Round 11 · targeted remediation · 2026-09-05
Separate tenant administration from platform operations
The high-severity authorization finding was confirmed. The fix covers role, user and group administration so that a group-membership route cannot bypass the new role boundary. This is a targeted remediation, not a claim that either repository has reached production completeness.
Changes
| Finding | Resulting behavior |
|---|---|
| SA-R11-01 Authorization tiers | platform-admin protects operations and metrics. Customer admin grants apply only inside the authenticated user's current organization. Role, group and user targets are checked before identity-provider writes. Lists and search use scoped local data. |
| Role and group escalation paths | Tenant roles receive generated immutable tenant:<organization-id>:<uuid> realm names. Display-name changes cannot mint an admin authority. Legacy unnamespaced role mutations require platform review. Composite/client-role grants are rejected. Group membership and invitations reject privileged effective roles, client grants and parent-group grants. |
| SA-R11-02 Credential defaults | The default profile requires the Keycloak server URL, administrator username and password without fallback. Local convenience values live only in the explicit dev profile; test fixtures supply their own credentials. |
| SA-R11-03 Loading text | Three actual loading messages used literal question marks and were corrected. Six other cited occurrences were ternary operators adjacent to isLoading, not displayed strings. Namespaced role assignments are now recognized by their realm name in the UI. |
Validation
- 37 backend unit tests passed, with zero failures or skips, covering administration boundaries, role/group services, invitations, inherited group privileges and credential defaults. Gradle reported BUILD SUCCESSFUL.
- Frontend: six targeted tests passed across operator navigation, assignment recognition and recovery behavior.
- Production frontend build passed; initial JavaScript 454,760 bytes against the 500,000-byte budget.
- Final TypeScript and frontend lint checks passed. SDK source fingerprint verified unchanged.
Integration validation is blocked. The new HTTP/PostgreSQL regression tests compiled, but Docker stalled during container startup; a separate read-only container-list request also stalled. The test worker was stopped after more than five minutes of waiting. Those integration tests are not counted as passing. They are designed to exercise real HTTP security, tenant resolution and PostgreSQL queries, with identity-provider I/O mocked. The passing unit tests use mocked repositories and identity-provider resources. The targeted Gradle invocation excludes the repository-wide coverage task for the subset only; the configured threshold is unchanged. These results do not replace a clean full-suite coverage run.
Logs in trustweave-saas: round11-unit-tests.log (passing), round11-tests.log (interrupted Docker run), round11-thread.log (startup wait); frontend round11-ui-tests.log, round11-build.log, round11-types.log, round11-lint.log.
Deployment work remains explicit
Provision platform-admin only for approved operators in the application realm, then obtain fresh tokens. Do not make it a default role, a customer-role composite or a customer-group grant. Existing unnamespaced roles and historic privilege grants require review; the application does not promote existing administrators, revoke tokens or automatically migrate role mappings.
The deployment guide is trustweave-saas/docs/administration-security.md. No live realm roles were changed. Keycloak and database writes remain separate operations, so failures between them still require reconciliation.
Resume integration validation
After Docker Desktop responds again, run from trustweave-saas:
./gradlew :server:test --tests '*TenantAdministrationIntegrationTest' --tests '*WebhookRecoveryIntegrationTest' -x :server:jacocoTestCoverageVerification --max-workers=2On Windows use .\gradlew.bat. This targeted check still does not establish repository-wide coverage. Keep the normal full-suite CI gate enabled.
Scores and remaining work
No new overall score is assigned. The original independent baseline remains 7.6/10 for trustweave and 7.0/10 for trustweave-saas; those numbers predate these changes. Eleven carried-forward engineering-hygiene findings remain open. Autonomous checkout line-item matching also remains unsupported and fails closed. Prior full-backend reliability and global coverage were not resolved by this targeted pass.
Nothing committed or deployed. Original review artifacts are preserved.