30 lines
1.9 KiB
Markdown
30 lines
1.9 KiB
Markdown
---
|
|
status: all_fixed
|
|
phase: 02-bot-skeleton-initdata-security
|
|
source: [02-REVIEW.md]
|
|
fixed: 2026-10-22
|
|
---
|
|
|
|
## Fix Summary
|
|
|
|
| Finding | Fix | Commit | Verification |
|
|
|---|---|---|---|
|
|
| WR-01 unbounded body read on `/api/session` | `bot/src/webhook.ts`: 4 KB pre-read Content-Length rejection + post-read backstop → 413, category-only logs | `8995498` | WK1 valid mint 200; WK2 over-cap signed body → 413, zero KV writes, log `"[initdata] rejected: malformed"`; WK2b lying Content-Length → 413; WK3 broken stream resolves 413 |
|
|
| WR-02 fail-open webhook when secret missing | `webhook.ts`: missing/empty `WEBHOOK_SECRET` binding → constant 500 + `[webhook] rejected: misconfigured` before grammY accept-all path; `config.ts` REQUIRED comment | `3ea1fdd` | WK5 unarmed → two consecutive constant 500s, no bot wiring, no KV touch; RED evidence recorded pre-fix; armed+unsigned covered by live 02-03 smokes (401) |
|
|
| WR-03 rotate-on-new atomicity over-claim | `sessions.ts`: honest invariant documented (intended single live token; reconciliation at mint/next use; orphans TTL-bounded; Phase 4 must not assume more) + best-effort post-mint sweep | `af691ae` | SR2 re-worded sequential; SR3 stale-replica emulation asserts honest outcome; PG1/PG2 unchanged |
|
|
|
|
Adjacent INFO fixed in same commits: IN-01(b) dead branch removed, IN-01(c) Phase-4 don't-delete notes added.
|
|
|
|
Out of scope (Phase 7 audit): IN-01(a), IN-02, IN-03, IN-04, IN-05.
|
|
|
|
## Verification
|
|
|
|
- `npm test -w bot` → **34 passed, 0 failed** (was 27)
|
|
- `npm run bot:typecheck` → exit 0
|
|
- All 4 `console.*` in bot/src are category-only (no payload/uid/timestamp/coords)
|
|
- Redeployed after fixes: version `b6ba6e58`; live `/api/session` garbage → 401; webhook pending 0; only stale (pre-fix) last_error
|
|
|
|
## Review status
|
|
|
|
02-REVIEW.md status `issues_found` → all Critical+Warning findings fixed; 3 INFO deferred deliberately.
|