fix: sha256:642bf10a1537bb32c2776dd2bee8efa243dc15921be82395332a6a24f7523248 · gabriel/musehub

fix: close domain-registration impersonation hole, fix stale docs URL

musehub#117 Phase 0 (DOM_02, DOM_03, DOM_04):

- DOM_02: register_domain() stored author_slug verbatim from the request body with no check against the caller's real authenticated handle (claims.handle) - any authenticated user could register a domain under someone else's namespace, e.g. '@aaronrene/anything' while authenticated as someone else. Now rejects with 403 when author_slug doesn't match the caller's own handle. Default deny, no delegation escape hatch - no delegation model exists yet. - DOM_03: docs_muse_domains.html claimed the registry lives at GET /api/musehub/domains - a URL that never existed. Fixed to the real, mounted GET /api/domains. - DOM_04: added TestDomainRegistryURLConsistency, which checks the docs page against the actually-mounted FastAPI route (introspected from app.routes, not a second hardcoded string) so the docs can never silently drift from reality again. The CLI side is guarded separately by test_publish_targets_api_domains_not_v1 in muse's own test suite.

symbols added

symbols modified

files changed

998

files in snapshot

dead code introduced

Semantic Changes 9 symbols

~ musehub/api/routes/musehub/domains.py .py 1 symbol modified

~ register_domain

~ musehub/templates/musehub/pages/docs_muse_domains.html .html 2 symbols modified

~ article@42

~ section#registry

~ tests/test_domains.py .py 5 symbols added, 1 symbol modified

+ TestDomainRegistryURLConsistency class class TestDomainRegistryURLConsistency L973–1001

+ test_docs_page_references_the_real_route_path method method test_docs_page_references_the_real_route_path L980–1001

+ test_register_domain_route_path method method test_register_domain_route_path L974–978

+ test_author_slug_matching_own_handle_still_succeeds method async_method test_author_slug_matching_own_handle_still_succeeds L787–803

+ test_author_slug_must_match_caller_handle method async_method test_author_slug_must_match_caller_handle L761–785

~ TestSecurity

Files Changed

998 in snapshot

~ musehub/api/routes/musehub/domains.py .py

~ musehub/templates/musehub/pages/docs_muse_domains.html .html

~ tests/test_domains.py .py

← Older Oldest on task/musehub-117-phase0-server

All commits

Newer → Latest on task/musehub-117-phase0-server

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:642bf10a1537bb32c2776dd2bee8efa243dc15921be82395332a6a24f7523248 --body "your comment"