79 lines
2.5 KiB
Markdown
79 lines
2.5 KiB
Markdown
# Phase 2.3 Failure Matrix — Grok G-5
|
||
|
||
**Commit:** `d6f087c21efb593ee7db58f816be98a2d087b3e3`
|
||
**Date:** 2026-08-18
|
||
|
||
## Credential / IDOR
|
||
|
||
| Attack | Result | Grade |
|
||
|--------|--------|-------|
|
||
| B uses A’s giveaway id | 403 owner check | OK |
|
||
| Client supplies foreign organizerId | ignored; session owner used | OK |
|
||
| Decrypt B credential as A | no path | OK |
|
||
| Null organizerId authorize | Forbidden | OK |
|
||
|
||
## Resolver / Fallback
|
||
|
||
| Case | Behaviour | Grade |
|
||
|------|-----------|-------|
|
||
| Public + SERVICE configured | SERVICE | OK |
|
||
| Private + SERVICE fail PrivateResource | USER fallback | OK |
|
||
| RateLimit on SERVICE | no fallback | OK |
|
||
| Network/Timeout/Validation | no fallback | OK |
|
||
| SERVICE→USER→SERVICE loop | no | OK |
|
||
| PermissionError fallback | allowed by policy | WARN |
|
||
|
||
## Refresh
|
||
|
||
| Case | Behaviour | Grade |
|
||
|------|-----------|-------|
|
||
| 20 concurrent expired | 1 HTTP refresh (test) | OK |
|
||
| 50–100 concurrent | intended single-flight; finally-delete race | WARN |
|
||
| A and B concurrent | separate keys | OK |
|
||
| null expiresAt | no refresh | WARN |
|
||
| identity mismatch on refresh | not checked | WARN |
|
||
| stale write overwrite | no CAS | WARN |
|
||
| invalid refresh / 429 / 500 | ReauthenticationRequired | OK |
|
||
| token in error/API | not by design | OK |
|
||
|
||
## Import / Capabilities
|
||
|
||
| Case | Behaviour | Grade |
|
||
|------|-----------|-------|
|
||
| Provider before ownership | no | OK |
|
||
| Idempotent completed import | cache hit | OK |
|
||
| Partial SERVICE + USER restart | must full restart | WARN |
|
||
| Stale UI capabilities | re-resolve on import | OK |
|
||
| Token in participants response | summary only | OK |
|
||
|
||
## VK contract
|
||
|
||
| Item | Verdict |
|
||
|------|---------|
|
||
| Refresh endpoint | VERIFIED / PARTIAL |
|
||
| device_id | UNVERIFIED |
|
||
| Scope separator | UNVERIFIED |
|
||
| Fallback policy | VERIFIED (product) |
|
||
| Definitely WRONG | None |
|
||
|
||
---
|
||
|
||
## Summary grades
|
||
|
||
| Area | Grade |
|
||
|------|-------|
|
||
| Credential isolation | **PASS** |
|
||
| Resolver | **PASS WITH WARNINGS** |
|
||
| Refresh | **PASS WITH WARNINGS** |
|
||
| Refresh concurrency | **PASS WITH WARNINGS** |
|
||
| Fallback | **PASS WITH WARNINGS** |
|
||
| Capabilities | **PASS WITH WARNINGS** |
|
||
| Token confidentiality | **PASS** |
|
||
| Participant import | **PASS WITH WARNINGS** |
|
||
| VK contract | **PASS WITH WARNINGS** |
|
||
| **Overall** | **PASS WITH FIXES** |
|
||
|
||
## Smoke-test readiness
|
||
|
||
**YES** — no CRITICAL blockers for controlled real VK smoke.
|
||
Watch: single-flight under load, null expiry, fallback only private/permission, zero token leakage in responses/logs.
|