[seonghobae]

보안 강화 목적으로 API 응답 헤더에 Permissions-Policy를 추가하여 불필요한 브라우저 기능(위치, 카메라, 마이크 등) 접근을 제한합니다.

---

PR created automatically by Jules for task 2088908442237673682 started by @seonghobae

Summary by CodeRabbit

• 보안
  • API 응답에 위치 정보, 카메라, 마이크 접근을 차단하는 Permissions-Policy 헤더를 추가했습니다. 오류 응답에도 이 정책이 적용됩니다.

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: ContextualWisdomLab/newsdom-api/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 0a162f7b-e1a4-458d-abdf-399905fe4f6a

📥 Commits

Reviewing files that changed from the base of the PR and between 539528f and e24a5bc.

📒 Files selected for processing (11)

• .jules/sentinel.md
• src/newsdom_api/main.py
• src/newsdom_api/schemas.py
• tests/test_auth.py
• tests/test_auth_deployment_contract.py
• tests/test_auth_fail_closed_contract.py
• tests/test_auth_protocol_edges.py
• tests/test_health.py
• tests/test_parse_endpoint.py
• tests/test_project_metadata.py
• tests/test_pypdf_security_floor.py

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

API 응답에 geolocation, camera, microphone을 비활성화하는 Permissions-Policy 헤더를 추가했습니다. 응답 헤더 테스트와 보안 지침을 갱신했습니다. 스키마 예시와 일부 테스트 코드는 동작 변경 없이 서식을 정리했습니다.

Changes

Permissions-Policy 헤더

Layer / File(s)	Summary
헤더 적용 및 응답 검증 .jules/sentinel.md, src/newsdom_api/main.py, tests/test_health.py, tests/test_parse_endpoint.py	API 응답에 Permissions-Policy: geolocation=(), camera=(), microphone=()를 추가했습니다. /health 응답과 처리 중 예외가 발생한 응답에서 헤더 값을 검사합니다. 보안 지침에도 해당 정책을 기록했습니다.

기존 코드 서식 정리

Layer / File(s)	Summary
선언 및 호출 서식 정리 src/newsdom_api/schemas.py, tests/test_auth.py, tests/test_auth_deployment_contract.py, tests/test_auth_fail_closed_contract.py, tests/test_auth_protocol_edges.py, tests/test_project_metadata.py, tests/test_pypdf_security_floor.py	스키마 예시, 테스트 데이터와 호출부, 문자열 및 사전 표현을 정리했습니다. 검증 조건과 테스트 동작은 변경되지 않았습니다.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Merge Risk: ⚪ Minimal · up to 50a31

The Permissions-Policy reaches normal and handled-error responses, and .jules/sentinel.md is outside the project’s required markdownlint scope. No actionable merge blocker is established.

Security Architecture Review

Security architecture risk: ⚪ Minimal · up to e24a5

The change adds a fixed, restrictive response header without expanding parser access, weakening authentication, or changing application state ownership. No material security regression was identified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The changed control affects responses using the shared helper and restricts browser capabilities. It does not introduce new parser callers, credentials, tenant access, or server-side privileges.

Trust Boundaries and Controls

• observed — The new policy value is a fixed literal rather than request-derived data. The existing pre-body authorization check for POST /parse remains in place, and the PR does not change its ordering or authority.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	설명은 변경 사항 요약을 포함하지만, 템플릿의 Git Flow target, Verification, Notes 섹션과 테스트 결과를 포함하지 않습니다.	템플릿에 따라 Git Flow target, Verification, Notes 섹션을 추가하세요. 실행한 pytest 및 PYTHONWARNINGS=error pytest 결과도 표시하세요.
Docstring Coverage	⚠️ Warning	Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 15 functions across 10 files. (1 skipped:…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	제목은 Permissions-Policy 보안 헤더 추가라는 주요 변경 사항을 명확하고 간결하게 설명합니다.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 15 functions across 10 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Exact-head failed-check RCA and non-force repair

• Failed head: 50a314b154cc4fb25af8d215d03dd34b7d6134d1.
• Security Scan run 36789136892, job 110137641217: Trivy reported 12 findings from the stale uv.lock (anyio, httpcore2, httpx2, pypdf, urllib3).
• codeql run 36789136867, job 110137592486: analysis completed, but SARIF upload failed with the GitHub installation API rate limit; this is distinct from the dependency defect.
• Canonical dependency-security owner: fix(deps): raise parser and TestClient security floors #822 at 23e481577af0283da512d9b2626ae27188245bdc, whose exact Security/tests/codeql/Semgrep/container/scorecards/fuzz runs are successful (its separate CodeQL PR dispatcher is skipped, not counted as passing).

Repair: created ordinary two-parent merge commit 2dc876bcba5e43b366aec1e4c4427aede1db06bc (first parent = exact feature head, second parent = #822), preserving the Permissions-Policy source, tests, schema/formatting deltas, and sentinel entry while taking the owner dependency floors/lock/tests/docs. The branch ref was advanced with force=false after an exact-head recheck.

Fresh checks on 2dc876bcba5e43b366aec1e4c4427aede1db06bc are authoritative; queued/pending/skipped jobs are not passing and no merge is claimed.

[seonghobae]

Concurrent tree-revert preservation and repair

After 2dc876bcba5e43b366aec1e4c4427aede1db06bc, a concurrent child commit 560d06d4623010f9025beea3dbbce2f0fca9a4f1 re-applied the feature tree but reverted the canonical owner changes: it removed docs/product-technical-gap-baseline.md and tests/test_httpx2_security_floor.py, downgraded the dependency floors/lock, removed the form-field bounds, and reverted the associated tests/docs. Its feature intent was already present in the parent.

The commit remains preserved in ordinary history. Follow-up 420a423f58799f717de9bc60d98d7c14d9c72d5e uses it as first parent and restores exact result tree cd272d84016c26e50f81e954a0b870106c28572c, which carries both #822 and the Permissions-Policy feature. Ref update was force=false after exact-head recheck.

Fresh checks on 420a423... are authoritative. No merge or passing claim is made while queued/running.

[seonghobae]

Exact-head admission correction (5a8529b): this PR is not currently merge-ready. Terminal failing Checks: Security Scan (failure), codeql (failure). Ready is review admission, but this revision now has concrete repair work; converting to Draft preserves the delta while causal owner/leaf RED→GREEN repair and fresh exact-head Checks proceed. No close, bypass, force update, destructive rebase, or manual rerun was used.

[seonghobae]

RCA / preservation update (2026-10-01): direct repairs on this generator branch were overwritten repeatedly by the same stale snapshot writer. To avoid another lossy edit, Draft successor #988 now carries the complete current #987 history plus canonical dependency-owner commit 23e481577af0283da512d9b2626ae27188245bdc, producing the previously verified owner tree cd272d84016c26e50f81e954a0b870106c28572c at exact successor head f6bcf169b22b73c3f9b2be267659d2eaf33e391d. This PR remains open and Draft; it must not be retired until #988 exact-head Checks and complete-delta equivalence are verified.

[seonghobae]

Successor evidence refresh: #988 advanced by ordinary non-force child commit from f6bcf169... to exact 9f030e97165841f70bef8e28c1d0ded536a13fc4 (tree 14bfb03cae613b6c4151dc8f614bfa3b9fe72164) to repair new exact-head urllib3 findings. The predecessor remains open/Draft. Retirement is still prohibited until the current successor head—not the historical f6bcf169... head—has terminal Checks and verified complete carryover.