Files

Kunthawat Greethong ead9aeb25c chore: pre-existing in-tree work (event-study/research/vintages/prices + migration script + integrity docs)

Committing the prior uncommitted working-tree state that predates this session's
data-source work (was already modified/untracked at session start) so the tree
is clean before push. Includes: event-study + research report integrity/forward
observation work, prices tests, research hash migration script, and the
2026-08-23/24 engineering-log + test-evidence notes. Verified green as part of
the full 362-test suite.

2026-08-29 09:19:24 +07:00

3.3 KiB

Raw Blame History

Paper Auth Policy — 2026-08-24

Status

Complete for the paper-auth scope. The separate staged integrity-remediation review remains open. No commit or push was performed.

Goal

Make the paper-only write path explicit and safe for the local single-user demo while preserving fail-closed protected mode for shared/network deployments.

Changes

Added explicit demo and token paper-auth modes.
Restricted demo mode to a loopback bind; unknown and non-loopback bind hosts fail closed.
Passed the actual HOST/bind value from backend/run.py into the app factory.
Kept protected token mode as the default and fail-closed when its configured credential is missing or malformed.
Added truthful API/UI state for “configured but not yet authenticated” versus “paper writes disabled by server configuration.”
Added regression coverage for demo writes, non-loopback rejection, unknown bind rejection, missing credentials, malformed credential configuration, and pre-session enabled state.
Updated README and handoff documentation with the two operating modes.

Review Finding and Root-Cause Fix

The first independent review found that coercing a non-string configured credential to str(...) could turn malformed configuration into an accepted value. It also found that GET auth status conflated an unauthenticated browser session with a disabled server configuration. The fix validates configured credentials without coercion, reports an explicit enabled state, and prevents the UI from presenting a dead unlock/write path.

Verification Evidence

PYTHONPATH=backend .venv/bin/python -W error -m unittest discover -s backend/tests -v — 85 tests passed.
PYTHONPATH=backend .venv/bin/python -m compileall -q backend — passed.
npm run build — passed.
npm audit --omit=dev --audit-level=high — 0 vulnerabilities.
git diff --check and git diff --cached --check — passed.
Static diff scan for credential-shaped literals and dangerous patterns — no findings.
Environment smoke checks — loopback demo allowed; unknown and non-loopback demo binds rejected.
Fresh static-server verification on port 5175 — HTTP 200; served bundle contained the disabled-state copy and auth warning marker. Temporary server was stopped afterward.
ruff, mypy, and eslint are unavailable in this environment; no project lint script is configured for them.

Data Safety

The smoke test created only synthetic paper rows in the runtime ledger; those exact test rows were removed afterward. The ledger was verified to contain no remaining smoke-test entries. No credentials, tokens, secrets, or connection strings were recorded.

Independent Review

Fresh bounded review returned schema-valid passed=true with empty security-concern and logic-error arrays. Non-blocking suggestions: add one request-token type regression, add frontend integration coverage for both auth states, and add a startup precedence regression for HOST/PAPER_BIND_HOST.

Remaining Gate

The separate staged integrity-remediation review is now closed for this scope: schema correction deleg_a1c721d2 returned the exact required four-key verdict with passed=true and empty security/logic-error arrays. Earlier schema-invalid, timeout, and interrupted responses remain non-approving historical artifacts.

3.3 KiB Raw Blame History