Repository navigation
hardening(server): validate owner_token is a UUID at ParseScheduledEvent boundary #1524
Description
Context
Surfaced while completing #261 (PR #1516). Deferred out of #1516 to let that PR converge; the change is written but held (not merged into the feature branch).
Idea
ParseScheduledEvent (internal/server/handler.go) should reject a non-empty owner_token that is not a valid UUID, failing loud. asyncInvokeSelf only ever sends uuid.New(), so a non-UUID token is a corrupt/forged payload; validating at the boundary turns it into an explicit error instead of relying on the downstream uuid-cast in the token-guarded clear/mark SQL (which already fails loud at the DB layer, so this is defense-in-depth, not a correctness gap).
Scope
- Boundary validation in ParseScheduledEvent: non-empty token must parse as UUID, else error.
- Tests: malformed / empty / valid token, plus an end-to-end assertion that a valid token reaches CollectRecommendations.
Small, self-contained; can land as its own PR with the standard plan -> implement -> review gate.
Activity
cristim commentedon Jul 27, 2026
Implemented in PR #1516 (commit f53bf37,
fix(server): reject malformed owner tokens at the event boundary) rather than as a separate PR — it landed while completing #1516 and was reviewed clean there. This issue will be resolved when #1516 merges; closing can follow the merge.cristim commentedon Jul 27, 2026
Verification sweep against
main(101f099fb) on 2026-07-27 finds this already resolved.ParseScheduledEvent now validates owner_token at the boundary with uuid.Parse.
Evidence: commit 99854f5 (#1516).
Recommending close.
cristim commentedon Sep 2, 2026
Verified resolved at 3c0f8ac: ParseScheduledEvent rejects a non-empty owner_token that does not parse as a UUID, failing loud at the boundary instead of relying on the downstream UUID cast, while an empty token stays legitimate for the EventBridge cron, HTTP and CLI callers. Evidence: internal/server/handler.go:458-461 (#1516, commit 99854f5). Residual axes checked: tests cover the valid pass-through to CollectRecommendations and the malformed rejection at internal/server/lambda_test.go:262 and :272; the empty-token path is explicitly exempted rather than accidentally skipped; uuid.Parse's error is deliberately not wrapped so the rejected value is not echoed into logs. Closing as completed; reopen if the behaviour recurs.