Repository navigation
Enforce operator revocation on cached tokens; refuse conflicting org context - #30
Conversation
…ontexts
revoke-operator revoked refresh tokens, but Firestore rules only checked the
claim, so an already-issued ID token kept global authority for up to an
hour. Revocation now records operator_revocations/{uid} with the Auth
tokens-valid-after time, and isSuperAdmin rejects claimed tokens whose
auth_time precedes it. The revocation root is browser-inaccessible and
excluded from the legacy admin catch-all.
provision-org silently skipped an existing context-v1 even when it was
retired or had different text; it now refuses such conflicts.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017SrzLVR7J3b9nCU177esz8
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4344acac3f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| await auth.revokeRefreshTokens(uid); | ||
| const validAfter = (await auth.getUser(uid)).tokensValidAfterTime; | ||
| const revokedAt = Math.floor(Date.parse(validAfter ?? new Date().toISOString()) / 1000); | ||
| await revocationRef.set({ uid: user.uid, revoked_at_seconds: revokedAt, recorded_at: new Date().toISOString(), source: 'operator_cli' }); |
There was a problem hiding this comment.
If the Firestore write fails after setCustomUserClaims and revokeRefreshTokens succeed—for example during a transient Firestore outage—the command exits with an error but previously issued ID tokens still satisfy isSuperAdmin() because no revocation document exists, preserving global access for up to their remaining lifetime. Make the fail-closed marker durable before the Auth mutations, or otherwise compensate/retry the cross-service operation so a partial failure cannot defeat the immediate-revocation guarantee.
Useful? React with 👍 / 👎.
This branch was successfully deployed
2 participants
Follow-up to #29, addressing the two Codex review findings that arrived as it merged.
P1: revocation didn't reach tokens that were already issued
revoke-operatorremoved the claim and revoked refresh tokens, butisSuperAdmin()infirestore.rulesonly checked the claim. An ID token issued earlier therefore kept global Firestore authority for up to an hour. The server APIs were not affected because they already callverifyIdToken(..., true).revoke-operatornow also writesoperator_revocations/{uid}withrevoked_at_secondstaken from Auth'stokensValidAfterTime.isSuperAdmin()rejects a claimed token whoseauth_timeisn't later than that value, so revocation takes effect immediately. Signing in again after a re-grant works normally.operator_revocations/**is denied to every browser client, including current operators, and is excluded from the legacy admin catch-all rule. Only the Admin SDK writes it.exists()/get()on the same document, and only when the super-admin branch is evaluated.P2:
provision-orgsilently accepted a conflicting contextAn existing
context-v1that was retired or had different text was skipped, and the run reported a no-op. It now parses the existing record and refuses withCONTEXT_EXISTS_WITH_DIFFERENT_CONTENTunless it is published with identical text.Rules deploy note
This changes
firestore.rules. It ships with the same reviewed rules deploy in runbook step 5; nothing deploys automatically.Verification
auth_timebefore the revocation is denied reads and writes; a later sign-in is allowed; the revocation document can't be read, written or deleted by any browser client; operators without a revocation record are unaffected.typecheck:v2;test:v268/68;test:security52/52.🤖 Generated with Claude Code
https://claude.ai/code/session_017SrzLVR7J3b9nCU177esz8
Generated by Claude Code