SECURITY: Cross-tenant access (IDOR) on single-resource endpoints + input-size DoS

[echel0nn]

Labels: security, multi-tenant, priority-high
Severity: S0/S1. List endpoints scope by team but single-resource access does not -- any authenticated user reaches any team's data by id.

Finding (path:line)	Issue
modules/malware/api_router.py:1090-1143 (+25 more)	Single-resource GET/PATCH/DELETE do del request, auth and look up by primary key only -> any authenticated user reads/mutates any team's targets, investigations, branches, outcomes, observations, playbooks by UUID
api/routers/findings_workflow.py + :280	Finding workflow transitions and evidence-chain use finding_id with no team/ownership check -> any operator transitions any team's finding
api/routers/tags.py	Tag assign/list/delete look up system_id with no team scope -> IDOR across teams
api/routers/dashboard.py, topology.py, search.py, executive.py	No team scoping -> any reader sees fleet-wide systems/connections, searches all teams, and downloads fleet-wide risk PDFs + per-system evidence ZIPs
api/middleware/idempotency.py	Idempotency cache key is IDEM:{key} with no user scope -> user A replays user B's cached response by guessing the key
modules/malware/api_router.py:979	upload_target does contents = await sample.read() with no size guard -> a multi-GB POST OOMs the uvicorn worker (trivial DoS)
api/routers/cost.py:269	Admin check uses getattr(auth,'is_admin',False) instead of auth.role == 'admin' -> inconsistent guard that may bypass depending on AuthContext shape

Acceptance: every single-resource handler resolves the row with a team/ownership predicate (not bare PK); idempotency keys namespaced by principal; uploads size-capped and streamed; the admin check uses the canonical role field everywhere.

[echel0nn]

Design decision (2026-07-19). Tenancy CONFIRMED multi-tenant with real data separation, so these single-resource IDOR paths are genuine S0s. Every single-resource handler must resolve rows with a team/ownership predicate, not a bare primary key.

[echel0nn]

Implementation-ready design (2026-07-19). Wave 1a. Full design on disk: .run/designs/DESIGN_tenant_isolation.md (8-heading template: grounded problem, design with signatures+DDL+Alembic, reworked concerns, test plan, rollout).

Key moves:

• Every single-resource handler resolves rows with owned_or_404 (team/ownership predicate), not bare PK -- malware 30+ endpoints, findings_workflow, tags, dashboard/topology/search/executive.
• Idempotency cache key namespaced by principal (stops replay); upload size cap; cost.py admin check uses auth.role.