Skip to main content

AEROSIM-TS-41

Project task

Remove and prohibit local credential surfaces

AeroSim contains no registration, password-entry, password-reset, or local-credential persistence path.

AEROSIM-TS-41Canonical ID TASK-0041
Verified flow state
Done
Owner
AeroSim Architecture and Delivery
Component
Web Application and API Service — identity boundary
Repository
corp-v1-aerosim/corp-v1-aerosim

Delivery scope

Add a repository control that inventories Nebula routes, Fastify routes, Prisma fields, browser forms, and persistence calls and rejects AeroSim-owned registration, password login/reset, password fields, credential hashes, or local token issuance. Primary files: tests/security/no-local-credentials.test.mjs, tests/security/prohibited-credential-patterns.json, applications/api/prisma/schema.prisma, applications/web/src/router.tsx.

Implementation contract

Implementation artifacts

  • tests/security/no-local-credentials.test.mjs
  • tests/security/prohibited-credential-patterns.json
  • applications/api/prisma/schema.prisma
  • applications/web/src/router.tsx

Inputs

  • Tracked Web/API source paths, generated route inventories, and Prisma schema
  • ProhibitedCredentialPatterns for password, passwordHash, register, reset-password, local-login, and token-signing code

Outputs

  • NoLocalCredentialsReport listing scanned paths and zero prohibited credential surfaces
  • Non-zero test result naming the file, route, model, or field that violates the identity boundary

Failure boundaries

  • Fail if a scan root is missing, excluded unexpectedly, or cannot be parsed; an incomplete inventory cannot pass.
  • Fail on any password-type input, local registration/reset route, credential column, argon/bcrypt dependency, or API JWT signing key.

Excluded scope

  • Keycloak-hosted login, password reset, MFA, account administration, and provider session cookies remain Keycloak responsibilities and are not scanned as AeroSim credential features.

Verification steps

  • node --test tests/security/no-local-credentials.test.mjs
  • Inject fixtures containing /register, input type=password, passwordHash in Prisma, and sign(jwt); assert each fails with its exact path.

Traceability

Requirements

Dependencies

UI/UX applicability

non_visual

This Task owns technical or behavioral acceptance and does not claim direct visual conformance to the approved UI/UX package.

Acceptance evidence

Verified delivery: application PR #37 reviewed head a1b426e0ce39162cf0789fe576b3f68521ef5662, exact-head validation task 1869 succeeded, merged as 98f7786d77e97d1431b9bfbd48d0fa082a50c128; Wave 6 integrated application head 5e7babdbc9d3749c062995a48da78cc12a43ef1a passed publish task 1879 and validate task 1880. Release completion verified on product 1.0.0.0 at GitOps revision 5d3712d89dfbf7dacd993348e55f497d126c7bf9 with Argo Synced/Healthy, exact image digests, authenticated API/database access, and three-world configured-flight acceptance.

Current evidence boundary

No current implementation, acceptance, release, or deployment evidence is claimed for this planned Task. Any prior implementation may be used only as prototype and discovery evidence.