2 Commits

Include renames

Author	SHA1	Message	Date
Logan CusanoandClaude Opus 5	a3681ea698	Stamp org_id everywhere and gate every route that leaked across tenants ... The previous commit shipped Firestore rules that reference an org_id claim nothing issues yet, and an org_id filter nothing writes yet - this is the commit that makes both real. Backend half of SAAS_PLAN.md B2/B2b/B2c. Data model: organizations/{org_id} and org_members/{uid} are new collections (models.py OrganizationRecord/OrgMember). org_id is now an Optional field on NodeRecord, SystemRecord, CallRecord, IncidentRecord, AlertRule, and AlertEvent - optional because every existing document predates it; scripts/backfill_org_id.py (written, not run - it touches production Firestore and Firebase Auth claims) is what closes that gap later. plan_id/subscription_status/stripe_* on OrganizationRecord are deliberately None: no billing or pricing model has been decided, so this is a seam, not a promise. app/internal/tenancy.py holds FOUNDING_ORG_ID, the org every pre-tenancy document and every legacy enrollment path resolves into. Where org_id comes from, end to end: a customer's node enrolls with a per-org token (new enrollment_tokens/{token_hash} collection, minted via POST /org/enrollment-tokens - new routers/org.py) instead of the old fleet-wide ENROLLMENT_TOKEN, which still works as a fallback that resolves to FOUNDING_ORG_ID so an already-deployed node's .env doesn't start failing today. The node's org_id then flows onto every call it produces (mqtt_handler.py's call_start/call_end, upload.py's /upload handler all resolve it from the node doc), and onto every incident correlated from those calls (incident_correlator.py's _create_incident/_create_master_incident). That last one is the part that isn't just a read filter: _build_context's `all_active = collection_list("incidents", status="active")` fed every correlation candidate - fast-path talkgroup match, unit-continuity, disambiguation - from the entire incidents collection, unscoped. Without scoping it to the call's own org_id, a call from org A could link into an incident org B already owns, which is a cross-tenant data merge at correlation time, not just an over-broad read. Same shape of bug in alerter.py: rule matching pulled every enabled alert_rule regardless of org, so org A's keyword rule could fire (and POST org A's Discord webhook) on org B's radio traffic. Both now resolve org_id from the call doc itself rather than threading a new parameter through every caller. Every list/get route gained org scoping via a new resolve_caller_org_id() helper in internal/auth.py, which handles the three credential shapes those routes accept (service key, node api_key, Firebase user) uniformly and returns None (unrestricted) for the service key and platform admins - preserving today's single-org behaviour exactly while closing the leak for everyone else: GET /nodes, /systems, /calls, /incidents, /alerts, /alert-rules. Write routes for nodes/systems (approve, create, delete, etc.) deliberately stay platform-admin-only for now rather than being loosened to org-owner/operator - that's a real gap called out in SAAS_PLAN.md 2.4's "should be" column, but it's a separate authorization redesign the 12-item build order doesn't actually enumerate, and doing it half-considered here risked being exactly the "half-applied filter is worse than none" failure mode the plan warns about. Today's founding org keeps working unchanged; loosening node/system management to org owners is follow-up work, flagged rather than guessed at. Also closed the four spend/access-attack routes SAAS_PLAN.md B2c called out by file and line: POST /calls/{id}/reprocess is now admin-only (was any signed-in viewer looping the Whisper+Gemini pipeline for free - DEFERRED.md had this as a live, independent-of-SaaS exploit) plus a per-call rate limiter as a second guard; POST /alerts/{id}/acknowledge now checks the alert's org_id; GET /admin/features moved from require_firebase_token to require_admin_token; and trips.py's four unauthenticated mutation routes (create_trip, update_trip_tags, create_event, update_event) are now restricted to the founding org (or the bot's service key, or a platform admin) - trips has no org_id of its own and isn't getting one, since [[trips-feature-intentional]] says it's an internal utility riding along on this stack, not a tenant-scoped product surface. New public-but-scoped seam: POST /auth/signup (routers/links.py, alongside the existing /auth/link* routes) provisions an organizations doc and an owner org_members doc for a just-created Firebase user, then sets their org_id/org_role claims - idempotent, so a double-submit doesn't create two orgs. This is the only route that turns "has a Firebase account" into "can read anything," which is what the frontend AuthProvider no-claim guard (next commit) is built around. Also new: GET/PATCH /org for the organization profile (closes the disabled "Save changes" button noted in DEFERRED.md - there was no organizations concept to save into before this), and POST /waitlist (public, source-IP rate-limited, not coupled to any plan or tier - the commercial model is still an open decision per SAAS_PLAN.md section 6). Verified: all touched files py_compile clean; c2-core pytest is 69 passed / 10 failed, matching the documented pre-existing baseline exactly (DEFERRED.md - mqtt_handler/node_sweeper test-vs-code drift, unrelated to this change) - no new failures. flake8 --max-line-length=120 shows no new violations in any touched file (checked each new E501/E221/E30x against `git diff` to confirm it predates this commit); c2-core has no CI lint gate regardless (CLAUDE.md - flake8 only runs in Client CI). No new environment variables. Firestore composite indexes for the queries this introduces were already shipped in the previous commit (infra/firestore/firestore.indexes.json). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-18 20:28:37 -04:00
Logan CusanoandClaude Opus 5	ee633cbe46	Secure the broker for public exposure: TLS and per-node credentials ... Edge nodes are deployed to arbitrary locations by arbitrary people, so the broker has to be reachable from the internet and secured on its own merits rather than by a VPN. Three defects made that impossible. The broker only had a plaintext 1883 listener; every node shared one drb-node password; and the ACL pattern used %c, the client-supplied client id, so any holder of that shared password could set client_id to another node and take over its namespace. The comment claiming this cryptographically prevented cross-node access was wrong and is gone. Authentication now uses mosquitto 2.x's built-in dynamic-security plugin on the stock eclipse-mosquitto image. c2-core administers it over the control topic, creating each node's client on approval with username=<node_id> and password=<its node_keys api_key>, attached to a role whose ACL is nodes/%u/# against the authenticated username. One credential, one revocation point. An HTTP-callback plugin was implemented first and rejected: that project is archived upstream, which is not an acceptable dependency on an internet-facing broker. Because dynsec state is a second source of truth alongside Firestore, approve/reissue/delete now write to the broker first and surface a 502 rather than drifting, and c2-core reconciles every approved node into dynsec on startup. Adds node self-enrollment (POST /nodes/enroll, GET /nodes/{id}/credentials) so a new node can obtain its key over HTTPS without an operator handling secrets by hand. Enrolling an already-approved node_id is refused on the fleet token alone — otherwise a leaked token plus a guessable id would let an attacker steal a live node's key before the real node asked for it. Pickup secrets are stored hashed and returned once, and the endpoint is rate limited per source IP. Infrastructure: an 8883 TLS listener fed by Caddy's certificate via a systemd path unit, a firewall rule for it, and Caddy now 404s /internal/* so the api vhost cannot proxy internal routes. Also fixes CORS, which allowed https://app.<domain> while the frontend is served on the bare domain — every call from the portal would have failed — and widens the vault gitignore to a glob, since ansible-vault leaves backup siblings that the exact-name rule left committable. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-16 09:34:44 -04:00