ver1 - Step 5 implementation complete.

2026-06-26 17:51:02 -05:00
parent c9682b0399
commit e90dbe4958
16 changed files with 474 additions and 45 deletions
@@ -0,0 +1,51 @@
+# Ver1 Step 5 Security Assumptions (Private-Network Baseline)
+
+## Operating Model
+
+This system is operated as:
+
+1. single operator
+2. trusted private network
+3. non-public deployment (no direct internet exposure for UI/API)
+
+Out of scope for Step 5:
+
+- enterprise IAM/SSO/RBAC
+- internet-facing zero-trust edge controls
+- multi-tenant user isolation
+
+## Step 5 Controls and Ownership
+
+| Control | Boundary Owner | Verification |
+| --- | --- | --- |
+| Optional operator authentication for `/ui*` and `/api*` routes | `src/transcription/security.py`, `src/transcription/app.py` | `tests/api/test_access_control.py` |
+| Unauthorized contract (`401` + safe envelope + `WWW-Authenticate`) | `src/transcription/api/errors.py` | `tests/api/test_access_control.py` |
+| Upload size guard (`MAX_UPLOAD_BYTES`) | `src/transcription/services/upload.py`, `src/transcription/config.py` | `tests/services/test_upload.py` |
+| Fail-fast auth config when enabled | `src/transcription/config.py` | `tests/test_config.py` |
+| Safe unexpected error messaging (reduced leak surface) | `src/transcription/errors.py` | `tests/test_errors.py`, worker/integration failure tests |
+
+## Access-Control Policy (Step 5)
+
+- Health endpoint (`/healthz`) remains unauthenticated for operability checks.
+- When `OPERATOR_ACCESS_ENABLED=true`, protected paths require HTTP Basic auth:
+  - `/ui`
+  - `/ui/...`
+  - `/api/...`
+- Credentials are runtime-configured:
+  - `OPERATOR_USERNAME` (default `operator`)
+  - `OPERATOR_PASSWORD` (required when access is enabled)
+
+## Secrets Policy
+
+- Secrets must be provided via runtime environment variables.
+- Secrets must not be committed to source control.
+- Secrets must not be logged.
+- Example secret values in docs must always be placeholders.
+
+## Residual Risks (Accepted for Step 5)
+
+1. HTTP Basic credentials are suitable only for trusted private-network deployment.
+2. No per-user identity model (single shared operator credential).
+3. No advanced brute-force/rate-limit controls in Step 5 scope.
+
+These are carried forward for future hardening only if deployment posture changes.