fce0be30fd
Security Auditor findings on PR #611: Fix 1 (BLOCKING): Remove budget_limit handling from Update() entirely. PATCH /workspaces/:id uses ValidateAnyToken — any enrolled workspace bearer could self-clear its own spending ceiling. The dedicated AdminAuth-gated PATCH /workspaces/:id/budget is the only authorised write path. Fix 2 (MEDIUM): Strip budget_limit and monthly_spend from Get() response before c.JSON(). GET /workspaces/:id is on the open router — any caller with a valid UUID must not read billing data. Also updates four existing tests in workspace_budget_test.go that encoded the old (insecure) behaviour, and adds three new regression tests. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| cmd/server | ||
| internal | ||
| migrations | ||
| pkg/provisionhook | ||
| Dockerfile | ||
| Dockerfile.tenant | ||
| entrypoint-tenant.sh | ||
| go.mod | ||
| go.sum | ||