Repository navigation
fix: match a leased SSO OTP by text, not by gateway sender - #58
Merged
Merged
Conversation
A workflow lease is an explicit statement that one unified-identity OTP is expected inside the window, yet the leased rule still required the configured GUANGDONG_SMS_SENDER. Sender IDs differ per gateway, so a stale value silently let the code reach Telegram during a live login, where the workflow then had nothing to read. Leased presets now match on the SMS text evidence only; the sender guard stays on the statically configured preset. Decisions are logged as structured intercept_decision events, including the case where a lease is held but nothing matches, which is the leak that previously left no trace.
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
AI assistance
WorkBuddy agent (DeepSeek-V4.1-Flash), directed by the repository owner.
What changed
src/pipeline.js:interceptPresetRules(preset, env, { leased })now forwards the source, andguangdongSsoPresetRulesappliesGUANGDONG_SMS_SENDERonly to the statically configured preset. Inside a workflow lease the rule matches on the SMS text evidence (验证码plus one SSO marker) alone.worker.js:findEffectiveInterceptRulereturns{ rule, leased, presets }; forwarding logs a structuredintercept_decisionevent on silence, plus ano_rule_match_while_leasedwarning when a lease is held but nothing matches.docs/configuration.md: documents the lease-vs-sender boundary.tests/pipeline.test.jsand an end-to-end worker case intests/worker-intercept.test.js.Why
During a live Guangdong SSO re-login the portal sent the OTP, but the bot still forwarded it to Telegram, so the workflow had nothing to read and the code reached the human instead.
The lease was held: the sender guard was the only difference. Its configured value did not match the sender actually reported in the message, so the rule never matched and the OTP was forwarded. Sender IDs vary per carrier and gateway, so tying an explicitly leased window to that string turns a configuration drift into a silent code leak.
Scope is unchanged: with no lease, the preset does not apply and other SMS behave exactly as before; text evidence is still mandatory, so an unrelated OTP (bank, courier) is never silenced.
How verified
npm test— 66 passed.npm run lint— clean (node --checkfor every source, test and the Pages relay).