🛡️ Sentinel: [CRITICAL] Admin API 인증 누락 해결

.jules/sentinel.md

@@ -32,3 +32,8 @@
 **Vulnerability:** The document hashing routine in `DefaultDocumentConversionService` processed file streams without enforcing any maximum size limit on the bytes read. An attacker could exploit this by uploading a maliciously large stream (or exploiting a compression bomb if unzipping), exhausting system memory, CPU, or disk space (DoS).
 **Learning:** Checking the declared file size (e.g., `file.getSize()`) in initial validation is not always sufficient if the input stream itself can be spoofed or dynamically expanded during reading. The actual bytes read must be verified against bounds continuously.
 **Prevention:** Always enforce a strict, configurable size limit (e.g., `ConversionProperties.maxUploadSizeBytes`) within the `while` loop that reads from untrusted input streams. Track `totalRead` and throw an exception immediately if the limit is exceeded.
+
+## 2026-07-20 - Admin API Authorization Check
+**Vulnerability:** The Admin API (`AdminController`) exposed internal admin endpoints (`/api/v1/admin/convert/jobs`, etc.) without any `TenantAccessService` authorization checks.
+**Learning:** Admin endpoints must enforce strict authorization checks, such as `admin:operate`, to prevent unauthorized internal or external users from listing all tenant jobs, deleting them, or retrying dead lettered jobs without authorization.
+**Prevention:** Always inject `TenantAccessService` into admin endpoints and require appropriate cross-tenant admin permissions via `tenantAccessService.require(headers, "admin:operate")`.

CHANGELOG.md

@@ -24,6 +24,7 @@
 
 ### Security
 
+- Jackson BOM을 `2.22.3`으로 올려 `jackson-databind`의 무제한 type-id 캐시 성장(CVE-2026-91776)과 이차 시간 forward-reference 해석(CVE-2026-91777)을 수정했습니다. 만료된 GHSA-5jmj-h7xm-6q6v OSV 예외를 제거하고 SBOM·제3자 고지문을 새 의존성 그래프와 함께 갱신했습니다.
 - `GET /api/v1/convert/jobs/{jobId}/download`가 리소스 조회 전에 전용 `artifact:read` 권한을 검증하고, PDF 저장소 접근 전에 작업의 tenant 소유권을 확인하도록 강화했습니다. `job:read`만으로는 문서 바이트를 읽을 수 없으며, 인증 누락·권한 누락·교차 tenant UUID 접근은 각각 fail closed 처리되고 교차 tenant 요청은 리소스 존재를 숨기는 `404`를 반환합니다.
 - Maven XML 테스트 보고서 검증기는 각 `testsuite`의 `tests`, `skipped`, `failures`, `errors` 속성을 모두 필수 증거로 요구합니다. 누락된 결과 수를 암묵적으로 0으로 간주하지 않고 fail closed 처리하며, 각 속성 누락 회귀 테스트를 추가했습니다.
 - Maven XML 테스트 보고서 검증기는 UTF-8만 허용하고 UTF-8 BOM은 수용하며, NUL 바이트·DTD·엔터티 선언을 파싱 전에 거부합니다. UTF-16 같은 대체 인코딩으로 위험 선언을 바이트 검사에서 숨기는 우회와 외부 엔터티 읽기·엔터티 확장형 서비스 거부를 회귀 테스트로 차단했습니다.
@@ -36,6 +37,7 @@
 
 ### Fixed
 
+- Enforced `admin:operate` on every Admin API endpoint and repaired the controller test fixture to construct the released `TenantContext` contract directly.
 - 뷰어 UI의 재시도 버튼 로딩 상태가 내부 DOM을 손상시키지 않고 안전하게 복원되도록 수정했습니다.
 
 ## [0.1.0] - 2026-06-25

docs/legal/2026-07-03-third-party-attribution.md

@@ -14,11 +14,11 @@ CycloneDX SBOM. It is engineering evidence, not legal advice.
 | Component | Version | License metadata | Package URL |
 | --- | --- | --- | --- |
 | com.fasterxml.jackson.core:jackson-annotations | 2.22 | Apache-2.0 | `pkg:maven/com.fasterxml.jackson.core/jackson-annotations@2.22?type=jar` |
-| com.fasterxml.jackson.core:jackson-core | 2.22.1 | Apache-2.0 | `pkg:maven/com.fasterxml.jackson.core/jackson-core@2.22.1?type=jar` |
-| com.fasterxml.jackson.core:jackson-databind | 2.22.1 | Apache-2.0 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.22.1?type=jar` |
-| com.fasterxml.jackson.datatype:jackson-datatype-jdk8 | 2.22.1 | Apache-2.0 | `pkg:maven/com.fasterxml.jackson.datatype/jackson-datatype-jdk8@2.22.1?type=jar` |
-| com.fasterxml.jackson.datatype:jackson-datatype-jsr310 | 2.22.1 | Apache-2.0 | `pkg:maven/com.fasterxml.jackson.datatype/jackson-datatype-jsr310@2.22.1?type=jar` |
-| com.fasterxml.jackson.module:jackson-module-parameter-names | 2.22.1 | Apache-2.0 | `pkg:maven/com.fasterxml.jackson.module/jackson-module-parameter-names@2.22.1?type=jar` |
+| com.fasterxml.jackson.core:jackson-core | 2.22.3 | Apache-2.0 | `pkg:maven/com.fasterxml.jackson.core/jackson-core@2.22.3?type=jar` |
+| com.fasterxml.jackson.core:jackson-databind | 2.22.3 | Apache-2.0 | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.22.3?type=jar` |
+| com.fasterxml.jackson.datatype:jackson-datatype-jdk8 | 2.22.3 | Apache-2.0 | `pkg:maven/com.fasterxml.jackson.datatype/jackson-datatype-jdk8@2.22.3?type=jar` |
+| com.fasterxml.jackson.datatype:jackson-datatype-jsr310 | 2.22.3 | Apache-2.0 | `pkg:maven/com.fasterxml.jackson.datatype/jackson-datatype-jsr310@2.22.3?type=jar` |
+| com.fasterxml.jackson.module:jackson-module-parameter-names | 2.22.3 | Apache-2.0 | `pkg:maven/com.fasterxml.jackson.module/jackson-module-parameter-names@2.22.3?type=jar` |
 | com.fasterxml:classmate | 1.7.3 | Apache-2.0 | `pkg:maven/com.fasterxml/classmate@1.7.3?type=jar` |
 | commons-logging:commons-logging | 1.4.0 | Apache-2.0 | `pkg:maven/commons-logging/commons-logging@1.4.0?type=jar` |
 | io.micrometer:micrometer-commons | 1.15.12 | Apache-2.0 | `pkg:maven/io.micrometer/micrometer-commons@1.15.12?type=jar` |

docs/product-technical-gap-baseline.md

@@ -0,0 +1,59 @@
+# Clearfolio Product and Technical Gap Baseline
+
+## Goal and loop
+
+Clearfolio is the ContextualWisdomLab document-viewer bounded context. Its buyer
+quality loop is review → root-cause repair → exact-head validation → ordinary
+merge. A queued, skipped, stale-head, or fail-closed Check is not passing.
+
+## Current product and technical boundary
+
+- **Product responsibility:** submit documents asynchronously, expose conversion
+  status, render same-origin PDF artifacts, and enforce tenant-scoped access.
+- **Runtime boundary:** Spring WebFlux controllers delegate validation,
+  conversion, state, artifact, authorization, and audit work to their owning
+  services and repositories; no cross-service database access is authorized.
+- **Supply-chain boundary:** Maven dependency policy, CycloneDX SBOM, license
+  policy, third-party attribution, Trivy, OSV, Semgrep, and CodeQL provide
+  fail-closed release evidence.
+
+## PRD and TRD acceptance baseline
+
+| Evidence | Acceptance rule | Status |
+| --- | --- | --- |
+| Product behavior | `mvn -B --no-transfer-progress verify`; zero test failures, errors, or skips; production line and branch coverage 100% | Required on exact repair head |
+| Public contract | Java 21 compilation and public Javadocs complete with warning and deprecation budget 0 | Required on exact repair head |
+| Supply chain | Trivy/OSV/SAST report no actionable finding; committed SBOM and attribution match the resolved dependency graph | #503 Security `36824043955` and SAST `36824043968` GREEN |
+| Review admission | Independent approval and all required terminal Checks bind to the current head | Not yet satisfied |
+
+## Gap and action ledger
+
+| Gap | Exact evidence and RCA | Action | Status |
+| --- | --- | --- | --- |
+| Jackson denial-of-service exposure | clearfolio#660 head `2a6b0b621e075da224210c0ca78db344af5dea52`, Security run `36778995059`, Trivy job `110104143035`: CVE-2026-91776 and CVE-2026-91777 in `jackson-databind` 2.22.2 | Repair canonical dependency owner #503 with Jackson 2.22.3, a downgrade regression test, refreshed SBOM/attribution, and removal of the expired OSV exception | Resolved at source commit `3e9ba61e1aa2a903e920cf832f9daa5467f2e166`; CI `36824043863`, Security `36824043955`, SAST `36824043968`, and fuzz `36824043977` GREEN |
+| Historical evidence drift | #503 review found its original one-file 2.22.2 bump left SBOM, attribution, POM rationale, and expired ignore stale | Keep dependency version and buyer evidence in one PR; run attribution/license drift checks | Resolved; both review threads closed and local evidence contracts GREEN |
+| Merge admission | #503 is Ready after product/security/fuzz validation; its Draft CodeQL run `36824043888` was skipped. #660 is Draft on the vulnerable predecessor head. | Obtain a non-skipped CodeQL verdict and independent approval on the current #503 head, then ordinarily integrate it into consumers and revalidate their new heads | Hold |
+
+## Decision traceability
+
+The selected repair is the upstream Jackson 2.22.3 patch line, released
+2026-09-21 with fixes for both CVEs. Ignoring the findings, weakening Trivy, or
+retaining the expired OSV exception was rejected because each would preserve a
+buyer-visible denial-of-service risk or conceal stale evidence. A new duplicate
+dependency PR was rejected because #503 already owns the Jackson version delta.
+
+## References
+
+FasterXML. (2026, September 21). *Jackson release 2.22.3*.
+https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.22.3
+
+
+## 2026-10-01 — Admin API authorization successor evidence
+
+- PR: [#650](https://github.com/ContextualWisdomLab/clearfolio/pull/650)
+- RED exact head: `c6a2a0aa5227c85e52f9eb2c48c7a1839587b802`
+- RED CI: [run 36624093074, Maven test job 109596509190](https://github.com/ContextualWisdomLab/clearfolio/actions/runs/36624093074/job/109596509190)
+- RED Security: [run 36624093209, Trivy job 109733907158](https://github.com/ContextualWisdomLab/clearfolio/actions/runs/36624093209/job/109733907158)
+- Root causes: the new test called nonexistent `TenantContext.fromClaims`, and the consumer head predated canonical Jackson owner #503.
+- Repair: construct the released `TenantContext` record directly, preserve the complete AdminController authorization delta, and integrate owner #503 as an ordinary second parent with its Jackson 2.22.3 dependency/SBOM/attribution/contracts.
+- Status: **Proposed / Draft / merge HOLD** until the new immutable head has terminal CI, Security, SAST, all fuzz shards, CodeQL, and qualifying independent approval. Predecessor, queued, skipped, cancelled, or pending evidence is not GREEN.