generated from john/python-template
51 lines
2.0 KiB
Markdown
51 lines
2.0 KiB
Markdown
# Ver1 Step 5 Security Assumptions (Private-Network Baseline)
|
|
|
|
## Operating Model
|
|
|
|
This system is operated as:
|
|
|
|
1. single operator
|
|
2. trusted private network
|
|
3. non-public deployment (no direct internet exposure for UI/API)
|
|
|
|
Out of scope for Step 5:
|
|
|
|
- enterprise IAM/SSO/RBAC
|
|
- internet-facing zero-trust edge controls
|
|
- multi-tenant user isolation
|
|
|
|
## Step 5 Controls and Ownership
|
|
|
|
| Control | Boundary Owner | Verification |
|
|
| --- | --- | --- |
|
|
| Optional operator authentication for `/ui*` and `/api*` routes | `src/transcription/security.py`, `src/transcription/app.py` | `tests/api/test_access_control.py` |
|
|
| Unauthorized contract (`401` + safe envelope + `WWW-Authenticate`) | `src/transcription/api/errors.py` | `tests/api/test_access_control.py` |
|
|
| Upload size guard (`MAX_UPLOAD_BYTES`) | `src/transcription/services/upload.py`, `src/transcription/config.py` | `tests/services/test_upload.py` |
|
|
| Fail-fast auth config when enabled | `src/transcription/config.py` | `tests/test_config.py` |
|
|
| Safe unexpected error messaging (reduced leak surface) | `src/transcription/errors.py` | `tests/test_errors.py`, worker/integration failure tests |
|
|
|
|
## Access-Control Policy (Step 5)
|
|
|
|
- Health endpoint (`/healthz`) remains unauthenticated for operability checks.
|
|
- When `OPERATOR_ACCESS_ENABLED=true`, protected paths require HTTP Basic auth:
|
|
- `/ui`
|
|
- `/ui/...`
|
|
- `/api/...`
|
|
- Credentials are runtime-configured:
|
|
- `OPERATOR_USERNAME` (default `operator`)
|
|
- `OPERATOR_PASSWORD` (required when access is enabled)
|
|
|
|
## Secrets Policy
|
|
|
|
- Secrets must be provided via runtime environment variables.
|
|
- Secrets must not be committed to source control.
|
|
- Secrets must not be logged.
|
|
- Example secret values in docs must always be placeholders.
|
|
|
|
## Residual Risks (Accepted for Step 5)
|
|
|
|
1. HTTP Basic credentials are suitable only for trusted private-network deployment.
|
|
2. No per-user identity model (single shared operator credential).
|
|
3. No advanced brute-force/rate-limit controls in Step 5 scope.
|
|
|
|
These are carried forward for future hardening only if deployment posture changes. |