thecrealm/katrix
1
0
Fork 0
Code Issues 23 Pull requests Projects Releases Packages Wiki Activity Actions

NFR-14: gate that every outbound request targets the configured homeserver #160

New issue
Open
opened 2026-08-27 19:21:20 +02:00 by thecrealm · 0 comments
thecrealm commented 2026-08-27 19:21:20 +02:00
Owner
Copy link

Review finding 2026-08-27 (D6). No test or structural check exists; KtorHttpPort.transportUrl builds from the request's baseUrl, and OidcAuthProvider.absolute(...) can target any absolute URL.

Acceptance (NFR-14, §9): a recording HttpPort under the conformance scenarios asserting request.baseUrl ∈ {homeserver, OIDC issuer from the homeserver's auth metadata}; a structural check that absolute() callers are limited to OidcAuthProvider.

Review finding 2026-08-27 (D6). No test or structural check exists; `KtorHttpPort.transportUrl` builds from the request's `baseUrl`, and `OidcAuthProvider.absolute(...)` can target any absolute URL. Acceptance (NFR-14, §9): a recording `HttpPort` under the conformance scenarios asserting `request.baseUrl ∈ {homeserver, OIDC issuer from the homeserver's auth metadata}`; a structural check that `absolute()` callers are limited to `OidcAuthProvider`.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
spec-v1
Labels
Clear labels   
M0

   
M1

   
M2

   
M3

   
M4

   
M5

   
M6

   
blocked

   
next

   
now

   
priority
Jump the queue: work before other next items in the same milestone

No labels
M0
M1
M2
M3
M4
M5
M6
blocked
next
now
priority
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
thecrealm/katrix#160
No description provided.