SEC-WF-004 — Never delete an unmatched DAG name without authorization
| Field | Value |
|---|---|
| Status | Open; source path verified, deployed role evidence pending |
| Architecture state | Deployed delete path; OpenFGA inactive |
| Severity | Critical |
| Affected surface | Delete workflow by name and orphan artifact cleanup |
| Components | sparqd/bff-api, sparqd/workflow-backend, OpenFGA, DAG Git/operations |
| Associated issue | Not opened |
Where the problem appears
Call the managed delete-by-name route for a valid DAG name that has no workflow database record.
Concrete observed case
Workflow-backend source calls delete_workflow when a workflow record exists.
That is an implemented check, not deployed OpenFGA protection in the assessed
environment. When no record exists, the same source route skips even that
check and attempts to delete Git DAG files by the supplied name as an
idempotent cleanup path.
Expected condition
After the authorization plane is activated, a product delete must resolve and authorize an existing canonical workflow. Orphan cleanup is a separate operator-only command with explicit repository scope, dry run, audit, and confirmation.
Cause and evidence
- The no-record branch calls artifact deletion directly.
- No workflow permission can be checked because no canonical workflow was resolved.
- The BFF exposes the by-name delete route to authenticated browser callers.
Why it matters
An authenticated caller may delete DAG artifacts outside managed workflow authorization by choosing a name absent from the workflow database.
Existing controls and workarounds
Disable the browser by-name deletion path or restrict it to trusted platform administrators until the no-record cleanup branch is removed.
Alternatives considered
- Recommended: return 404 for product delete when the managed record is absent.
- Operator-only orphan reconciler keyed by desired-state inventory.
- Authorize only by name — rejected because name is mutable and has no resource permission object when unmatched.
Component involvement
- sparqd/workflow-backend separates product deletion from orphan repair.
- sparqd/bff-api does not expose operator cleanup.
- Operations owns dry-run reconciliation and audit.
Reproduction and verification
Follow WF-S012.
Resolution conditions
Close when unmatched browser deletion cannot mutate Git and approved orphan cleanup requires explicit operator authorization and produces complete audit evidence.
Validation and blockers
Security, workflow-backend, BFF, Git repository, and operations owners must validate immediately.