Security context

Highlights

Auth Bypass: 20 prior fixes. Scrutinize any change in this area.

examples/bri-3/src/bri/identity/bpiSubjects/api/subjects.controller.ts: most-fixed (4 issues). Treat as high-risk during review.

26 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Auth Bypass: NestJS Authorization Guards were bypassing access control entirely. This occurred because async database checks for BPI Subject roles were not properly awaited, and guards trusted unauthenticated, incomplete request-bound objects instead of fetching the authoritative user with their active role relations directly from the database.

Auth Bypass: Critical administrative routes, such as the creation of a BpiSubject, lacked proper NestJS authorization checks. The endpoints were exposed to bypasses because they either missed the AuthzGuard entirely, lacked specific CASL action decorators, or were explicitly marked with a public access decorator.

Auth Bypass: Cryptographic signature verification logic was broken at the agent layer. Key defects allowed signature validation to bypass security checks by verifying against the signature payload itself rather than the sender's actual public key, while unhandled parsing errors (e.g., failing to strip '0x' prefixes or handle message format errors) could trigger application crashes or logic failures.