wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 3 Packages Projects Releases Wiki Activity

fix(security): verify workload DB concurrency budget
All checks were successful
CD Pipeline / workflow-shape (push) Successful in 1s
Details
CD Pipeline / cancel-stale-cd (push) Has been skipped
Details
CD Pipeline / tests (push) Successful in 2m19s
Details
CD Pipeline / build-and-deploy (push) Successful in 6m54s
Details
CD Pipeline / post-deploy-checks (push) Successful in 2m6s
Details
AWOOOI Harbor 110 Local Repair / workflow-shape (push) Successful in 1s
Details
AWOOOI Harbor 110 Local Repair / harbor-110-local-repair (push) Successful in 48s
Details

Browse Source
This commit is contained in:
ogt
2026-07-11 04:44:23 +08:00
parent 2d786da147
commit 0660813781
6 changed files with 206 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
apps/api/src/services/executor_trust_boundary_readback.py
View File

@@ -74,6 +74,11 @@ def _build_database_identity_boundary(
"required_connection_budget": _int_or_none(
receipt.get(f"{workload_id}_required_connection_budget")
),
"concurrent_connection_probe_count": _int_or_none(
receipt.get(
f"{workload_id}_concurrent_connection_probe_count"
)
),
"database_null_pool": _truthy(
receipt.get(f"{workload_id}_database_null_pool")
),
@@ -130,13 +135,27 @@ def _build_database_identity_boundary(
and workloads[workload_id]["required_connection_budget"] > 0
for workload_id in _DB_WORKLOAD_IDS
)
api_http_concurrency_verified = _truthy(
receipt.get("api_http_concurrency_probe_passed")
)
representative_preflights_verified = bool(
all(
workloads[workload_id]["representative_preflight_passed"] is True
and isinstance(
workloads[workload_id]["required_connection_budget"], int
)
and isinstance(
workloads[workload_id]["concurrent_connection_probe_count"],
int,
)
and workloads[workload_id]["required_connection_budget"] > 0
and workloads[workload_id]["concurrent_connection_probe_count"]
>= workloads[workload_id]["required_connection_budget"]
and workloads[workload_id]["table_privilege_gap_count"] == 0
and workloads[workload_id]["sequence_privilege_gap_count"] == 0
for workload_id in _DB_WORKLOAD_IDS
)
and api_http_concurrency_verified
and _truthy(receipt.get("representative_db_preflights_verified"))
)
db_identity_isolated = bool(
@@ -162,6 +181,8 @@ def _build_database_identity_boundary(
blockers.append("database_secret_refs_not_distinct")
if not distinct_role_fingerprints:
blockers.append("database_role_fingerprints_not_distinct")
if not api_http_concurrency_verified:
blockers.append("api_http_concurrency_probe_not_verified")
for workload_id in _DB_WORKLOAD_IDS:
workload = workloads[workload_id]
if workload["role_fingerprint"] is None:
@@ -170,6 +191,12 @@ def _build_database_identity_boundary(
blockers.append(f"{workload_id}_database_null_pool_not_verified")
if (
workload["representative_preflight_passed"] is not True
or not isinstance(
workload["concurrent_connection_probe_count"], int
)
or not isinstance(workload["required_connection_budget"], int)
or workload["concurrent_connection_probe_count"]
< workload["required_connection_budget"]
or workload["table_privilege_gap_count"] != 0
or workload["sequence_privilege_gap_count"] != 0
):
@@ -220,6 +247,9 @@ def _build_database_identity_boundary(
"representative_db_preflights_verified": (
representative_preflights_verified
),
"api_http_concurrency_probe_passed": (
api_http_concurrency_verified
),
},
"connection_budget": {
"observed_total": (