test(07.4): complete UAT — 4 passed, 1 fixed (fgp concatenation collision)

UAT found and resolved a concatenation collision in _compute_fgp (no separator between user_agent and accept_lang). Fix committed in c77b97b. All 5 FGP tests pass. Full suite: 401 passed, 6 skipped, 7 xfailed, 1 pre-existing failure (test_extract_docx — missing docx module, unrelated to this phase). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-06 23:04:17 +02:00
parent c77b97b6d3
commit fd05563ec6
1 changed files with 66 additions and 0 deletions
@@ -0,0 +1,66 @@
+---
+status: complete
+phase: 07.4-security-token-fingerprinting-token-binding-inserted
+source: [07.4-01-SUMMARY.md, 07.4-02-SUMMARY.md]
+started: 2026-06-06T21:00:00Z
+updated: 2026-06-06T21:10:00Z
+---
+
+## Current Test
+
+[testing complete]
+
+## Tests
+
+### 1. Cold Start Smoke Test
+expected: Kill any running server/service. Start the application from scratch. Server boots without errors. Health check returns live response with all services healthy.
+result: pass
+notes: docker compose stop → rm -f → up -d; backend started clean, no errors in logs. GET /health returned {"status":"ok","checks":{"postgres":"ok","minio":"ok"}}
+
+### 2. Login and normal API access still work
+expected: Log in with valid credentials. Access token returned with fgp claim embedded. Protected endpoint returns 200 — fgp embedding is transparent to the user.
+result: pass
+notes: Login returned ES256 JWT. Decoded payload confirmed fgp="9a27732e18cd110c" present. GET /api/documents with matching User-Agent returned HTTP 200.
+
+### 3. Fingerprint mismatch is rejected
+expected: A token replayed from a different User-Agent should return HTTP 401 "Token fingerprint mismatch".
+result: pass
+notes: Token bound to Mozilla/5.0; replayed with "EvilBot/1.0 (stolen-token-replay)" and different Accept-Language. Response: {"detail":"Token fingerprint mismatch"} HTTP 401. Exact.
+
+### 4. Refresh flow preserved
+expected: Refresh endpoint issues a new fgp-bound access token. New token works with same UA, fails with different UA.
+result: pass
+notes: Refresh returned new JWT with same fgp ("9a27732e18cd110c"). New token: 200 with matching UA, 401 with "AnotherBot/2.0". httpOnly refresh cookie correctly stored with #HttpOnly_ prefix in curl jar.
+
+### 5. FGP test suite passes (5/5)
+expected: All FGP integration tests pass with no xfail stubs remaining. Full suite shows no new failures.
+result: issue
+reported: "4/4 tests passed initially. A concatenation collision vulnerability was found and fixed during UAT. A 5th regression test (FGP-05) was added. Full suite: 401 passed, 6 skipped, 7 xfailed, 1 failed (pre-existing docx ModuleNotFoundError). Final FGP suite: 5/5 passed."
+severity: major
+notes: Bug found and fixed in same session. See fix commit c77b97b.
+
+## Summary
+
+total: 5
+passed: 4
+issues: 1
+pending: 0
+skipped: 0
+blocked: 0
+
+## Gaps
+
+- truth: "_compute_fgp must not accept different splits of the same concatenated string as equivalent fingerprints"
+  status: fixed
+  reason: "User reported: token bound to UA='foobar'+AL='' was accepted by UA='foo'+AL='bar' — same HMAC input without separator"
+  severity: major
+  test: 5
+  root_cause: "Line 91 in backend/services/auth.py: `(user_agent + accept_lang).encode()` — no separator between the two fields allows concatenation collision"
+  artifacts:
+    - path: "backend/services/auth.py:91"
+      issue: "HMAC input lacks separator — user_agent + accept_lang ambiguous"
+  missing:
+    - "Null-byte separator between user_agent and accept_lang in HMAC input"
+    - "Regression test FGP-05 to prevent reintroduction"
+  fix_commit: "c77b97b"
+  fix_status: "resolved — separator added, regression test added, all 5 FGP tests pass"