Application threat model¶

An unauthenticated client can reach Baander directly or through an explicitly trusted reverse proxy. This model follows that client's input through the PHP application and records where the current tests establish a boundary. It also covers a signed-in user attempting to read another user's data, a stolen token, a malicious outbound destination, and unavailable infrastructure.

The evidence applies to the checkout and runtime recorded by each verification run, not to an independently assessed deployment. The testing guide documents the runners and their artifact locations. The separate registry threat model covers the C++ service's credential ownership, replay, parsing, TLS and quorum boundaries. The application checkpoint below does not qualify those boundaries. Regional deployment qualification and deferred mobile work remain separate work. Remaining findings and coverage limits are described below. A scanner canary establishes scanner operation, not resistance to hostile requests.

Assets and actors¶

Actors include anonymous clients, members, playlist collaborators, administrators, operators with console access, external OAuth clients, notification receivers, external metadata providers and an attacker who controls a proxy, DNS answer or application-origin script. Console access is full authority. A compromised host, malicious administrator or arbitrary application-origin script is not contained by ordinary API authorization.

Data flows and trust boundaries¶

Open full-size diagramOpen full-size diagram

Diagram source

flowchart LR
    accTitle: Application trust boundaries
    accDescr: Browser requests reach Swoole directly or through a trusted proxy, then pass through the Symfony firewall and application ports. The application and workers use PostgreSQL, Redis and media storage; workers also contact external services.
    Browser[Browser and service worker] --> Proxy[Optional trusted reverse proxy]
    Browser --> Web[Swoole HTTP and WebSocket]
    Proxy --> Web
    Web --> Kernel[Symfony firewall and application ports]
    Kernel --> PG[(PostgreSQL)]
    Kernel --> Redis[(Redis)]
    Kernel --> Media[Media storage]
    Redis --> Worker[Workers]
    Worker --> PG
    Worker --> Media
    Worker --> External[Mail, push, webhook and metadata services]
    Kernel --> External

The service worker authenticates supported same-origin media requests. It must not send tokens to a matching path on a foreign origin or follow an authenticated media redirect. Browser-auth tests run the real worker and browser storage with a local HTTP fixture; they do not run the production PHP issuer.

Swoole parses wire HTTP before Symfony sees a request. The Symfony firewall checks ordinary API credentials and application ports enforce resource authority. The WebSocket handshake accepts a single-use ticket issued by POST /api/ws/tickets through the OAuth and DPoP firewall. The raw upgrade callback validates its route, framing and exact Origin, then atomically consumes the ticket and checks fresh user/token state. Workers process jobs using application and infrastructure services, with database and media privileges independent of the originating HTTP connection. Tests of a controller alone cannot establish Swoole parsing or a live WebSocket lifecycle.

PHP Discovery is local registration and pairing. RegisterServerHandler generates an API key and persists a server through its application port; pairing handlers persist and complete local sessions. These paths do not call the registry service. A stored server URL is not evidence of an outbound request. The separate registry's replication, quorum and routing security need their own model.

Request identity and proxy deployment¶

Both HTTP layers read TRUSTED_PROXIES, a comma-separated list of proxy addresses or CIDRs. The default is empty, including development. The Swoole trust-all handler is disabled. Configure only the immediate proxies under operator control, and make those proxies remove client-supplied forwarding values before setting their own. A broad container-network CIDR grants every reachable member of that network proxy authority; it is not an automatic consequence of using Docker.

For direct access, leave the list empty. For a reverse proxy, set its actual source address or deliberately restricted CIDR and verify the external scheme, host and client address. This affects rate-limit identities and the URL against which DPoP proofs are checked. TLS termination, trusted-proxy topology and protection of PostgreSQL, Redis and the loopback Swoole management API remain deployment duties.

Threats and evidence¶

Test names below are repository paths relative to tests/ unless a different root is given. Existing tests are evidence of intended controls; the current execution counts and failures belong to the corresponding run artifacts.

Outbound inventory¶

Provider transport boundaries¶

The provider policy accepts HTTPS on port 443 with an approved ASCII hostname, without user information or a fragment. Exact host allowlists and explicitly approved domain suffixes use label boundaries. Every A/AAAA answer must be public; empty, mixed public/private, mapped-private, multicast and IPv6 translation or transition answers are rejected. No LAN exception applies. The transport pins one approved address while retaining the hostname for TLS peer/name verification and uses a fresh HTTP/1.1 connection with proxies disabled. Caller options cannot replace these controls.

Metadata and IPRD requests reject redirects by default. Cover Art Archive alone may follow at most three manual GET redirects within coverartarchive.org, archive.org or their label-boundary subdomains. Each hop repeats validation and pinning and cancels the previous response. Cross-origin hops retain only Accept, Accept-Language and User-Agent headers; credentials, cookies and request bodies are not forwarded. The redirect chain shares one HTTP budget.

Public HTTP requests carry one monotonic deadline through DNS and every approved redirect hop, capped at thirty seconds. Push transport shares a thirty-second budget between DNS and sending; its connection timeout is the smaller of five seconds and the remaining budget. Direct destination-policy calls without a caller deadline use a thirty-second budget.

NativeDnsResolver starts a fresh PHP helper for the system resolver's complete A/AAAA lookup. It retains native family-error semantics and rejects incomplete or invalid output rather than accepting one successful family after the other fails. The caller polls without blocking its coroutine worker. Admission permits at most eight owned children per PHP process, including children still awaiting reaping; independent resolver instances share that bound. Replies are limited to 64 KiB. Polling sleeps for at most five milliseconds, with a one-millisecond minimum near the deadline. Timeout and cancellation kill the direct helper; cleanup polls for up to 250 milliseconds, and an unreaped child retains its admission slot. The helper also arms an alarm rounded up to the remaining whole second, capped at thirty seconds, so abrupt parent exit does not leave a normal lookup unbounded.

Process launch, cleanup and operating-system scheduling prevent a hard real-time return guarantee. Existing provider and Messenger retries can extend the overall operation. Transport-level replay of push requests and Spotify token POSTs stays disabled; delivery is not exactly once. Webhook resolution retains its separate implementation and policy.

Provider API-key queries, push endpoint credentials and transport exception chains are excluded from delivery logs. This protects the changed paths; it is not an exhaustive taint analysis of logging or external observability.

Open findings and qualification work¶

1. WebSocket residual limits. Ticket issuance requires a valid DPoP proof and allowed Origin; a raw access token no longer authenticates an upgrade. Tickets expire within thirty seconds and are single use. A stolen, unused ticket can still race the intended client. Revocation racing connection registration keeps the existing reconciliation bound. Chained sessions close through the immediate logout path; tokens without a refresh chain rely on reconciliation. The embedded player's party message vocabulary remains different from the server protocol; migrating its authentication does not qualify party synchronization. External proxy logging and deferred native clients remain unqualified.
2. Rate-limit storage and residual limits. The configured limiters use shared atomic Redis storage rather than Symfony's cache storage. Each operation executes the installed fixed/sliding-window policy against its own snapshot and compares both the generation and opaque revision before writing. Redis rejects snapshots older than two seconds or from a future server time. Empty reads and per-subject resets leave ten-second revision tombstones, preventing a paused writer from confusing an expired state with the absence it originally read. Definite conflicts retry within a limit of eight total attempts and a two-second monotonic budget; an in-flight bounded Redis call can finish after that deadline. Transport errors, uncertain writes and corrupt state are not retried as fresh consumption. The 19 names, budgets, identity keys, media exemptions and development bypass are unchanged. The full backend suites, focused concurrency/outage checks and production runtime drills have recorded passing runs; those artifacts retain their counts and limits. The rewritten Unit/Shared/Infrastructure/RateLimiter/RateLimiterFailureSemanticsTest.php targets failed storage, conflict refetch, uncertain writes and the retry deadline. The effective configuration contributes to the subject digest, so a configuration change starts a fresh budget; this isolates configurations rather than enforcing one shared budget across a rolling configuration change. Named clears reach all configurations of the limiter. Wrong-type subject keys and missing/invalid generation fields still fail closed after a named clear until expiry or targeted repair. A valid old-generation hash, including extra fields, is replaced on read. DPoP outage handling is a separate mechanism.
3. Provider destination residual limits. Metadata, radio-catalog and persisted push endpoints now use the public destination controls above. Their adapter, pinning, redirect and local TLS checks pass in the CI image; no live-provider or deployment trust-store assessment is claimed. The historical Unit/Metadata/Infrastructure/Api/MetadataStreamRedirectTest.php retains the raw PHP stream reproduction: an HTTPS request follows a redirect to loopback HTTP; CI PHP 8.5.2 also forwards Authorization while host PHP 8.5.11 strips it. That fixture records the former transport's behavior, not a bypass of the new adapters. Bounded helper execution removes native DNS from the coroutine worker and includes lookup in the caller's request budget. The dedicated network-isolated DNS drill and native lifecycle tests cover complete answers, stalled lookups, cancellation and cleanup; execution results belong to the corresponding run artifacts. Per-process helper capacity, cleanup/scheduling tolerance, overall provider retries and approved-provider compromise remain limits. Webhooks, operator-configured lyrics, mail, tracing and browser playback retain their separate policies.
4. Unqualified boundaries. Sustained denial of service, complete HTTP parser differential testing, authenticated pairing races, live external TLS providers and actual regional deployments remain unqualified. The registry model records its separate local quorum qualification. Existing scanner tests do not close any of these findings.

Reproduce the checkpoint¶

Use the CI image and disposable runners from Testing. The security runtime runner creates an internal Docker network and disposable PostgreSQL and Redis, generates test-only OAuth keys and removes its containers on exit. It has a 360-second outer deadline. Malformed-input sockets have three-second deadlines; WebSocket and outage probes use bounded request budgets of up to ten seconds. It does not reset the development database. The Forgejo workflow runs it as a blocking step.

BAANDER_TEST_IMAGE=baander-ci-prewarm:local bash scripts/test-security-runtime-container.sh
BAANDER_TEST_IMAGE=baander-ci-prewarm:local bash scripts/test-unit-container.sh
BAANDER_TEST_IMAGE=baander-ci-prewarm:local BAANDER_FUNCTIONAL_TIMEOUT_ACTIVE=1 \
  bash scripts/test-functional-container.sh tests/Functional
BAANDER_TEST_IMAGE=baander-ci-prewarm:local BAANDER_FUNCTIONAL_TIMEOUT_ACTIVE=1 \
  bash scripts/test-functional-container.sh tests/Integration

The same runner exercises browser-compatible ticket issuance, missing/wrong/replayed proofs, Origin and route rejection, ambiguous query parameters, single-use and concurrent redemption, ticket expiry, account disable, logout closure and pending ticket revocation. It pauses and stops its disposable Redis instance to verify bounded 503 responses, then checks fresh issuance and upgrades after recovery. The client keeps its DPoP key in the window; the service worker gains no new signing permissions. Every reconnect requests a fresh ticket, and cancelled issuance cannot open a late socket.

The full checkpoint also includes PHPStan, Deptrac, container lint and OpenAPI drift. A passing checkpoint supports the named cases and controls, not an assertion that the application has no exploitable vulnerabilities.