Protect filing seals and detect missing seals or substituted data books #60

New Issue

2026-11-05T12:09:27Z

spencerm commented

2026-11-05 12:09:27 +00:00

Priority: high. Database integrity boundary, not a demonstrated unauthenticated exploit.

The app role inherits UPDATE/DELETE on packet_seals. Its seal digest covers the packet model but not the stored data-book asset reference. The nightly check selects only existing unbroken seals, so a filed packet without one is absent from the check.

Evidence: server/packetstation/migrations/0001_base.sql:8, server/packetstation/migrations/0003_domain.sql:589, server/packetstation/domain/pipeline.py:842, server/packetstation/worker/jobs/integrity.py:80.

Reproduce in a disposable database: file a packet, then as ps_app change its unbroken seal's databook_asset_id to another valid asset. Verify the seal and run integrity. Separately test a filed packet with no unbroken seal. Deletion may be blocked by archive foreign keys on archived seals, but unrestricted seal updates remain possible.

Impact: the stored book can be substituted without the key, and missing/broken-only seals can evade the nightly seal scan. No SQL injection or normal API path granting this access was found.

Acceptance criteria:

Prevent deletion and unauthorized changes to immutable seal fields at the database boundary; retain legitimate initial book attachment and audited reopen behavior.
Cryptographically bind the filed data book to its seal, including its content digest, with a versioned compatibility strategy for existing seals.
Flag every filed packet lacking a valid unbroken seal and detect book substitution/content mismatch.
Add app-role permission and integrity regression tests covering these cases.

Related: #28. Source: Grok; confirmed by static inspection.

Reviewed revision: 18333600b55b70971877c1a0c72d1d61b6ce9c69. Raised from the November 2026 independent project reviews and parent verification. No production system was tested.

Priority: high. Database integrity boundary, not a demonstrated unauthenticated exploit. The app role inherits UPDATE/DELETE on packet_seals. Its seal digest covers the packet model but not the stored data-book asset reference. The nightly check selects only existing unbroken seals, so a filed packet without one is absent from the check. Evidence: [server/packetstation/migrations/0001_base.sql:8](https://gt.pescoinc.biz/spencerm/PacketStation/src/commit/18333600b55b70971877c1a0c72d1d61b6ce9c69/server/packetstation/migrations/0001_base.sql#L8), [server/packetstation/migrations/0003_domain.sql:589](https://gt.pescoinc.biz/spencerm/PacketStation/src/commit/18333600b55b70971877c1a0c72d1d61b6ce9c69/server/packetstation/migrations/0003_domain.sql#L589), [server/packetstation/domain/pipeline.py:842](https://gt.pescoinc.biz/spencerm/PacketStation/src/commit/18333600b55b70971877c1a0c72d1d61b6ce9c69/server/packetstation/domain/pipeline.py#L842), [server/packetstation/worker/jobs/integrity.py:80](https://gt.pescoinc.biz/spencerm/PacketStation/src/commit/18333600b55b70971877c1a0c72d1d61b6ce9c69/server/packetstation/worker/jobs/integrity.py#L80). Reproduce in a disposable database: file a packet, then as ps_app change its unbroken seal's databook_asset_id to another valid asset. Verify the seal and run integrity. Separately test a filed packet with no unbroken seal. Deletion may be blocked by archive foreign keys on archived seals, but unrestricted seal updates remain possible. Impact: the stored book can be substituted without the key, and missing/broken-only seals can evade the nightly seal scan. No SQL injection or normal API path granting this access was found. Acceptance criteria: - Prevent deletion and unauthorized changes to immutable seal fields at the database boundary; retain legitimate initial book attachment and audited reopen behavior. - Cryptographically bind the filed data book to its seal, including its content digest, with a versioned compatibility strategy for existing seals. - Flag every filed packet lacking a valid unbroken seal and detect book substitution/content mismatch. - Add app-role permission and integrity regression tests covering these cases. Related: #28. Source: Grok; confirmed by static inspection. Reviewed revision: `18333600b55b70971877c1a0c72d1d61b6ce9c69`. Raised from the November 2026 independent project reviews and parent verification. No production system was tested.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: spencerm/PacketStation#60