Marctrem/graduate oasis keys teamresource - #19
Open
marctrem wants to merge 2 commits into
Open
Conversation
…uested_parent_node_id from priv Three additions promoted from the priv-side overlay: - splitsecure.oasis.saml.v2 (28 files): the base OASIS SAML 2.0 metadata types as a standalone package. These mirror the OASIS standard and only import google well-known types. The inline copies in splitsecure.saml2.v2.metadata remain untouched; the saml2 v3 surface will build on this package instead. - splitsecure.keys.v1.AsymmetricEncryptionSpec + the asymmetric_encryption arm (field 5) on keys.v1.Spec: RSA decryption/encapsulation keys, used by OpenPGP [E] subkeys and RSA-only keys. - teamresource.v1.BaseResourceAttributes.requested_parent_node_id (field 6): the creator-chosen vault-tree placement carried in the quorum-signed part of a create request. A birth-time request only - resources are movable afterwards without a new ceremony.
Stable identity across supersession for v2 attested issuances: every edit is a new CREATE presenting its predecessor, all versions share one lineage. lineage_id is empty at genesis (a genesis record's lineage id is the domain-tagged digest of its own signed bytes) and enclave-stamped verbatim from the predecessor on a superseding CREATE; revision counts supersessions within the lineage. Both live in the quorum-signed bytes.
WalkthroughAdds an RSA asymmetric-encryption specification, a SAML v2 metadata protobuf model spanning primitives and descriptors, and parent, lineage, and revision fields to resource attributes. ChangesAsymmetric encryption schema
SAML metadata schema
Resource lineage attributes
Estimated code review effort: 3 (Moderate) | ~25 minutes 🚥 Pre-merge checks | ✅ 3 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (3 passed)
✨ Finishing Touches⚔️ Resolve merge conflicts
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 13
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@proto/splitsecure/keys/v1/asymmetric_encryption_spec.proto`:
- Around line 6-9: Extend AsymmetricEncryptionSpec and its RSA configuration to
represent encryption-specific parameters, including an encryption padding choice
such as OAEP, separately from signing parameters. Update the protobuf schema and
generated artifacts or corresponding consumers so callers can select a safe RSA
encryption configuration without relying on signature_scheme.
In `@proto/splitsecure/oasis/saml/v2/attribute_consuming_service.proto`:
- Around line 9-10: Constrain AttributeConsumingService.index to the SAML
unsigned-short range by validating and rejecting values greater than 65535
before metadata publication. Keep the existing uint32 protobuf field, and update
the validation path for AttributeConsumingService rather than changing unrelated
fields.
In `@proto/splitsecure/oasis/saml/v2/attribute.proto`:
- Around line 15-16: Update the SAML attribute_value field in the proto
definition to use a lossless structured representation rather than repeated
string, preserving nested XML, namespaces, and typed AttributeValue content
during round trips.
In `@proto/splitsecure/oasis/saml/v2/authn_authority_descriptor.proto`:
- Around line 12-13: Add runtime minimum-cardinality validation for every
required endpoint list in authn_authority_descriptor.proto (lines 12-13),
pdp_descriptor.proto (lines 12-13), attribute_authority_descriptor.proto (lines
13-14), idp_sso_descriptor.proto (lines 16-17), and sp_sso_descriptor.proto
(lines 19-20), ensuring each repeated endpoint field rejects empty lists while
preserving the existing schema declarations.
In `@proto/splitsecure/oasis/saml/v2/encryption_method.proto`:
- Around line 9-10: Update the key_size field in the encryption method schema to
preserve presence, using proto3 optionality or an equivalent wrapper, and
enforce validation that any explicitly provided value must be greater than zero
while allowing the field to remain unset.
In `@proto/splitsecure/oasis/saml/v2/entity_descriptor.proto`:
- Around line 28-36: Model the SAML XML choices as protobuf unions: in
entity_descriptor.proto, replace the parallel role fields and
affiliation_descriptor with an ordered oneof while preserving repeated role
entries; in entities_descriptor.proto, place entity_descriptor and
entities_descriptor in a single ordered oneof; and in metadata.proto, add
EntitiesDescriptor as a branch of the top-level oneof. Apply these changes at
entity_descriptor.proto:28-36, entities_descriptor.proto:17-19, and
metadata.proto:8-10.
In `@proto/splitsecure/oasis/saml/v2/indexed_endpoint.proto`:
- Around line 11-12: Update the index field in indexed_endpoint.proto to use
explicit presence and enforce the SAML endpoint range of 0 through 65535 with
the project’s existing validation annotations, so unset remains distinguishable
from an explicit zero.
In `@proto/splitsecure/oasis/saml/v2/key_info.proto`:
- Around line 12-13: Define an explicit encoding contract for the key_value
field in the key-info schema, specifying the exact representation consumers must
provide and receive. Update the associated validation or parsing logic to
enforce that format; alternatively, replace key_value with the existing typed
key representation if one is available. Keep the field’s optional behavior
unchanged.
In `@proto/splitsecure/oasis/saml/v2/requested_attribute.proto`:
- Around line 7-12: Update the RequestedAttribute message to remove the nested
Attribute field and define the inherited SAML attribute fields directly: name,
name_format, friendly_name, and attribute_value, while retaining is_required.
Use the existing field types and compatible numbering conventions from Attribute
so the generated shape matches SAML metadata.
In `@proto/splitsecure/oasis/saml/v2/role_descriptor_type.proto`:
- Around line 28-29: Enforce non-empty presence for required SAML metadata
fields by adding the project’s standard proto validation rules in
proto/splitsecure/oasis/saml/v2/role_descriptor_type.proto:28-29 (including
protocol_support_enumeration), contact_person.proto:9-10,
encryption_method.proto:6-7, key_descriptor.proto:13-14,
organization.proto:13-20, and additional_metadata_location.proto:6-10. Apply
validation to every required field at these sites so omitted or empty values are
rejected while optional fields remain unchanged.
- Around line 13-14: Update the signature field in role_descriptor_type.proto to
define the XMLDSig wire format explicitly: either document the exact serialized
representation expected for signature or replace the raw bytes field with a
structured signature type. Preserve the optional signature semantics and ensure
consumers can unambiguously serialize and parse it.
In `@proto/splitsecure/oasis/saml/v2/sso_descriptor_type.proto`:
- Around line 13-14: Enforce collection-level uniqueness of the index field for
the repeated IndexedEndpoint fields: update
proto/splitsecure/oasis/saml/v2/sso_descriptor_type.proto lines 13-14 and
proto/splitsecure/oasis/saml/v2/sp_sso_descriptor.proto lines 19-20. Apply the
project’s existing validation mechanism so duplicate index values are rejected
within each collection while preserving the current endpoint definitions.
In `@proto/splitsecure/teamresource/v1/base_resource_attributes.proto`:
- Around line 25-34: The supersession logic must preserve a genesis resource’s
effective lineage ID when creating its first successor. In the enclave flow that
stamps `lineage_id`, use `predecessor.lineage_id` when present, otherwise use
the predecessor’s domain-tagged signed-issuance digest, and write that effective
value into the successor; add a test covering genesis-to-first-successor lineage
continuity.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 53f14670-f970-41c7-8876-0287198bfc32
⛔ Files ignored due to path filters (62)
gen/es/proto/splitsecure/keys/v1/asymmetric_encryption_spec_pb.tsis excluded by!**/gen/**gen/es/proto/splitsecure/keys/v1/spec_pb.tsis excluded by!**/gen/**gen/es/proto/splitsecure/oasis/saml/v2/additional_metadata_location_pb.tsis excluded by!**/gen/**gen/es/proto/splitsecure/oasis/saml/v2/affiliation_descriptor_pb.tsis excluded by!**/gen/**gen/es/proto/splitsecure/oasis/saml/v2/attribute_authority_descriptor_pb.tsis excluded by!**/gen/**gen/es/proto/splitsecure/oasis/saml/v2/attribute_consuming_service_pb.tsis excluded by!**/gen/**gen/es/proto/splitsecure/oasis/saml/v2/attribute_pb.tsis excluded by!**/gen/**gen/es/proto/splitsecure/oasis/saml/v2/authn_authority_descriptor_pb.tsis excluded by!**/gen/**gen/es/proto/splitsecure/oasis/saml/v2/contact_person_pb.tsis excluded by!**/gen/**gen/es/proto/splitsecure/oasis/saml/v2/contact_type_pb.tsis excluded by!**/gen/**gen/es/proto/splitsecure/oasis/saml/v2/encryption_method_pb.tsis excluded by!**/gen/**gen/es/proto/splitsecure/oasis/saml/v2/endpoint_pb.tsis excluded by!**/gen/**gen/es/proto/splitsecure/oasis/saml/v2/entities_descriptor_pb.tsis excluded by!**/gen/**gen/es/proto/splitsecure/oasis/saml/v2/entity_descriptor_pb.tsis excluded by!**/gen/**gen/es/proto/splitsecure/oasis/saml/v2/extension_pb.tsis excluded by!**/gen/**gen/es/proto/splitsecure/oasis/saml/v2/extensions_pb.tsis excluded by!**/gen/**gen/es/proto/splitsecure/oasis/saml/v2/idp_sso_descriptor_pb.tsis excluded by!**/gen/**gen/es/proto/splitsecure/oasis/saml/v2/indexed_endpoint_pb.tsis excluded by!**/gen/**gen/es/proto/splitsecure/oasis/saml/v2/key_descriptor_pb.tsis excluded by!**/gen/**gen/es/proto/splitsecure/oasis/saml/v2/key_info_pb.tsis excluded by!**/gen/**gen/es/proto/splitsecure/oasis/saml/v2/key_type_pb.tsis excluded by!**/gen/**gen/es/proto/splitsecure/oasis/saml/v2/localized_name_pb.tsis excluded by!**/gen/**gen/es/proto/splitsecure/oasis/saml/v2/localized_uri_pb.tsis excluded by!**/gen/**gen/es/proto/splitsecure/oasis/saml/v2/metadata_pb.tsis excluded by!**/gen/**gen/es/proto/splitsecure/oasis/saml/v2/organization_pb.tsis excluded by!**/gen/**gen/es/proto/splitsecure/oasis/saml/v2/pdp_descriptor_pb.tsis excluded by!**/gen/**gen/es/proto/splitsecure/oasis/saml/v2/requested_attribute_pb.tsis excluded by!**/gen/**gen/es/proto/splitsecure/oasis/saml/v2/role_descriptor_type_pb.tsis excluded by!**/gen/**gen/es/proto/splitsecure/oasis/saml/v2/sp_sso_descriptor_pb.tsis excluded by!**/gen/**gen/es/proto/splitsecure/oasis/saml/v2/sso_descriptor_type_pb.tsis excluded by!**/gen/**gen/es/proto/splitsecure/teamresource/v1/base_resource_attributes_pb.tsis excluded by!**/gen/**gen/go/proto/splitsecure/keys/v1/asymmetric_encryption_spec.pb.gois excluded by!**/*.pb.go,!**/gen/**gen/go/proto/splitsecure/keys/v1/spec.pb.gois excluded by!**/*.pb.go,!**/gen/**gen/go/proto/splitsecure/oasis/saml/v2/additional_metadata_location.pb.gois excluded by!**/*.pb.go,!**/gen/**gen/go/proto/splitsecure/oasis/saml/v2/affiliation_descriptor.pb.gois excluded by!**/*.pb.go,!**/gen/**gen/go/proto/splitsecure/oasis/saml/v2/attribute.pb.gois excluded by!**/*.pb.go,!**/gen/**gen/go/proto/splitsecure/oasis/saml/v2/attribute_authority_descriptor.pb.gois excluded by!**/*.pb.go,!**/gen/**gen/go/proto/splitsecure/oasis/saml/v2/attribute_consuming_service.pb.gois excluded by!**/*.pb.go,!**/gen/**gen/go/proto/splitsecure/oasis/saml/v2/authn_authority_descriptor.pb.gois excluded by!**/*.pb.go,!**/gen/**gen/go/proto/splitsecure/oasis/saml/v2/contact_person.pb.gois excluded by!**/*.pb.go,!**/gen/**gen/go/proto/splitsecure/oasis/saml/v2/contact_type.pb.gois excluded by!**/*.pb.go,!**/gen/**gen/go/proto/splitsecure/oasis/saml/v2/encryption_method.pb.gois excluded by!**/*.pb.go,!**/gen/**gen/go/proto/splitsecure/oasis/saml/v2/endpoint.pb.gois excluded by!**/*.pb.go,!**/gen/**gen/go/proto/splitsecure/oasis/saml/v2/entities_descriptor.pb.gois excluded by!**/*.pb.go,!**/gen/**gen/go/proto/splitsecure/oasis/saml/v2/entity_descriptor.pb.gois excluded by!**/*.pb.go,!**/gen/**gen/go/proto/splitsecure/oasis/saml/v2/extension.pb.gois excluded by!**/*.pb.go,!**/gen/**gen/go/proto/splitsecure/oasis/saml/v2/extensions.pb.gois excluded by!**/*.pb.go,!**/gen/**gen/go/proto/splitsecure/oasis/saml/v2/idp_sso_descriptor.pb.gois excluded by!**/*.pb.go,!**/gen/**gen/go/proto/splitsecure/oasis/saml/v2/indexed_endpoint.pb.gois excluded by!**/*.pb.go,!**/gen/**gen/go/proto/splitsecure/oasis/saml/v2/key_descriptor.pb.gois excluded by!**/*.pb.go,!**/gen/**gen/go/proto/splitsecure/oasis/saml/v2/key_info.pb.gois excluded by!**/*.pb.go,!**/gen/**gen/go/proto/splitsecure/oasis/saml/v2/key_type.pb.gois excluded by!**/*.pb.go,!**/gen/**gen/go/proto/splitsecure/oasis/saml/v2/localized_name.pb.gois excluded by!**/*.pb.go,!**/gen/**gen/go/proto/splitsecure/oasis/saml/v2/localized_uri.pb.gois excluded by!**/*.pb.go,!**/gen/**gen/go/proto/splitsecure/oasis/saml/v2/metadata.pb.gois excluded by!**/*.pb.go,!**/gen/**gen/go/proto/splitsecure/oasis/saml/v2/organization.pb.gois excluded by!**/*.pb.go,!**/gen/**gen/go/proto/splitsecure/oasis/saml/v2/pdp_descriptor.pb.gois excluded by!**/*.pb.go,!**/gen/**gen/go/proto/splitsecure/oasis/saml/v2/requested_attribute.pb.gois excluded by!**/*.pb.go,!**/gen/**gen/go/proto/splitsecure/oasis/saml/v2/role_descriptor_type.pb.gois excluded by!**/*.pb.go,!**/gen/**gen/go/proto/splitsecure/oasis/saml/v2/sp_sso_descriptor.pb.gois excluded by!**/*.pb.go,!**/gen/**gen/go/proto/splitsecure/oasis/saml/v2/sso_descriptor_type.pb.gois excluded by!**/*.pb.go,!**/gen/**gen/go/proto/splitsecure/teamresource/v1/base_resource_attributes.pb.gois excluded by!**/*.pb.go,!**/gen/**
📒 Files selected for processing (31)
proto/splitsecure/keys/v1/asymmetric_encryption_spec.protoproto/splitsecure/keys/v1/spec.protoproto/splitsecure/oasis/saml/v2/additional_metadata_location.protoproto/splitsecure/oasis/saml/v2/affiliation_descriptor.protoproto/splitsecure/oasis/saml/v2/attribute.protoproto/splitsecure/oasis/saml/v2/attribute_authority_descriptor.protoproto/splitsecure/oasis/saml/v2/attribute_consuming_service.protoproto/splitsecure/oasis/saml/v2/authn_authority_descriptor.protoproto/splitsecure/oasis/saml/v2/contact_person.protoproto/splitsecure/oasis/saml/v2/contact_type.protoproto/splitsecure/oasis/saml/v2/encryption_method.protoproto/splitsecure/oasis/saml/v2/endpoint.protoproto/splitsecure/oasis/saml/v2/entities_descriptor.protoproto/splitsecure/oasis/saml/v2/entity_descriptor.protoproto/splitsecure/oasis/saml/v2/extension.protoproto/splitsecure/oasis/saml/v2/extensions.protoproto/splitsecure/oasis/saml/v2/idp_sso_descriptor.protoproto/splitsecure/oasis/saml/v2/indexed_endpoint.protoproto/splitsecure/oasis/saml/v2/key_descriptor.protoproto/splitsecure/oasis/saml/v2/key_info.protoproto/splitsecure/oasis/saml/v2/key_type.protoproto/splitsecure/oasis/saml/v2/localized_name.protoproto/splitsecure/oasis/saml/v2/localized_uri.protoproto/splitsecure/oasis/saml/v2/metadata.protoproto/splitsecure/oasis/saml/v2/organization.protoproto/splitsecure/oasis/saml/v2/pdp_descriptor.protoproto/splitsecure/oasis/saml/v2/requested_attribute.protoproto/splitsecure/oasis/saml/v2/role_descriptor_type.protoproto/splitsecure/oasis/saml/v2/sp_sso_descriptor.protoproto/splitsecure/oasis/saml/v2/sso_descriptor_type.protoproto/splitsecure/teamresource/v1/base_resource_attributes.proto
📜 Review details
🔇 Additional comments (11)
proto/splitsecure/teamresource/v1/base_resource_attributes.proto (1)
15-23: LGTM!Also applies to: 36-39
proto/splitsecure/keys/v1/spec.proto (2)
4-4: LGTM!
16-16: LGTM!proto/splitsecure/oasis/saml/v2/extension.proto (1)
1-14: LGTM!proto/splitsecure/oasis/saml/v2/extensions.proto (1)
1-10: LGTM!proto/splitsecure/oasis/saml/v2/endpoint.proto (1)
1-14: LGTM!proto/splitsecure/oasis/saml/v2/localized_name.proto (1)
4-10: LGTM!proto/splitsecure/oasis/saml/v2/localized_uri.proto (1)
4-10: LGTM!proto/splitsecure/oasis/saml/v2/affiliation_descriptor.proto (1)
9-33: LGTM!proto/splitsecure/oasis/saml/v2/contact_type.proto (1)
4-10: LGTM!proto/splitsecure/oasis/saml/v2/key_type.proto (1)
4-8: LGTM!
Comment on lines
+6
to
+9
| message AsymmetricEncryptionSpec { | ||
| oneof union { | ||
| RSA rsa = 1; | ||
| } |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n## proto/splitsecure/keys/v1/asymmetric_encryption_spec.proto\n'
cat -n proto/splitsecure/keys/v1/asymmetric_encryption_spec.proto
printf '\n## Search for RSA message definition and related specs\n'
rg -n "message RSA|signature_scheme|AsymmetricEncryptionSpec|Asymmetric.*Spec|OAEP|padding|encryption_scheme" proto -S
printf '\n## List nearby proto files\n'
find proto -maxdepth 4 -type f | sort | sed -n '1,200p'Repository: splitsecure/apis
Length of output: 8087
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "need to inspect repository"Repository: splitsecure/apis
Length of output: 181
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Show the encryption spec and the RSA message definition if present.
for f in \
proto/splitsecure/keys/v1/asymmetric_encryption_spec.proto \
proto/splitsecure/keys/v1/*.proto
do
[ -f "$f" ] || continue
done
echo '## asymmetric_encryption_spec.proto'
cat -n proto/splitsecure/keys/v1/asymmetric_encryption_spec.proto
echo
echo '## Files containing "message RSA"'
rg -n "^message RSA\b" proto/splitsecure/keys/v1 -S || true
echo
echo '## Files containing signature_scheme / OAEP / encryption scheme'
rg -n "signature_scheme|OAEP|padding|encryption_scheme|PKCS#1|PSS" proto/splitsecure/keys/v1 -S || trueRepository: splitsecure/apis
Length of output: 723
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo '## proto/splitsecure/keys/v1/rsa.proto'
cat -n proto/splitsecure/keys/v1/rsa.proto
echo
echo '## proto/splitsecure/keys/v1/symmetric_encryption_spec.proto'
cat -n proto/splitsecure/keys/v1/symmetric_encryption_spec.proto
echo
echo '## proto/splitsecure/keys/v1/key_encapsulation_spec.proto'
cat -n proto/splitsecure/keys/v1/key_encapsulation_spec.proto
echo
echo '## proto/splitsecure/keys/v1/spec.proto'
cat -n proto/splitsecure/keys/v1/spec.protoRepository: splitsecure/apis
Length of output: 1909
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo '## References to AsymmetricEncryptionSpec'
rg -n "AsymmetricEncryptionSpec|asymmetric_encryption" proto -S
echo
echo '## References to RSA in key-related protos'
rg -n "\bRSA\b" proto/splitsecure/keys/v1 -SRepository: splitsecure/apis
Length of output: 731
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "waiting for shell results"Repository: splitsecure/apis
Length of output: 180
Define RSA encryption parameters here. AsymmetricEncryptionSpec only wraps RSA, and that type carries bits plus signature_scheme for PKCS#1 v1.5/PSS signing. It cannot describe RSA encryption or padding like OAEP, so this contract can’t represent a safe asymmetric-encryption choice.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@proto/splitsecure/keys/v1/asymmetric_encryption_spec.proto` around lines 6 -
9, Extend AsymmetricEncryptionSpec and its RSA configuration to represent
encryption-specific parameters, including an encryption padding choice such as
OAEP, separately from signing parameters. Update the protobuf schema and
generated artifacts or corresponding consumers so callers can select a safe RSA
encryption configuration without relying on signature_scheme.
Comment on lines
+9
to
+10
| // Required: index | ||
| uint32 index = 1; |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Inspect the proto definition and search for any range validation around AttributeConsumingService.index
git ls-files 'proto/splitsecure/oasis/saml/v2/*' | sed 's#^`#FILE` #'
echo
ast-grep outline proto/splitsecure/oasis/saml/v2/attribute_consuming_service.proto --view expanded || true
echo
cat -n proto/splitsecure/oasis/saml/v2/attribute_consuming_service.proto
echo
rg -n "AttributeConsumingService|index\s*=|65535|unsignedShort|range|validate|validation" proto/splitsecure/oasis/saml/v2 -S || trueRepository: splitsecure/apis
Length of output: 3255
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Check whether the project already documents or validates this SAML metadata constraint elsewhere.
rg -n "AttributeConsumingService\.index|unsignedShort|65535|SAML metadata|saml-metadata" . -S || trueRepository: splitsecure/apis
Length of output: 811
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Verify the OASIS SAML metadata definition for AttributeConsumingService@index using local text search if a copy exists.
fd -a -t f 'saml-metadata-2.0-os.pdf|*.pdf|*.xml|*.xsd|*.md' . 2>/dev/null | sed -n '1,120p'Repository: splitsecure/apis
Length of output: 154
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== files =="
git ls-files 'proto/splitsecure/oasis/saml/v2/*' | sort
echo
echo "== attribute_consuming_service.proto =="
cat -n proto/splitsecure/oasis/saml/v2/attribute_consuming_service.proto
echo
echo "== related references =="
rg -n "AttributeConsumingService|unsignedShort|65535|validate|validation|index = 1" proto/splitsecure/oasis/saml/v2 . -S || trueRepository: splitsecure/apis
Length of output: 14926
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Minimal targeted inspection of the file under review.
sed -n '1,80p' proto/splitsecure/oasis/saml/v2/attribute_consuming_service.protoRepository: splitsecure/apis
Length of output: 855
🌐 Web query:
OASIS SAML metadata AttributeConsumingService index unsignedShort specification
💡 Result:
In the OASIS SAML V2.0 metadata specification, the index attribute of the AttributeConsumingService element is defined with the data type xsd:unsignedShort [1][2][3]. This attribute is a required component of the AttributeConsumingServiceType complex type [4][5][6]. Its purpose is to assign a unique integer value to the element, allowing it to be referenced in SAML protocol messages [4][7]. As it is defined as an xsd:unsignedShort, the value must be a non-negative integer within the range of 0 to 65,535.
Citations:
- 1: https://git.unl.edu/iam-pub/metadata/-/blob/594-update-nytimes-metadata/docs.oasis-open.org_security_saml_v2.0_saml-schema-metadata-2.0.xsd
- 2: https://www.datypic.com/sc/saml2/e-md_AttributeConsumingService.html
- 3: https://repository.data2type.de/SAML/v_2.0/html/at.AttributeConsumingServiceType_index.html
- 4: https://docs.oasis-open.org/security/saml/v2.0/saml-metadata-2.0-os.pdf
- 5: https://www.keycloak.org/docs-api/26.3.2/javadocs/org/keycloak/dom/saml/v2/metadata/AttributeConsumingServiceType.html
- 6: https://docs.jboss.org/seam/3/3.0.0.CR1/api/org/jboss/seam/security/external/jaxb/samlv2/metadata/AttributeConsumingServiceType.html
- 7: https://xml.coverpages.org/SSTC-SAMLMetadataV20Draft08-7750.pdf
Constrain AttributeConsumingService.index to 0..65535.
uint32 allows values outside SAML’s xsd:unsignedShort range. Keep the protobuf type if needed, but reject index > 65535 before publishing metadata.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@proto/splitsecure/oasis/saml/v2/attribute_consuming_service.proto` around
lines 9 - 10, Constrain AttributeConsumingService.index to the SAML
unsigned-short range by validating and rejecting values greater than 65535
before metadata publication. Keep the existing uint32 protobuf field, and update
the validation path for AttributeConsumingService rather than changing unrelated
fields.
Comment on lines
+15
to
+16
| // Optional: attribute values | ||
| repeated string attribute_value = 4; |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
git ls-files proto/splitsecure/oasis/saml/v2/attribute.proto
cat -n proto/splitsecure/oasis/saml/v2/attribute.proto
rg -n "attribute_value|AttributeValue|saml/v2/attribute" proto -SRepository: splitsecure/apis
Length of output: 1452
🏁 Script executed:
ast-grep outline proto/splitsecure/oasis/saml/v2/attribute.proto --view expanded
ast-grep outline proto/splitsecure/saml2/v2/metadata.proto --view expanded
cat -n proto/splitsecure/oasis/saml/v2/requested_attribute.proto
cat -n proto/splitsecure/oasis/saml/v2/attribute_authority_descriptor.proto
cat -n proto/splitsecure/oasis/saml/v2/idp_sso_descriptor.proto
cat -n proto/splitsecure/oasis/saml/v2/sp_sso_descriptor.protoRepository: splitsecure/apis
Length of output: 3792
🏁 Script executed:
rg -n "google\.protobuf\.Any|bytes .*xml|raw xml|anyType|xsi:type|xmlns|element|fragment|CDATA|AttributeValue|attribute_value" proto -SRepository: splitsecure/apis
Length of output: 1505
🏁 Script executed:
cat -n proto/splitsecure/saml2/v2/metadata.proto | sed -n '350,460p'
cat -n proto/splitsecure/oasis/saml/v2/extension.proto
cat -n proto/splitsecure/oasis/saml/v2/extensions.proto
rg -n "message Attribute|message RequestedAttribute|message Extensions|message Extension|message AttributeValue" proto/splitsecure/oasis/saml/v2 -SRepository: splitsecure/apis
Length of output: 4422
Preserve structured SAML AttributeValue content. repeated string attribute_value strips nested XML, namespaces, and typed values, so valid SAML values cannot round-trip. Use a lossless representation instead.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@proto/splitsecure/oasis/saml/v2/attribute.proto` around lines 15 - 16, Update
the SAML attribute_value field in the proto definition to use a lossless
structured representation rather than repeated string, preserving nested XML,
namespaces, and typed AttributeValue content during round trips.
Comment on lines
+12
to
+13
| // Required: authentication query service endpoints (at least one) | ||
| repeated Endpoint authn_query_service = 2; |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Map the relevant files and inspect surrounding context.
for f in \
proto/splitsecure/oasis/saml/v2/authn_authority_descriptor.proto \
proto/splitsecure/oasis/saml/v2/pdp_descriptor.proto \
proto/splitsecure/oasis/saml/v2/attribute_authority_descriptor.proto \
proto/splitsecure/oasis/saml/v2/idp_sso_descriptor.proto \
proto/splitsecure/oasis/saml/v2/sp_sso_descriptor.proto \
proto/splitsecure/oasis/saml/v2/sso_descriptor_type.proto
do
echo "===== $f ====="
wc -l "$f"
sed -n '1,220p' "$f"
echo
done
# Find any validation logic or tests that enforce non-empty endpoint collections.
echo "===== SEARCH: validation / required / endpoints ====="
rg -n --hidden --glob '!.git' \
-e 'required.*endpoint|at least one|non-empty|len\(.+\) > 0|size\(.+\) > 0|validate.*descriptor|descriptor.*validate|assertion_consumer_service|single_sign_on_service|authn_query_service|authz_service|attribute_service' \
proto . || trueRepository: splitsecure/apis
Length of output: 28541
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Look for any validation layer or constructors that enforce non-empty endpoint lists.
rg -n --hidden --glob '!.git' \
-e 'func .*Validate|Validate\(|validation|non-empty|at least one|required.*service|assertion_consumer_service|single_sign_on_service|authn_query_service|authz_service|attribute_service' \
proto/splitsecure/oasis/saml/v2 gen/go/proto/splitsecure/oasis/saml/v2 gen/es/proto/splitsecure/oasis/saml/v2 || true
# Inspect the generated Go for the five descriptors to see whether any constraints are encoded.
for f in \
gen/go/proto/splitsecure/oasis/saml/v2/authn_authority_descriptor.pb.go \
gen/go/proto/splitsecure/oasis/saml/v2/pdp_descriptor.pb.go \
gen/go/proto/splitsecure/oasis/saml/v2/attribute_authority_descriptor.pb.go \
gen/go/proto/splitsecure/oasis/saml/v2/idp_sso_descriptor.pb.go \
gen/go/proto/splitsecure/oasis/saml/v2/sp_sso_descriptor.pb.go
do
echo "===== $f ====="
rg -n 'type .*Descriptor|Validate|Required:|repeated|rep,name=' "$f"
doneRepository: splitsecure/apis
Length of output: 13247
Add validation for required SAML endpoint lists
All five fields are still plain repeated proto3 fields, so empty endpoint lists can be serialized even though the schema marks them as required. Add runtime validation for the minimum cardinality on:
proto/splitsecure/oasis/saml/v2/authn_authority_descriptor.protoproto/splitsecure/oasis/saml/v2/pdp_descriptor.protoproto/splitsecure/oasis/saml/v2/attribute_authority_descriptor.protoproto/splitsecure/oasis/saml/v2/idp_sso_descriptor.protoproto/splitsecure/oasis/saml/v2/sp_sso_descriptor.proto
📍 Affects 5 files
proto/splitsecure/oasis/saml/v2/authn_authority_descriptor.proto#L12-L13(this comment)proto/splitsecure/oasis/saml/v2/pdp_descriptor.proto#L12-L13proto/splitsecure/oasis/saml/v2/attribute_authority_descriptor.proto#L13-L14proto/splitsecure/oasis/saml/v2/idp_sso_descriptor.proto#L16-L17proto/splitsecure/oasis/saml/v2/sp_sso_descriptor.proto#L19-L20
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@proto/splitsecure/oasis/saml/v2/authn_authority_descriptor.proto` around
lines 12 - 13, Add runtime minimum-cardinality validation for every required
endpoint list in authn_authority_descriptor.proto (lines 12-13),
pdp_descriptor.proto (lines 12-13), attribute_authority_descriptor.proto (lines
13-14), idp_sso_descriptor.proto (lines 16-17), and sp_sso_descriptor.proto
(lines 19-20), ensuring each repeated endpoint field rejects empty lists while
preserving the existing schema declarations.
Comment on lines
+9
to
+10
| // Optional: key size | ||
| int32 key_size = 2; |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n== File list ==\n'
git ls-files 'proto/splitsecure/oasis/saml/v2/encryption_method.proto' 'proto/splitsecure/oasis/saml/v2/*' | sed -n '1,40p'
printf '\n== Target file with line numbers ==\n'
cat -n proto/splitsecure/oasis/saml/v2/encryption_method.proto
printf '\n== Search for key_size usage and validation ==\n'
rg -n --hidden --no-ignore -S 'key_size|encryption_method|EncryptionMethod' proto . || trueRepository: splitsecure/apis
Length of output: 18387
Reject non-positive key sizes. int32 accepts negatives, and proto3 treats an unset field as 0, so this should be presence-aware (optional int32 or a wrapper) and rejected when <= 0.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@proto/splitsecure/oasis/saml/v2/encryption_method.proto` around lines 9 - 10,
Update the key_size field in the encryption method schema to preserve presence,
using proto3 optionality or an equivalent wrapper, and enforce validation that
any explicitly provided value must be greater than zero while allowing the field
to remain unset.
Source: MCP tools
Comment on lines
+7
to
+12
| message RequestedAttribute { | ||
| // Attribute definition | ||
| Attribute attribute = 1; | ||
|
|
||
| // Optional: is required | ||
| bool is_required = 2; |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Map the relevant proto file and nearby definitions.
git ls-files 'proto/splitsecure/oasis/saml/v2/*.proto'
echo '--- requested_attribute.proto ---'
cat -n proto/splitsecure/oasis/saml/v2/requested_attribute.proto
echo '--- attribute_type.proto ---'
cat -n proto/splitsecure/oasis/saml/v2/attribute_type.proto
echo '--- attribute.proto ---'
cat -n proto/splitsecure/oasis/saml/v2/attribute.proto
echo '--- search for RequestedAttribute usages ---'
rg -n "RequestedAttribute|requested_attribute" proto . --glob '!**/node_modules/**'Repository: splitsecure/apis
Length of output: 2245
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo '--- attribute.proto ---'
cat -n proto/splitsecure/oasis/saml/v2/attribute.proto
echo '--- outline: attribute.proto ---'
ast-grep outline proto/splitsecure/oasis/saml/v2/attribute.proto --view expanded || true
echo '--- search for RequestedAttribute and Attribute usage ---'
rg -n "RequestedAttribute|message Attribute|attribute =" proto/splitsecure/oasis/saml/v2
echo '--- metadata-related files mentioning RequestedAttribute ---'
rg -n "RequestedAttribute" proto/splitsecure/oasis/saml/v2Repository: splitsecure/apis
Length of output: 2071
Flatten RequestedAttribute to match SAML metadata.
RequestedAttributeType extends saml:AttributeType; it does not contain a nested Attribute element. Replace Attribute attribute = 1 with the inherited fields (name, name_format, friendly_name, attribute_value) plus is_required, so the generated shape matches standard metadata.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@proto/splitsecure/oasis/saml/v2/requested_attribute.proto` around lines 7 -
12, Update the RequestedAttribute message to remove the nested Attribute field
and define the inherited SAML attribute fields directly: name, name_format,
friendly_name, and attribute_value, while retaining is_required. Use the
existing field types and compatible numbering conventions from Attribute so the
generated shape matches SAML metadata.
Comment on lines
+13
to
+14
| // Optional: signature over the descriptor | ||
| bytes signature = 1; |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Locate the target proto and related SAML metadata definitions.
git ls-files 'proto/**/*.proto' | rg 'saml|metadata|signature|descriptor'
echo '--- outline target file ---'
ast-grep outline proto/splitsecure/oasis/saml/v2/role_descriptor_type.proto --view expanded || true
echo '--- search for Signature/message definitions ---'
rg -n --hidden --no-messages -S '\bmessage\s+Signature\b|\bSignature\b|ds:Signature|signature =' proto
echo '--- search for protocol_support_enumeration ---'
rg -n --hidden --no-messages -S 'protocol_support_enumeration|ProtocolSupportEnumeration|required|repeated string' proto/splitsecure/oasis/saml/v2Repository: splitsecure/apis
Length of output: 7897
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo '--- role_descriptor_type.proto ---'
cat -n proto/splitsecure/oasis/saml/v2/role_descriptor_type.proto | sed -n '1,120p'
echo '--- metadata.proto ---'
cat -n proto/splitsecure/oasis/saml/v2/metadata.proto | sed -n '1,260p'
echo '--- related SAML descriptor files with signature fields ---'
for f in \
proto/splitsecure/oasis/saml/v2/entities_descriptor.proto \
proto/splitsecure/oasis/saml/v2/entity_descriptor.proto \
proto/splitsecure/oasis/saml/v2/affiliation_descriptor.proto
do
echo "=== $f ==="
cat -n "$f" | sed -n '1,120p'
doneRepository: splitsecure/apis
Length of output: 6997
Define the signature wire format. bytes leaves the XMLDSig payload ambiguous; specify the exact serialized form or model the signature structure explicitly.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@proto/splitsecure/oasis/saml/v2/role_descriptor_type.proto` around lines 13 -
14, Update the signature field in role_descriptor_type.proto to define the
XMLDSig wire format explicitly: either document the exact serialized
representation expected for signature or replace the raw bytes field with a
structured signature type. Preserve the optional signature semantics and ensure
consumers can unambiguously serialize and parse it.
Source: MCP tools
Comment on lines
+28
to
+29
| // Optional: protocol support enumeration (required, space-separated URIs) | ||
| repeated string protocol_support_enumeration = 6; |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
Enforce required SAML fields at the schema boundary. Proto3 comments don’t enforce presence or minimum cardinality, so these fields can still be omitted or empty. Add validation for the consolidated SAML metadata messages so missing values are rejected in role_descriptor_type.proto, contact_person.proto, encryption_method.proto, key_descriptor.proto, organization.proto, and additional_metadata_location.proto.
📍 Affects 6 files
proto/splitsecure/oasis/saml/v2/role_descriptor_type.proto#L28-L29(this comment)proto/splitsecure/oasis/saml/v2/contact_person.proto#L9-L10proto/splitsecure/oasis/saml/v2/encryption_method.proto#L6-L7proto/splitsecure/oasis/saml/v2/key_descriptor.proto#L13-L14proto/splitsecure/oasis/saml/v2/organization.proto#L13-L20proto/splitsecure/oasis/saml/v2/additional_metadata_location.proto#L6-L10
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@proto/splitsecure/oasis/saml/v2/role_descriptor_type.proto` around lines 28 -
29, Enforce non-empty presence for required SAML metadata fields by adding the
project’s standard proto validation rules in
proto/splitsecure/oasis/saml/v2/role_descriptor_type.proto:28-29 (including
protocol_support_enumeration), contact_person.proto:9-10,
encryption_method.proto:6-7, key_descriptor.proto:13-14,
organization.proto:13-20, and additional_metadata_location.proto:6-10. Apply
validation to every required field at these sites so omitted or empty values are
rejected while optional fields remain unchanged.
Comment on lines
+13
to
+14
| // Optional: artifact resolution service endpoints | ||
| repeated IndexedEndpoint artifact_resolution_service = 2; |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
git ls-files 'proto/splitsecure/oasis/saml/v2/*' | sed -n '1,120p'Repository: splitsecure/apis
Length of output: 1694
🏁 Script executed:
rg -n "IndexedEndpoint|artifact_resolution_service|assertion_consumer_service|index.*unique|unique.*index|validate" proto/splitsecure/oasis/saml/v2 -SRepository: splitsecure/apis
Length of output: 588
🏁 Script executed:
ast-grep outline proto/splitsecure/oasis/saml/v2/sso_descriptor_type.protoRepository: splitsecure/apis
Length of output: 168
🏁 Script executed:
ast-grep outline proto/splitsecure/oasis/saml/v2/sp_sso_descriptor.protoRepository: splitsecure/apis
Length of output: 168
🏁 Script executed:
ast-grep outline proto/splitsecure/oasis/saml/v2/indexed_endpoint.protoRepository: splitsecure/apis
Length of output: 168
🏁 Script executed:
sed -n '1,220p' proto/splitsecure/oasis/saml/v2/sso_descriptor_type.protoRepository: splitsecure/apis
Length of output: 921
🏁 Script executed:
sed -n '1,220p' proto/splitsecure/oasis/saml/v2/sp_sso_descriptor.protoRepository: splitsecure/apis
Length of output: 978
🏁 Script executed:
sed -n '1,220p' proto/splitsecure/oasis/saml/v2/indexed_endpoint.protoRepository: splitsecure/apis
Length of output: 483
🏁 Script executed:
rg -n "\[\(validate\.rules\)|protoc-gen-validate|buf.validate|unique|collection-level" . -SRepository: splitsecure/apis
Length of output: 895
🏁 Script executed:
rg -n "message\s+IndexedEndpoint|repeated\s+IndexedEndpoint|index\s*=" proto -SRepository: splitsecure/apis
Length of output: 1228
🏁 Script executed:
find proto -maxdepth 4 -type f | sort | sed -n '1,200p'Repository: splitsecure/apis
Length of output: 7217
🌐 Web query:
SAML metadata IndexedEndpoint index must be unique within the collection specification
💡 Result:
According to the OASIS SAML V2.0 Metadata specification, the index attribute of an IndexedEndpointType element must be a unique integer value within the collection of like elements contained within the same parent element [1][2]. The specification explicitly notes that these index values do not need to be unique across the entire metadata instance, only among sibling elements of the same type [1][2]. In practice, this means that while all AssertionConsumerService elements (for example) within a single SPSSODescriptor must have unique index values, the index values themselves (such as "0") can be reused for different types of indexed endpoints (such as ArtifactResolutionService) or within different parent elements [1][3][2]. The index attribute is a required unsigned short integer used to allow protocol messages to reference specific endpoints [4][5][6].
Citations:
- 1: https://docs.oasis-open.org/security/saml/v2.0/saml-metadata-2.0-os.pdf
- 2: https://www.ziliaoku.com/res/info_38f1299c944e4d8cb292d138e2f72765.html
- 3: https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf
- 4: https://repository.data2type.de/SAML/v_2.0/html/co.IndexedEndpointType.html
- 5: https://www.keycloak.org/docs-api/26.3.2/javadocs/org/keycloak/dom/saml/v2/metadata/IndexedEndpointType.html
- 6: https://xml.coverpages.org/SSTC-SAMLMetadataV20Draft08-7750.pdf
🌐 Web query:
OASIS SAML metadata IndexedEndpoint index uniqueness repeated collection
💡 Result:
Under the OASIS SAML 2.0 Metadata specification, the 'index' attribute of an 'IndexedEndpointType' element (such as 'AssertionConsumerService', 'ArtifactResolutionService', etc.) is a required integer that must be unique within a collection of like elements contained within the same parent element [1][2][3]. Key points regarding this requirement include: 1. Scope of Uniqueness: The 'index' value is only required to be unique relative to other endpoints of the same type within the same parent XML element [1]. It does not need to be unique across the entire metadata instance [1][4]. 2. Purpose: This index allows specific endpoints to be referenced by protocol messages (e.g., when an Identity Provider needs to direct a response to a specific 'AssertionConsumerService' endpoint) [1][3]. 3. Implementation: Duplicate index values within the same collection are considered a violation of the SAML standard [4]. While some implementations may strictly enforce this and throw errors during parsing [4], others may attempt to handle or ignore them [4]. 4. Default Handling: In a sequence of indexed endpoints, the default endpoint is determined by the 'isDefault' attribute. If 'isDefault="true"' is specified, that element is the default [1][2]. If no element has 'isDefault="true"', the first endpoint in the sequence is treated as the default [1][3]. In practice, developers and system administrators should ensure that 'index' values are unique within their respective parent containers to prevent ambiguity and ensure interoperability [2][4].
Citations:
- 1: https://docs.oasis-open.org/security/saml/v2.0/saml-metadata-2.0-os.pdf
- 2: https://github.com/kellenmurphy/incommon-saml-specs/blob/main/summaries/saml/saml-metadata-2.0-os-claude.md
- 3: https://xml.coverpages.org/SSTC-SAMLMetadataV20Draft08-7750.pdf
- 4: Ignore SPSSODescriptor on metadata parsing Sustainsys/Saml2#408
Reject duplicate index values in indexed-endpoint collections.
SAML requires index to be unique within each IndexedEndpoint collection, but these fields still allow duplicates. Add collection-level uniqueness validation for:
proto/splitsecure/oasis/saml/v2/sso_descriptor_type.proto#L13-L14proto/splitsecure/oasis/saml/v2/sp_sso_descriptor.proto#L19-L20
📍 Affects 2 files
proto/splitsecure/oasis/saml/v2/sso_descriptor_type.proto#L13-L14(this comment)proto/splitsecure/oasis/saml/v2/sp_sso_descriptor.proto#L19-L20
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@proto/splitsecure/oasis/saml/v2/sso_descriptor_type.proto` around lines 13 -
14, Enforce collection-level uniqueness of the index field for the repeated
IndexedEndpoint fields: update
proto/splitsecure/oasis/saml/v2/sso_descriptor_type.proto lines 13-14 and
proto/splitsecure/oasis/saml/v2/sp_sso_descriptor.proto lines 19-20. Apply the
project’s existing validation mechanism so duplicate index values are rejected
within each collection while preserving the current endpoint definitions.
Comment on lines
+25
to
+34
| // lineage_id identifies this resource's lineage across supersession | ||
| // (HashiCorp-style versioning): every edit is a new CREATE presenting its | ||
| // predecessor, and all versions of the "same" resource share one lineage. | ||
| // Empty at genesis — the enclave stamps this into the signed bytes only | ||
| // when a presented predecessor makes this a superseding CREATE, copying | ||
| // the predecessor's lineage_id verbatim. A record's true lineage id is | ||
| // therefore this field when non-empty, else the domain-tagged digest of | ||
| // its own signed issuance bytes (genesis IS its own lineage). Callers | ||
| // never set this directly; it is enclave-derived only. | ||
| bytes lineage_id = 7; |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Preserve the genesis lineage ID on the first supersession.
A genesis resource intentionally has an empty lineage_id (Line 28), but the first successor copies predecessor.lineage_id verbatim (Lines 29-30). It therefore remains empty and then derives a new lineage ID from its own issuance bytes (Lines 31-32), breaking lineage grouping. Propagate the predecessor’s effective lineage ID—using its genesis digest when the predecessor field is empty—and add a genesis-to-first-successor test.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@proto/splitsecure/teamresource/v1/base_resource_attributes.proto` around
lines 25 - 34, The supersession logic must preserve a genesis resource’s
effective lineage ID when creating its first successor. In the enclave flow that
stamps `lineage_id`, use `predecessor.lineage_id` when present, otherwise use
the predecessor’s domain-tagged signed-issuance digest, and write that effective
value into the successor; add a test covering genesis-to-first-successor lineage
continuity.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.