basquetWi + New ticket
mars MARS-732

Support API: restrict internal-note visibility to Elazar plus ticket stakeholder

Blocked high cmcoder-mars-cc ⛔ Interim disclosure fix is live at c97cf42/v2.85.9, but the original Elazar+ticket-stakeholder internal-note visibility requirement is still unmet. Shared SUPPORT_API_KEY cannot identify the caller; full stakeholder reads remain denied until EVO-102 trusted per-agent identity, EVO-104 env provisioning, and authoritative stakeholder mapping/policy. Class-A build/runtime logs and live keyed behavior also remain unverified from this seat (Vercel API not_found for exact deployment).

Source review 2026-09-13: GET /api/internal/support-action authenticates only with the shared SUPPORT_API_KEY and returns vSupportTicketMessagesAll, including every internal note for the selected ticket. This does not meet MARS-467 requirements for a private comment visible only to Elazar and the ticket stakeholder agent. Blast radius: every holder of the shared bearer can read all internal notes for any ticket it can identify and invoke the route authorized operations; the exact holder set is not enumerable from source. Cross-link: MARS-467.

Sub-tickets

No sub-tickets.
+ Add sub-ticket

Activity

  • wi-cli-venus created · 4w ago
  • wi-cli-venus assigned · 3w ago
    coder-mars-ca
  • wi-cli-venus note · 3w ago
    Reassigned coder-mars-cc -> coder-mars-ca on 2026-09-19 under Elazar's direct Mars coder+PM handover, relayed by coder-mars-cc at 05:39 ART and explicitly ordered by pmmaster-evolutiva-cc at 05:40 ART. This transfers backlog ownership only; implementation/push authority remains governed by mars-commons.md.
  • coder-mars-ca blocked · 1w ago
    Shared SUPPORT_API_KEY authenticates no individual; X-Acting-Agent is self-asserted and cannot authorize internal-note reads. The GET currently returns vSupportTicketMessagesAll. Full Elazar+ticket-stakeholder enforcement needs trusted per-agent credentials (EVO-102; Vercel env provisioning currently gated by EVO-104) and an authoritative stakeholder mapping/policy. Await PM/Elazar decision on interim public-only bearer GET, which would protect notes but deny legitimate stakeholder-agent reads.
  • coder-mars-ca progress · 1w ago
    PM approved fail-closed interim: shared-bearer ticket GET now selects vSupportTicketMessagesPublic and preserves visibility='public' in response; staff console continues separate all-message read. This intentionally denies stakeholder agents internal-note reads until EVO-102 trusted per-agent identity and EVO-104 env provisioning, plus authoritative stakeholder policy, land. Focused handler tests passed 2/2; Class-A diff review and push pending.
  • coder-mars-ca verified · 1w ago
    Interim mitigation pushed c97cf42dea4cf10d66441ac6fe0c6e2b65778ff7 (v2.85.9): bearer ticket GET selects vSupportTicketMessagesPublic only; staff console unchanged. Class-A design/diff reviews PASS from audit-general-ca. Push hook: 973/973 tests, type generation, lint 0 errors. GitHub Vercel status success for this exact SHA; production /api/health reports v2.85.9 and dpl_Uwa3evSd6FBfzwkfkKcronMFCwTi, matching the SHA status target; unauthenticated GET returned 401. Vercel build/runtime logs inaccessible from this seat: API returned not_found for that deployment, so full Class-A PTD log read is unverified. Live keyed public/internal message behavior was not exercised.
  • coder-mars-ca blocked · 1w ago
    Interim disclosure fix is live at c97cf42/v2.85.9, but the original Elazar+ticket-stakeholder internal-note visibility requirement is still unmet. Shared SUPPORT_API_KEY cannot identify the caller; full stakeholder reads remain denied until EVO-102 trusted per-agent identity, EVO-104 env provisioning, and authoritative stakeholder mapping/policy. Class-A build/runtime logs and live keyed behavior also remain unverified from this seat (Vercel API not_found for exact deployment).
  • coder-mars-ca assigned · 6d ago
    coder-mars-cc
security
4w ago by wi-cli-venus
6d ago