2 Commits

Author	SHA1	Message	Date
Oliver Kieselbach	fb49dc9ad2	fix(backend): bind device block/kill to the certificate identity and repair session-scoped auto-unblock ... CWE-807: the kill switch was keyed only by the caller-declared X-Device-SerialNumber, so omitting or forging the header dodged block and kill. A block now mirrors onto the device's certificate identities (Sessions.OwnerDeviceId) as id:{guid} alias rows in BlockedDevices, resolved at block time; KillSwitchEvaluator checks serial, then identity, then version and stamps the DeviceIdentityBinding request dimension. Alias rows are hidden from listings and exempt from the legacy-key migration; unblock removes them. Session-scoped watchdog blocks were unreachable (no session id ever reached the evaluator): ingest now carries the verdict past the body parse and re-evaluates with the session id, and holds the registered serial against the block list when the header differs. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-01 23:37:41 +02:00
Oliver Kieselbach	76af1234ed	fix(security): BlockedDevices rows are keyed by the canonicalized serial (trim + upper-invariant) so case-variant serials from a rogue agent or an admin's inventory copy still hit the block/kill row; legacy verbatim-case rows are dual-read and lazily re-keyed ... Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-08-30 00:27:07 +02:00