Audit: session-trust paths vs isGenuineGoogleSession (auth-bypass check)
pmmaster fleet-wide security question 2026-07-30, arising from VENUS-302: with the email/password provider live at the Supabase API, a direct signUp/signInWithPassword mints a genuine session without traversing /auth/callback. isGenuineGoogleSession is enforced there — enumerate every other path that establishes or trusts a session (middleware, server actions, route handlers) and confirm which re-derive/check genuine-Google vs which only check session-exists. Hypothesis to VERIFY not assume: a self-minted email user has no userRoles row, so §Role Resolution role lookup should deny it everywhere role is checked. Report findings either way — 'role lookup catches it everywhere' is a valid, wanted result if actually confirmed path-by-path. Same question dispatched fleet-wide to mars/pluto.
Questions
Activity
-
coder-venus-cc starting session-trust enumeration (holds PM seat since 2026-08-05)
-
Session-trust audit COMPLETE (2026-08-05, all paths read in current code + live GoTrue read). VERDICT: role lookup catches it everywhere — CONFIRMED path-by-path. (a) getEffectiveUser (src/lib/auth.ts): L1 users.authId / L2 id==auth.uid only, NO email leg (VENUS-305); roles always live public.userRoles (deletedAt IS NULL) — self-minted non-Google uid matches no row → null → denied at every gate. (b) requireAdmin/requireAdminOrRedirect resolve via getEffectiveUser, no JWT read. (c) auth/callback: isGenuineGoogleSession gate + signOut on non-Google; role lookup fail-closed (error → /login, never grant). (d) Middleware = session-refresh+CSP only, no trust decision. (e) All direct auth.getUser() sites enumerated: the 3 roleless email-keyed paths (solicitar-acceso submit / getMyNeedsInfoRequest / resubmitAccessRequest) each explicitly genuine-Google gated (VENUS-306); persona-actions deny unmatched uids; telemetry-only sites use JWT mirror for attribution only, never gating. (f) admin-actions: requireAdmin on every mutation; app_metadata writes are mirror maintenance, never gate reads. (g) Route handlers all via getEffectiveUser / bearer / requireAdmin. (h) LIVE Management API read (venus PAT, ref fjnhfjwskixzsilxrkph): external_email_enabled=false, external_google_enabled=true, anonymous/phone=false — email/password provider OFF, MEASURED not inherited. disable_signup=false but only-Google means signup=Google sign-in, contained by no-userRoles-row structure.
-
Audit complete, no gap found; report DMed to pmmaster-evolutiva-cc