mono
63e0457886
Source-reviewed hardening changes and regression tests. UNBUILT / UNTESTED: not a deployable release. Go formatting, compilation, automated regression tests, full frontend validation and staging acceptance remain required. See docs/hardening/VALIDATION.md. Main remains the original clean snapshot; no upstream Git history imported.
64 lines
3.5 KiB
Markdown
64 lines
3.5 KiB
Markdown
# Security and reliability hardening
|
|
|
|
This independent fork starts from the current source tree of
|
|
[MonoVerseNS/agent-desk-ng](https://github.com/MonoVerseNS/agent-desk-ng), revision
|
|
`b06954b0a495389cbb5194e0d388342eabe60636`. It does not import the old Git history.
|
|
The upstream Apache-2.0 license and notices remain applicable. This document
|
|
records changes made by this fork; it is not a claim of production certification.
|
|
|
|
## Release gate
|
|
|
|
The hardening changes must be reviewed and validated before deployment. Source
|
|
inspection, a compiler check, a passing isolated test, and live acceptance are
|
|
separate kinds of evidence. See `VALIDATION.md` for the actual checks performed.
|
|
No production service, database, credentials, or external deployment is changed
|
|
by committing this source code.
|
|
|
|
## Changes being integrated
|
|
|
|
- Separate guest, signed-user, issuer and channel identities. Use canonical
|
|
customer/channel WebSocket topics and recheck recipients instead of treating
|
|
a topic subscription as authorization.
|
|
- Apply conversation-view permission to staff WebSockets; keep notifications
|
|
separate. Revalidate session expiry, revocation, account state and permissions
|
|
on long-lived connections. Disabled roles must no longer grant permissions.
|
|
- Keep drafts and asynchronous responses bound to their identity and dialogue.
|
|
Preserve drafts on failed sends, protect newly typed revisions, and prevent
|
|
duplicate concurrent sends. Profile refresh and delayed API errors must not
|
|
restore or expire the wrong signed-in account.
|
|
- Turn setup repair into an explicit preview/apply operation. Never resurrect
|
|
deleted configuration or silently introduce continuous working hours. Apply
|
|
reviewed writes transactionally and dispatch only after commit.
|
|
- Make empty setup, initial retry and standalone chat dismissal truthful and
|
|
recoverable; remove bearer-token-bearing WebSocket URLs from browser logs.
|
|
|
|
## Upgrade precautions
|
|
|
|
Customer identity scoping is an additive schema and token-contract change, not
|
|
only a frontend patch. Existing unscoped customer tokens will be rejected.
|
|
Legacy identities and conversations must be inventoried and reconciled with
|
|
trusted issuer/channel provenance before expecting their old history in new
|
|
customer sessions. No automatic customer merge or destructive cleanup is
|
|
appropriate. See `CUSTOMER_IDENTITY_UPGRADE.md` before any deployment.
|
|
|
|
New anonymous sessions are server-issued. Knowing an old anonymous external ID
|
|
is not sufficient to reclaim its history. Preserve the signed customer-session
|
|
credential for normal resume; loss or expiry can require a new anonymous session.
|
|
|
|
The setup quick-fix API now requires preview and explicit apply. Older callers
|
|
must not treat a successful preview response as proof that configuration changed.
|
|
See [the setup contract](SETUP_PREVIEW.md) before integrating custom callers.
|
|
|
|
## Verification priorities
|
|
|
|
1. Guest/user/channel collisions, unauthorized staff topics, revoked/expired
|
|
sockets, disabled roles and concurrent identity registration.
|
|
2. Wrong-recipient drafts, failed and duplicate sends, delayed responses after
|
|
switching conversations or accounts, and logout during profile refresh.
|
|
3. Preview/apply tampering, permission denial, rollback, deleted configuration,
|
|
off-hours schedules, empty-channel simulation and dispatch failure reporting.
|
|
4. Desktop and narrow-screen interaction checks in Russian, English and Chinese.
|
|
|
|
Use temporary, isolated data for checks. Do not run migration/repair commands
|
|
against a live database merely to validate the code.
|