dev01 muestra columnas que PROD oculta, asi que la verificacion de Eugenia no verifica PROD

Sub-tickets

Activity

• wi-cli-venus created · 4w ago
• audit-mba-l-cc audit-finding · 1w ago
  CENSUS of isFaithfulHost/isFaithfulClient gated surfaces (dev01 vs app.movilba.com), per coder03's ask: 1) External API GET /api/v1/exports/vehiculos (x-api-key auth, api/v1/exports/vehiculos/route.ts:59 -> lib/exports/vehiculos.ts): adds comentariosImportacion column on staging+dev01, omits on prod/any other host. 41 cols off / 42 on. Gate correct, by design (post-2026-08-13 incident). 2) Vehiculo ficha detail page (vehiculos/[dominio]/page.tsx, useStagingFaithful hook): 'Notas de importacion' card shown only on staging+dev01. Gate correct. 3) Chasis-match catalog autocomplete (actions/vehiculo-match.ts:75, suggestCatalogMatch): silently returns null off-allowlist; staging+dev01 only. Gate correct. All three are intentional default-deny, documented in stagingSwitch.ts header. None need touching. CORRECTION to the prior note's root cause: the on-screen /vehiculos LIST download (ExportButton -> /api/export?entity=vehiculos -> buildRutapLibroXlsx/Csv, RUTAP_HISTORICAL_COLUMNS in lib/exports/rutap-historico.ts) is a COMPLETELY SEPARATE, UNGATED 39-column builder. Grepped: it has NO comentarios/comentario column at all, on ANY host - confirmed via full header list. Comentarios importacion exists in exactly 4 files (stagingSwitch.ts, exports/vehiculos.ts, actions/vehiculos.ts, vehiculos/[dominio]/page.tsx) - the /vehiculos list page is not one of them. So Eugenia's reported 'descarga de /vehiculos trae Comentarios importacion' cannot be explained by the list-download path at all - that path never had the column, gated or not. Two live possibilities, neither confirmed by code: (a) she or someone on her behalf hit the external x-api-key'd API directly against dev01 and that's the file she saw; (b) she's paraphrasing the ficha detail page's 'Notas de importacion' card (same underlying data, different UI, not a download). Need Elazar/her to confirm WHICH file/screen she actually looked at before this can be closed - the cheap first step the prior note already proposed.
• audit-mba-l-cc audit-finding · 1w ago
  audit 2026-10-08: re-measured the gate, finding UNCHANGED after 3 weeks - no drift. src/lib/stagingSwitch.ts:19-22 FAITHFUL_HOSTS is still exactly [staging.movilba.com, dev01.movilba.com]; app.movilba.com is still absent, so PROD remains default-deny and the column still does not leave PROD. src/lib/exports/vehiculos.ts:165 still deletes comentariosImportacion per row on non-faithful hosts. So the gate is intact and the original conclusion holds: this is NOT a PROD leak. What is still open is unchanged and is NOT audit's to execute: (a) Elazar's A/B decision - Eugenia verifies on a PROD-faithful host, or the screen tells her on-screen that she is seeing columns PROD does not serve; (b) the cheap prerequisite, asking Eugenia which host she saw it on, which is a tracker write and goes through the lane that owns the tracker, not audit. Parking on (a). No code or data change recommended - lowering the gate to silence the report would reopen the 2026-08-13 incident (739/1600 rows to prod + external API).
• researcher-mba-l-cc note · 1w ago
  researcher 2026-10-08 13:17 ART: one half already closed, one real choice survives. CLOSED: the export gate is correct and stays - audit confirmed PROD never emits comentariosImportacion, dev01/staging show it on purpose, lowering the gate would reopen the 2026-08-13 incident. Not a decision, don't present it as one. CHEAP STEP FIRST (execution, not Elazar's call): ask Eugenia which host she saw the column on, to confirm dev01 and rule out a real PROD escape. REAL CHOICE FOR ELAZAR, only after that confirms dev01: A) Eugenia verifies against a PROD-faithful host instead of dev01, or B) the screen tells her in the UI that she's viewing columns PROD doesn't serve. Her 'Verificado' on dev01 today is not evidence about PROD either way until one of these ships.
• coder03-mba-l-cc assigned · 1w ago
  researcher-mba-l-cc / solo
• coder03-mba-l-cc statusChanged · 1w ago
  coder03-mba-l-cc 19:40Z - moved from audit (saturated, and it is the only gate before a push) to researcher as a read-only surface census. It is not a cleanup: Eugenia verifies on dev01, so any column dev01 shows that PROD hides means her verification does not verify PROD, which bears directly on retiring the workbook.
• researcher-mba-l-cc note · 1w ago
  2026-10-08T16:47:28-03:00 / 19:47:28Z researcher-mba-l-cc. Read-only census, every host-conditional surface difference. Started from stagingSwitch.ts's two tiers (FAITHFUL, VALIDATOR-FULL) plus the separate STAGING tier, then grepped every predicate function itself (isFaithfulHost/Client, isValidatorFullHost/Client, isStagingHost/Client) across src/, not just the named constants - this surfaced a SECOND, independent host-gate file (docsHost.ts) that MOVILBA-640 and the assignment did not name. MECHANISM INVENTORY - two separate files, five predicates, three host lists: - src/lib/stagingSwitch.ts: FAITHFUL_HOSTS=[staging,dev01] / isFaithfulHost (server) / isFaithfulClient (client). VALIDATOR_FULL_HOSTS=[staging,dev01,permisos-movilba-dev] / isValidatorFullHost / isValidatorFullClient. STAGING_HOST=staging alone / isStagingHost / isStagingClient. - src/lib/docsHost.ts (NOT in stagingSwitch.ts, separate list): DEV_DOCS_HOST=permisos-movilba-dev.gcba.gob.ar / isDevDocsHost. Not named in the MOVILBA-640 measurement or in this ticket's starting points. PER-SURFACE TABLE: 1. XLSX export, comentariosImportacion column - src/app/api/v1/exports/vehiculos/route.ts:59 reads isFaithfulHost(host), passes `faithful` into src/lib/exports/vehiculos.ts's row-shaping function, which deletes the key off-allowlist (:155-163) and only runs the supplementary fetch (fetchComentariosImportacion, :179-188) on-allowlist. 42 cols on staging+dev01, 41 elsewhere. Already known (MOVILBA-640). No PDF export touches this column - grep for comentariosImportacion/comentarios_importacion across src/ found 4 files total, none a PDF renderer. 2. Chassis matching - src/actions/vehiculo-match.ts:75 isFaithfulHost(h.get('host')) -> returns null off-allowlist. Already known. 3. Ficha screen "Notas de importación" card - src/app/vehiculos/[dominio]/page.tsx: TWO separate calls gate the SAME card, not two surfaces - useStagingFaithful() hook (:217, controls render at :1454) and a second, independent isFaithfulClient() inline call (:402, controls whether the fetch even runs). Belt-and-suspenders on one card. 4. Ficha screen's data source for #3, server action obtenerComentariosImportacion (src/actions/vehiculos.ts:420-452): NO HOST CHECK AT ALL in the action itself. Its own doc comment (:417-419) says the column "existe SOLO en movilba_staging" and relies on a 42703 (undefined_column) catch to no-op off-staging - but the CALLING page's comment (vehiculos/[dominio]/page.tsx:395-397) says this is stale: "comentarios_importacion was promoted into movilba_dev... gated on the host allowlist (staging + dev01), not on column absence." If the column now also exists on any OTHER host (not checked here - DB-side, out of this census's scope), any authenticated session with vehiculos:read can call this server action directly, bypassing the UI's isFaithfulClient gate entirely, since the action has no isFaithfulHost check of its own. Flagging as a real gap: the only enforcement point here is the client-side call site, not the data-serving action. 5. Validadoras - PARTIAL leak past the "hidden everywhere" rule. The proxy redirect (src/proxy.ts:136-138) covers only the literal path `/validadoras` and `/validadoras/*`. useValidatorFull() / VALIDATOR_FULL_HOSTS gate the OPENPASS-specific sub-fields inside ValidadoraEntitySection.tsx (:252,374,377,382) - OPENPASS fields render only on staging/dev01/permisos-movilba-dev, never prod. BUT ValidadoraEntitySection itself is rendered unconditionally (no host check, no proxy redirect) from TWO pages outside /validadoras: src/app/lineas/[id]/page.tsx:332 and src/app/lineas/[id]/editar/page.tsx:176. Inside the component, SUBE-type validadora records (assigned/available lists, tipoValor === "SUBE" branches at :377,382) render on EVERY host including prod, independent of showValidatorFull. So SUBE validadora assignment data for a línea is visible on prod today via /lineas/[id] and /lineas/[id]/editar, through a code path the proxy redirect does not reach. This looks like it conflicts with the CLAUDE.md hard rule "No screen... exposes validadora data" - flagging as found, not fixed (read-only, no host-list or redirect-path change made). - ValidadorasList.tsx and ValidadoraForm.tsx: both confirmed used ONLY under /validadoras/* (page.tsx, [id]/editar, agregar) - fully covered by the proxy redirect, correctly moot. 6. API docs / Try-it UI - separate mechanism, src/lib/docsHost.ts's isDevDocsHost, DEV_DOCS_HOST=permisos-movilba-dev.gcba.gob.ar. Two call sites: src/app/api/docs/route.ts:69 (serves Scalar with no session/RBAC on that one host, per Elazar GO 2026-07-31) and src/app/api/layout.tsx:30 (same bypass for the /api landing pages). Off that host: normal auth() + api_docs:read gate. This is an AUTH gate, not a data-shape gate like the others - included because it is host-conditional and the ticket asked for every one, not just the ones that change what Eugenia sees; not a workbook-fidelity risk since it carries no vehiculo/línea data. 7. Admin "Análisis de importación" tool card - src/app/admin/page.tsx:72 isStagingClient() -> card visibility only, staging alone (not dev01). Already partly known as the STAGING tier in stagingSwitch.ts's own header comment; confirmed the one live call site. NOT FOUND, checked and ruled out: VALIDATOR_COLUMNS/validatorFull (confirmed gone by name, zero hits). No other window.location.hostname or headers.get('host')-style direct check anywhere in src/ outside the two files above (grepped both patterns across all of src/). No PDF generator references any of FAITHFUL/VALIDATOR_FULL/STAGING data. NOT COVERED: whether comentarios_importacion now exists as a column on prod or any third host (DB-side, not checked - the finding in #4 holds regardless of the answer, since the gap is the action having no check of its own). Whether any OTHER table/view read by obtenerComentariosImportacion-style direct-sql actions elsewhere in src/actions has the same no-server-check pattern - only this one action was traced, because it was the one already named in the ticket's starting context (comentariosImportacion). No live-traffic check of whether /lineas/[id] has actually been loaded from prod with SUBE validadoras assigned - this is a code-reachability finding, not a confirmed-exploited one. SUMMARY: 7 surfaces, 2 gate files, 5 predicates, 3 host lists. One gap found beyond what MOVILBA-640 measured: validadora SUBE data is reachable on every host via /lineas/[id] and its editar page, outside the proxy redirect's path scope. One second gap: obtenerComentariosImportacion has no host check of its own, relying solely on client-side gating.
• coder03-mba-l-cc note · 1w ago
  Censo recibido y cerrado en dos items accionables, los dos asignados a coder04-mba-l-ca: MOVILBA-742 por el render de ValidadoraEntitySection fuera del redirect, MOVILBA-743 por el server action sin gate de host propio. Lo que hace que esto sea un censo y no una muestra es haber nombrado docsHost.ts/isDevDocsHost, que MOVILBA-640 nunca nombro: 7 superficies, 2 archivos de gate, 5 predicados, 3 listas de host. Read-only, sin cambiar ninguna lista ni ningun redirect.
• researcher-mba-l-cc statusChanged · 1w ago
  2026-10-08T18:43:39-03:00 / 21:43:39Z researcher-mba-l-cc. Census-reuse half already closed by coder03 (20:00:26Z, -> 742/743). Original-scope half: executed the cheap step, not just proposed it. Added Pendientes row (todo-rutap-importacion-prestaciones.xlsx, row 12) asking Eugenia directly which host/screen showed the Comentarios importacion column - dev01.movilba.com (shows it on purpose) or app.movilba.com (would be a real PROD leak). Lock held on rutap-tracker.xlsx for the write, archive copy saved (archivo/todo-rutap-importacion-prestaciones-20261008-184333.xlsx), identity+Tu-respuesta-column assertions passed before save, reopened and re-verified after. Status set to inProgress, not done: the real choice for Elazar (A: verify against a PROD-faithful host, B: on-screen warning) stays open pending her answer, and is not mine to resolve or to escalate yet - only once dev01 is confirmed as what she saw, per MOVILBA-462's own stated order.
• researcher-mba-l-cc blocked · 1w ago
  2026-10-08T18:44:32-03:00 / 21:44:32Z researcher-mba-l-cc, measurement by coder03-mba-l-cc (18:44 ART): src/lib/stagingSwitch.ts:19 FAITHFUL_HOSTS = exactly [staging.movilba.com, dev01.movilba.com]. app.movilba.com is NOT in it, so isFaithfulHost is false there and the published export route (src/app/api/v1/exports/vehiculos/route.ts:59) CANNOT emit comentariosImportacion on app.movilba.com - 41 columns there, not 42. This kills the 'real leak via the published export' branch outright but does NOT settle the whole question: the same field is published on four surfaces each resolving it via its own query, and only the export route and src/actions/vehiculo-match.ts:75 are host-gated. If Eugenia answers app.movilba.com, the leak is on one of the OTHER (ungated) surfaces and that is where the hunt starts next - sharper than the original A/B. Parking on her reply to the tracker question (Pendientes row 12).
• coder03-mba-l-cc note · 1w ago
  Elazar decision 2026-10-09 (CLI): Eugenia's verification host IS app.movilba.com (PROD); if something's unclear she checks dev01 as a secondary step. Gate is correct as-is: comentarios_importacion hidden on app (PROD), visible on dev01/staging by design (FAITHFUL_HOSTS). Her seeing it on dev01 is expected, not a leak. Original premise (her verification doesn't verify PROD) does not hold - her primary check is PROD.
• coder03-mba-l-cc unblocked · 1w ago
• coder03-mba-l-cc completed · 1w ago
  completed