---
phase: 10
slug: ux-interaction
status: verified
threats_open: 0
asvs_level: 2
created: 2026-06-17
register_authored_at_plan_time: true
---

# Phase 10 — Security

> Retroactive security contract for Phase 10: UX & Interaction.

## Trust Boundaries

| Boundary | Description | Data Crossing |
|---|---|---|
| Browser window events → Vue UI handlers | Keyboard shortcuts, drag events, modal Escape handlers, and menu positioning are handled client-side only. | Event metadata; no secrets or server-side authority. |
| OS file drag → `OsDragOverlay` → existing upload flow | Files arrive through the browser `DataTransfer` API and are forwarded into the existing authenticated upload path. | Browser-controlled `File` objects; existing quota/auth checks still apply on upload. |
| Route metadata → layout selection | `/admin/*` layout selection hides the user sidebar and shows admin chrome. | Route metadata only; backend/admin guard remains unchanged. |
| Vue templates → user-visible text | Breadcrumbs, empty states, toasts, and dropdown labels render through Vue interpolation. | Store/view strings; Vue escaping preserved. |

## Threat Register

| Threat ID | Category | Component | Disposition | Mitigation | Status |
|---|---|---|---|---|---|
| T-10-01 | Cross-Site Scripting | Breadcrumb, empty state, toast, and dropdown text rendering | mitigate | Vue template interpolation is used; no `v-html` or raw HTML injection introduced by Phase 10 UI components. | closed |
| T-10-02 | Information Disclosure | Toast notifications | mitigate | Toast payloads are generic action results such as upload/delete/rename/revoke status; no document content, extracted text, credentials, or token material is displayed. | closed |
| T-10-03 | Tampering | `OsDragOverlay` file drop handling | accept | Handler reads browser-provided `dataTransfer.files`, resets overlay state, and emits to the existing authenticated upload flow; no direct server write bypass is introduced. | closed |
| T-10-04 | Elevation of Privilege | Admin route layout selection | accept | `App.vue` admin branch changes presentation only; router `requiresAdmin` guard and backend `get_current_admin` enforcement are unchanged. | closed |
| T-10-05 | Spoofing | Keyboard shortcut dispatch through current route instance | accept | Shortcuts call methods on the mounted Vue route component only; no URL parameter or user-supplied string selects privileged behavior. | closed |
| T-10-06 | Denial of Service | Global keyboard and drag listeners | mitigate | Event listeners are added once at component mount and removed on unmount; drag overlay uses a bounded `dragDepth` counter and ignores non-file drags. | closed |
| T-10-07 | Supply Chain | Phase 10 frontend changes | accept | No new runtime packages were introduced by Phase 10; changes are Vue components, tests, and existing Tailwind/Vitest usage. | closed |
| T-10-08 | Supply Chain | Vite/esbuild dev dependency audit | mitigate | `npm audit --audit-level=high` found GHSA-gv7w-rqvm-qjhr through `vite@6.4.3`/`esbuild@0.25.12`; Vite was upgraded to `^8.0.16`, then audit, tests, and build were re-run. | closed |

*Status: open · closed*
*Disposition: mitigate (implementation required) · accept (documented risk) · transfer (third-party)*

## Accepted Risks Log

| Risk ID | Threat Ref | Rationale | Accepted By | Date |
|---|---|---|---|---|
| AR-10-01 | T-10-03 | The drop handler cannot bypass upload authorization or quota checks because it delegates to the existing upload flow. | project owner | 2026-06-17 |
| AR-10-02 | T-10-04 | Layout selection is presentation-only; authorization remains in router/backend gates. | project owner | 2026-06-17 |
| AR-10-03 | T-10-05 | Route-instance method lookup is local Vue state, not user-controlled input. | project owner | 2026-06-17 |
| AR-10-04 | T-10-07 | No new dependency was added in Phase 10. | project owner | 2026-06-17 |

## Audit Evidence

| Source | Finding |
|---|---|
| `10-01-SUMMARY.md` through `10-12-SUMMARY.md` | Threat flags are either "None" or document UI-only behavior with no new auth/network/schema surface. |
| `10-13-PLAN.md` | Contains a STRIDE register for the UAT gap-closure plan; all threats have accepted dispositions. |
| `10-13-SUMMARY.md` | Confirms gap-closure changes are display-only template/event-handler updates with no new network endpoints, auth paths, or schema changes. |
| `10-VERIFICATION.md` | Confirms 15/15 Phase 10 requirements passed after gap closure and no anti-patterns remain. |
| `10-VALIDATION.md` | Confirms Phase 10 validation coverage for UX and interaction requirements. |
| `npm audit --audit-level=high` | Initially found a high-severity esbuild advisory through Vite; after upgrading to Vite `^8.0.16`, npm reported 0 vulnerabilities. |

## Security Audit Trail

| Audit Date | Threats Total | Closed | Open | Run By |
|---|---:|---:|---:|---|
| 2026-06-17 | 8 | 8 | 0 | Codex (milestone audit remediation) |

## Sign-Off

- [x] All threats have a disposition.
- [x] Accepted risks documented.
- [x] No Phase 10 change introduces backend routes, auth changes, DB schema changes, or direct storage writes.
- [x] Existing upload/auth/admin enforcement remains the authority boundary.
- [x] High-severity npm audit finding resolved by Vite 8 upgrade.
- [x] `threats_open: 0` confirmed.

**Approval:** verified 2026-06-17