UAT: AuthHeader and ClientAccount auth models accept empty/whitespace-only token, orgId, and hash — no minimum length validation #1832

New issue

Open

opened 2026-04-02 23:56:25 +00:00 by freemo · 1 comment

freemo commented

2026-04-02 23:56:25 +00:00

Owner

Metadata

Branch: fix/auth-model-min-length-validation
Commit Message: fix(auth): enforce min_length=1 on AuthHeader and ClientAccount security-critical fields
Milestone: v3.7.0
Parent Epic: #362

Bug Report

Summary

The AuthHeader and ClientAccount domain models in src/cleveragents/domain/models/auth/auth.py accept empty strings and whitespace-only values for security-critical fields (token, orgId, hash). The models use str_strip_whitespace=True which strips whitespace but does not reject the resulting empty string. This means invalid authentication credentials can be constructed without raising a validation error.

Expected Behavior

Authentication credential models should reject empty or whitespace-only values for security-critical fields. An AuthHeader with an empty token is not a valid authentication credential and should raise a ValidationError at construction time.

Actual Behavior

from cleveragents.domain.models.auth.auth import AuthHeader, ClientAccount

# All of these succeed without error:
h1 = AuthHeader(token='', orgId='org-123', hash='abc123')
# h1.token == ''  — empty token accepted!

h2 = AuthHeader(token='   ', orgId='org-123', hash='abc123')
# h2.token == ''  — whitespace stripped to empty, still accepted!

h3 = AuthHeader(token='valid-token', orgId='', hash='abc123')
# h3.org_id == ''  — empty orgId accepted!

h4 = AuthHeader(token='valid-token', orgId='org-123', hash='')
# h4.hash == ''  — empty hash accepted!

a = ClientAccount(isCloud=True, host='https://api.example.com', email='user@example.com',
                  userName='testuser', userId='user-123', token='', isLocalMode=False, isTrial=False)
# a.token == ''  — empty token accepted!

Steps to Reproduce

from cleveragents.domain.models.auth.auth import AuthHeader
h = AuthHeader(token='', orgId='org-123', hash='abc123')
print(repr(h.token))  # ''  — should have raised ValidationError

Code Location

src/cleveragents/domain/models/auth/auth.py:

AuthHeader.token — Field(...) with no min_length constraint
AuthHeader.org_id (alias orgId) — Field(...) with no min_length constraint
AuthHeader.hash — Field(...) with no min_length constraint
ClientAccount.token — Field(...) with no min_length constraint

Fix

Add min_length=1 to the Field(...) definitions for security-critical fields in AuthHeader and ClientAccount:

token: str = Field(..., min_length=1)
org_id: str = Field(..., alias="orgId", min_length=1)
hash: str = Field(..., min_length=1)

Severity

Medium — Empty auth tokens can be constructed without validation errors, potentially bypassing auth checks in code that trusts the model to be valid.

Subtasks

Add min_length=1 to AuthHeader.token field definition
Add min_length=1 to AuthHeader.org_id (alias orgId) field definition
Add min_length=1 to AuthHeader.hash field definition
Add min_length=1 to ClientAccount.token field definition
Tests (Behave): Add BDD scenarios for empty/whitespace token, orgId, and hash rejection in AuthHeader
Tests (Behave): Add BDD scenarios for empty/whitespace token rejection in ClientAccount
Tests (Robot): Add integration smoke tests confirming ValidationError is raised for empty security-critical fields
Verify coverage >= 97% via nox -s coverage_report
Run nox (all default sessions), fix any errors

Definition of Done

This issue is complete when:

All subtasks above are completed and checked off.
AuthHeader and ClientAccount raise ValidationError for empty or whitespace-only values on all security-critical fields (token, orgId, hash).
BDD scenarios covering the fix are passing.
A Git commit is created where the first line of the commit message matches the Commit Message in Metadata exactly, followed by a blank line, then additional lines providing relevant details about the implementation.
The commit is pushed to the remote on the branch matching the Branch in Metadata exactly.
The commit is submitted as a pull request to master, reviewed, and merged before this issue is marked done.
All nox stages pass.
Coverage >= 97%.

Automated by CleverAgents Bot
Supervisor: UAT Testing | Agent: ca-new-issue-creator

## Metadata - **Branch**: `fix/auth-model-min-length-validation` - **Commit Message**: `fix(auth): enforce min_length=1 on AuthHeader and ClientAccount security-critical fields` - **Milestone**: v3.7.0 - **Parent Epic**: #362 ## Bug Report ### Summary The `AuthHeader` and `ClientAccount` domain models in `src/cleveragents/domain/models/auth/auth.py` accept empty strings and whitespace-only values for security-critical fields (`token`, `orgId`, `hash`). The models use `str_strip_whitespace=True` which strips whitespace but does not reject the resulting empty string. This means invalid authentication credentials can be constructed without raising a validation error. ### Expected Behavior Authentication credential models should reject empty or whitespace-only values for security-critical fields. An `AuthHeader` with an empty `token` is not a valid authentication credential and should raise a `ValidationError` at construction time. ### Actual Behavior ```python from cleveragents.domain.models.auth.auth import AuthHeader, ClientAccount # All of these succeed without error: h1 = AuthHeader(token='', orgId='org-123', hash='abc123') # h1.token == '' — empty token accepted! h2 = AuthHeader(token=' ', orgId='org-123', hash='abc123') # h2.token == '' — whitespace stripped to empty, still accepted! h3 = AuthHeader(token='valid-token', orgId='', hash='abc123') # h3.org_id == '' — empty orgId accepted! h4 = AuthHeader(token='valid-token', orgId='org-123', hash='') # h4.hash == '' — empty hash accepted! a = ClientAccount(isCloud=True, host='https://api.example.com', email='user@example.com', userName='testuser', userId='user-123', token='', isLocalMode=False, isTrial=False) # a.token == '' — empty token accepted! ``` ### Steps to Reproduce ```python from cleveragents.domain.models.auth.auth import AuthHeader h = AuthHeader(token='', orgId='org-123', hash='abc123') print(repr(h.token)) # '' — should have raised ValidationError ``` ### Code Location `src/cleveragents/domain/models/auth/auth.py`: - `AuthHeader.token` — `Field(...)` with no `min_length` constraint - `AuthHeader.org_id` (alias `orgId`) — `Field(...)` with no `min_length` constraint - `AuthHeader.hash` — `Field(...)` with no `min_length` constraint - `ClientAccount.token` — `Field(...)` with no `min_length` constraint ### Fix Add `min_length=1` to the `Field(...)` definitions for security-critical fields in `AuthHeader` and `ClientAccount`: ```python token: str = Field(..., min_length=1) org_id: str = Field(..., alias="orgId", min_length=1) hash: str = Field(..., min_length=1) ``` ### Severity **Medium** — Empty auth tokens can be constructed without validation errors, potentially bypassing auth checks in code that trusts the model to be valid. ## Subtasks - [ ] Add `min_length=1` to `AuthHeader.token` field definition - [ ] Add `min_length=1` to `AuthHeader.org_id` (alias `orgId`) field definition - [ ] Add `min_length=1` to `AuthHeader.hash` field definition - [ ] Add `min_length=1` to `ClientAccount.token` field definition - [ ] Tests (Behave): Add BDD scenarios for empty/whitespace token, orgId, and hash rejection in `AuthHeader` - [ ] Tests (Behave): Add BDD scenarios for empty/whitespace token rejection in `ClientAccount` - [ ] Tests (Robot): Add integration smoke tests confirming `ValidationError` is raised for empty security-critical fields - [ ] Verify coverage >= 97% via `nox -s coverage_report` - [ ] Run `nox` (all default sessions), fix any errors ## Definition of Done This issue is complete when: - All subtasks above are completed and checked off. - `AuthHeader` and `ClientAccount` raise `ValidationError` for empty or whitespace-only values on all security-critical fields (`token`, `orgId`, `hash`). - BDD scenarios covering the fix are passing. - A Git commit is created where the **first line** of the commit message matches the Commit Message in Metadata exactly, followed by a blank line, then additional lines providing relevant details about the implementation. - The commit is pushed to the remote on the branch matching the **Branch** in Metadata exactly. - The commit is submitted as a **pull request** to `master`, reviewed, and **merged** before this issue is marked done. - All nox stages pass. - Coverage >= 97%. --- **Automated by CleverAgents Bot** Supervisor: UAT Testing | Agent: ca-new-issue-creator

freemo added this to the v3.7.0 milestone

2026-04-02 23:57:24 +00:00

freemo referenced this issue

2026-04-02 23:58:16 +00:00

[UAT-SUPERVISOR] Progress Report — Cycle 461 — v3.7.0 #1850

freemo added a new dependency

2026-04-03 00:03:31 +00:00

#362 Epic: Security & Safety Hardening

freemo commented

2026-04-03 00:05:00 +00:00

Author

Owner

Issue triaged by project owner:

State: Verified
MoSCoW: MoSCoW/Should Have — bug or error handling improvement.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: ca-project-owner

Issue triaged by project owner: - **State**: Verified - **MoSCoW**: MoSCoW/Should Have — bug or error handling improvement. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: ca-project-owner