molecule-ai/molecule-core
41
0
Fork 2
Code Issues 103 Pull Requests 146 Actions 100 Packages Projects Releases Wiki Activity

fix(handlers): HOTFIX OFFSEC-015 — scope broadcast recipients to sender org #1243

Open
release-manager wants to merge 2 commits from fix/offsec-015-staging into staging
pull from: fix/offsec-015-staging
merge into: molecule-ai:staging
Conversation 6 Commits 2 Files Changed 2 +715 -6

2 Commits

Author SHA1 Message Date
Molecule AI Fullstack Engineer
f89f7a34d9 test(handlers): add 15 BroadcastHandler test cases to PR #1243
Some checks failed
Release-Manager/probe release-cycle-probe
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 28s
Details
CI / Detect changes (pull_request) Successful in 31s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 29s
Details
E2E Chat / detect-changes (pull_request) Successful in 34s
Details
Harness Replays / detect-changes (pull_request) Successful in 28s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 42s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 34s
Details
gate-check-v3 / gate-check (pull_request) Successful in 35s
Details
Runtime PR-Built Compatibility / detect-changes (pull_request) Successful in 52s
Details
qa-review / approved (pull_request) Successful in 22s
Details
security-review / approved (pull_request) Successful in 24s
Details
sop-checklist / all-items-acked (pull_request) Successful in 23s
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 1m39s
Details
sop-tier-check / tier-check (pull_request) Successful in 30s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 12s
Details
CI / Python Lint & Test (pull_request) Successful in 11s
Details
E2E Chat / E2E Chat (pull_request) Failing after 10s
Details
Harness Replays / Harness Replays (pull_request) Successful in 8s
Details
Runtime PR-Built Compatibility / PR-built wheel + import smoke (pull_request) Successful in 23s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 2m50s
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 6m18s
Details
CI / Canvas (Next.js) (pull_request) Successful in 19m21s
Details
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Details
CI / Platform (Go) (pull_request) Failing after 20m29s
Details
CI / all-required (pull_request) Successful in 2s
Details 
Merges 14 new tests (truncate, validation, DB errors, success paths,
graceful degradation) with the 11 existing OFFSEC-015 org-isolation tests.
All 25 tests now use setupBroadcastDB + QueryMatcherEqual with exact SQL.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-05-16 12:08:44 +00:00
Molecule AI Release Manager
aff7f810bc fix(handlers): hotfix OFFSEC-015 — scope broadcast recipients to sender's org
Some checks failed
CI / Canvas Deploy Reminder (pull_request) Blocked by required conditions
Details
CI / all-required (pull_request) Blocked by required conditions
Details
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 13s
Details
CI / Detect changes (pull_request) Successful in 1m2s
Details
Harness Replays / detect-changes (pull_request) Successful in 25s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 22s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 1m15s
Details
gate-check-v3 / gate-check (pull_request) Successful in 24s
Details
E2E Chat / detect-changes (pull_request) Successful in 1m27s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 1m21s
Details
qa-review / approved (pull_request) Successful in 31s
Details
security-review / approved (pull_request) Successful in 27s
Details
sop-tier-check / tier-check (pull_request) Successful in 30s
Details
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 1m31s
Details
Runtime PR-Built Compatibility / detect-changes (pull_request) Successful in 1m41s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 10s
Details
CI / Python Lint & Test (pull_request) Successful in 12s
Details
Harness Replays / Harness Replays (pull_request) Successful in 11s
Details
E2E Chat / E2E Chat (pull_request) Failing after 48s
Details
Runtime PR-Built Compatibility / PR-built wheel + import smoke (pull_request) Successful in 11s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 2m56s
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 7m13s
Details
CI / Canvas (Next.js) (pull_request) Successful in 19m1s
Details
CI / Platform (Go) (pull_request) Failing after 20m41s
Details
sop-checklist / all-items-acked (pull_request) [info tier:low] acked: 0/7 — missing: comprehensive-testing, local-postgres-e2e, staging-smoke, +4 — body-unfilled: comprehensive-testing, l
Details 
Cherry-picked from 5a05302c (main) / 98382eb1 (hotfix branch).

Recursive CTE walks parent_id chain to find sender's org root, then
filters recipients to same org only. Prevents cross-tenant broadcast.

Also adds CWE-400 rate limiting (3/min), CWE-400 message cap (1000
chars), and CWE-79 html.EscapeString sanitization.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-05-15 22:42:56 +00:00