SEC-CAT-001 — Authorize DataHub mutations per actor and resource
| Field | Value |
|---|---|
| Status | Open finding; source-verified, security review required |
| Severity | Critical |
| Affected surface | Table and column descriptions, tags, and structured metadata |
| Implementation issue | bff-api #232 |
| Code-change repository | sparqd/bff-api |
Where the problem appears
Attempt an approved disposable metadata mutation as platform administrator, non-admin Catalog roles, and an actor denied access to the target resource.
Concrete observed case
Reviewed mutation routes verify authentication but do not establish a role/resource authorization decision before acting through the shared BFF DataHub credential. DataHub therefore observes the service credential rather than independently enforcing the end user's Catalog rights.
Expected condition
Authorize every mutation against actor, workspace, canonical resource, scope, and action before using the service credential. Record the end-user actor, decision, target, before/after state, and correlation identity.
Cause and evidence
- The BFF mediates DataHub writes with a shared service identity.
- The reviewed routes did not expose a complete role and resource check.
- UI visibility is not a security boundary.
Why it matters
An authenticated user may mutate metadata outside their intended authority, and audit records may attribute changes only to a shared service.
Existing controls and workarounds
Restrict metadata mutation routes operationally until the role/resource matrix is verified. Use disposable fixtures for testing.
Alternatives considered
- Recommended: BFF policy enforcement plus end-user audit attribution.
- Delegate directly to DataHub user identities — viable only with complete identity federation and matching policies.
- Hide controls for non-admins only — rejected because direct API calls remain possible.
Component involvement
- BFF owns authorization and audit enforcement.
- Oqullus reflects capability but is not the enforcement point.
- DataHub stores canonical metadata and service-side audit context.
Reproduction and verification
Follow CAT-S006. Record the visible state, request outcome, effective identity, and recovery behavior relevant to this finding.
Resolution conditions
Close after allowed and denied role/resource cases pass, denial occurs before DataHub mutation, and audit identifies the initiating actor and canonical target.
Validation and blockers
Security and BFF owners must validate. Until then this remains a critical open finding.