🛡️ Sentinel: [HIGH] Enforce strict tenant isolation on cluster sync endpoint - #51
Conversation
Co-authored-by: lucivskvn <7908015+lucivskvn@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
|
Warning Review limit reached
Next review available in: 38 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
WalkthroughCluster sync and dashboard routes now authenticate and scope requests to tenants, with tests covering isolation boundaries. Classifier payload limits, test schema setup, a duplicate decay export, and a Python import were also updated. ChangesTenant isolation
Maintenance cleanup
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant Client
participant ClusterSync
participant TenantMiddleware
participant MemoryDatabase
Client->>ClusterSync: Submit sync payload
ClusterSync->>TenantMiddleware: Authenticate tenant
TenantMiddleware-->>ClusterSync: Return verified tenant
ClusterSync->>MemoryDatabase: Check memory ownership
MemoryDatabase-->>ClusterSync: Return ownership result
ClusterSync->>MemoryDatabase: Perform tenant-scoped upsert
Possibly related PRs
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/openmemory-js/src/server/routes/system.ts`:
- Around line 84-115: Make the ownership validation and deduplicated upsert in
the route’s `q.get_mem.get`/`q.ins_mem.run` flow atomic: wrap both statements in
the database transaction mechanism, or change the upsert to conditionally
preserve the existing `user_id` when a conflicting row already belongs to
another tenant. Ensure concurrent requests cannot overwrite ownership after the
check, while retaining the existing 403 response and version behavior.
🪄 Autofix (Beta)
✅ Autofix completed
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: f201ab70-eff2-48f8-b3bd-1c9170354a32
📒 Files selected for processing (4)
.jules/sentinel.mdpackages/openmemory-js/src/memory/decay.tspackages/openmemory-js/src/server/routes/system.tspackages/openmemory-js/tests/sectors_tenant.test.ts
💤 Files with no reviewable changes (1)
- packages/openmemory-js/src/memory/decay.ts
| const existing = await q.get_mem.get(data.id); | ||
| if (existing && existing.user_id !== tenant) { | ||
| return res.status(403).json({ | ||
| error: "tenant_mismatch", | ||
| message: "Target memory belongs to another tenant.", | ||
| }); | ||
| } | ||
|
|
||
| // Handle version tracker deduplication check | ||
| if (!existing || (data.version ?? 1) > existing.version) { | ||
| // We do an upsert | ||
| // We do an upsert, coalescing undefined fields to null to avoid libSQL TypeError | ||
| await q.ins_mem.run( | ||
| data.id, | ||
| data.user_id, | ||
| data.project_id, | ||
| data.segment, | ||
| data.user_id ?? null, | ||
| data.project_id ?? null, | ||
| data.segment ?? null, | ||
| data.content, | ||
| data.simhash, | ||
| data.simhash ?? null, | ||
| data.primary_sector, | ||
| data.tags, | ||
| data.meta, | ||
| data.created_at, | ||
| data.updated_at, | ||
| data.last_seen_at, | ||
| data.salience, | ||
| data.decay_lambda, | ||
| data.tags ?? null, | ||
| data.meta ?? null, | ||
| data.created_at ?? null, | ||
| data.updated_at ?? null, | ||
| data.last_seen_at ?? null, | ||
| data.salience ?? null, | ||
| data.decay_lambda ?? null, | ||
| data.version ?? 1, | ||
| data.mean_dim, | ||
| data.mean_vec, | ||
| data.compressed_vec, | ||
| data.feedback_score, | ||
| data.mean_dim ?? null, | ||
| data.mean_vec ?? null, | ||
| data.compressed_vec ?? null, | ||
| data.feedback_score ?? null, | ||
| ); |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Inspect q.ins_mem and q.get_mem SQL and any transaction helpers
fd -t f -e ts -p 'core/db' | xargs rg -nP -C3 '(ins_mem|get_mem)\s*[:=]'
rg -nP -C2 '(INSERT|REPLACE|ON CONFLICT|BEGIN|transaction)' packages/openmemory-js/src/core/db* 2>/dev/nullRepository: lucivskvn/OpenMemory-OSS
Length of output: 1999
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== candidate files =="
fd -t f -e ts packages/openmemory-js/src | rg 'db|routes/system' || true
echo "== db query definitions around ins_mem/get_mem =="
sed -n '305,430p' packages/openmemory-js/src/core/db.ts
echo "== system route around ownership check =="
sed -n '60,130p' packages/openmemory-js/src/server/routes/system.ts
echo "== schema/index definitions for memories =="
rg -n -C4 'CREATE TABLE[[:space:]]+memories|CREATE UNIQUE|primary key|CREATE INDEX' packages/openmemory-js/src -SRepository: lucivskvn/OpenMemory-OSS
Length of output: 19365
Make the ownership check transactional before the upsert.
q.get_mem.get(data.id) and q.ins_mem.run(...) are separate statements while ins_mem uses an unconditional INSERT ... ON CONFLICT DO UPDATE. With two concurrent requests from different tenants for the same non-existent data.id, both can pass the existing === null check, with the later write overwriting the earlier tenant’s record. Wrap the read + upsert in a transaction, or use a write-time ownership guard such as an insert-conditioned/statement that leaves user_id unchanged unless the row is still absent.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/openmemory-js/src/server/routes/system.ts` around lines 84 - 115,
Make the ownership validation and deduplicated upsert in the route’s
`q.get_mem.get`/`q.ins_mem.run` flow atomic: wrap both statements in the
database transaction mechanism, or change the upsert to conditionally preserve
the existing `user_id` when a conflicting row already belongs to another tenant.
Ensure concurrent requests cannot overwrite ownership after the check, while
retaining the existing 403 response and version behavior.
…d protect classifier training against DoS Co-authored-by: lucivskvn <7908015+lucivskvn@users.noreply.github.com>
…rd routes and mitigate training DoS risks Co-authored-by: lucivskvn <7908015+lucivskvn@users.noreply.github.com>
…rd routes and fix CI errors Co-authored-by: lucivskvn <7908015+lucivskvn@users.noreply.github.com>
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/openmemory-js/src/server/routes/dashboard.ts`:
- Around line 134-147: Remove or tenant-scope the global telemetry exposed by
the tenant-facing dashboard routes: in
packages/openmemory-js/src/server/routes/dashboard.ts lines 134-147, update the
/dashboard/stats flow and its underlying metrics query/schema to filter request
metrics by tenant, or omit those aggregates; at lines 448-449, likewise
tenant-scope maintenance metrics or remove them from /dashboard/maintenance.
Ensure no tenant can infer other tenants’ workload.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 1851036c-cae4-49c4-a96a-b62dfe115038
📒 Files selected for processing (4)
packages/openmemory-js/src/server/routes/dashboard.tspackages/openmemory-js/tests/sectors_tenant.test.tspackages/openmemory-js/tests/setup.tspackages/openmemory-py/src/openmemory/memory/hsg.py
…rd routes and fix CI errors Co-authored-by: lucivskvn <7908015+lucivskvn@users.noreply.github.com>
…rd routes and fix CI errors Co-authored-by: lucivskvn <7908015+lucivskvn@users.noreply.github.com>
|
Note Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. Fixes Applied SuccessfullyFixed 2 file(s) based on 1 unresolved review comment. Files modified:
Commit: The changes have been pushed to the Time taken: |
Fixed 2 file(s) based on 1 unresolved review comment. Co-authored-by: CodeRabbit <noreply@coderabbit.ai>
|
1 participant
🚨 Severity: HIGH
💡 Vulnerability: Prior to this change,
/api/cluster/syncroute accepted memory sync payloads without validating the authenticated tenant boundaries. Any authenticated user could submit a sync request claiming anyuser_id(allowing writing memories to other tenant's space) or specify another tenant's existing memoryidand overwrite/hijack its contents.🎯 Impact: Exploitable multi-tenant data hijacking, deletion, or manipulation across shared server environments.
🔧 Fix:
require_tenantto authenticate/derive the tenant.reject_tenant_mismatchto prevent spoofing of theuser_idin the synced payload.user_idvalues to the verified tenant ID.403 Forbiddenif it belongs to a different tenant.nullto prevent SQLite/libSQLTypeErrorcrashes on missing inputs.reset_last_decayindecay.ts).✅ Verification: Added comprehensive test assertions in
packages/openmemory-js/tests/sectors_tenant.test.tscovering missing tenant validation, mismatch validation, coercion, and cross-tenant overwrite blocks. All tests pass successfully.PR created automatically by Jules for task 18203014218256310329 started by @lucivskvn
Summary by CodeRabbit