[amar-python]

What

Preparation for the two trackers that can't be closed from code: #112 needs an independent reviewer, and #113 needs a person with access to the real identity provider. This PR makes both as cheap as possible. Neither tracker is closed by it.

Stacked on #228 (M7), on #227 (M6), on #226 (M5). The base is the M7 branch, so this diff shows only this work.

#113: OIDC against the real IdP

• The https:// key fetch now has tests. The tracker said it ran in no test. tests/system/test_oidc_https.py runs PyJWT's PyJWKClient for real against a local TLS server (tests/oidc_stub.py): a trusted certificate, key caching, a forged token naming a published key, claim checks, key rotation, an untrusted certificate, an IdP that is down, one that hangs, and a full sign-in through the API.
• The key fetch now times out after 5 s. PyJWT's default is 30 s, which would hold a request thread that long on every sign-in attempt while the IdP is unreachable. The hang test fails without the change.
• A correction to a comment, found by writing the rotation test: api/oidc.py implied a rotated key is re-fetched immediately. PyJWT re-fetches at most every 30 s (so random key ids can't hammer the IdP), which means a freshly rotated key can be refused for up to 30 s. The comment, the env var doc and the runbook now say so, and a test pins both halves.
• scripts/check_oidc.py + docs/OIDC_REAL_IDP_CHECK.md: the real check as one command. It runs config, discovery, the key set, the token and (with --api) the sign-in as separate stages, each with a hint for its failure, and never prints the ID token or the session token. The token comes from an environment variable, a file or stdin, never the command line. The runbook uses the device-code flow (Keycloak and Entra ID), so the token never touches a browser address bar or a third-party debugger.

#112: security review pack

docs/SECURITY_REVIEW_PACK.md maps the five areas in scope (authentication, tenant isolation, role matrix, upload handling, deployment secrets) to their controls, the code and the tests behind them, and questions for the reviewer, and records 11 weaknesses I found while preparing it, each with how it was verified. The headline ones:

F1	No limit on the request body before it is parsed, so a signed-in uploader can make the server buffer any size before the 413
F3	Rate limiting keys on the peer IP, so behind a reverse proxy everyone shares one budget
F7	One runtime role reaches every tenant's schema; the per-tenant roles in the original design were never built
F8	The shared API key bypasses tenants and roles, and every action it takes audits as api_key
F2	The unauthenticated /api/health returns the database name, host and port and exact PostgreSQL version; /docs and /openapi.json are open (verified by calling it)
F9	Key Vault and the registry are left publicly reachable "temporarily" until someone flips them; the API's own secrets have no deployment definition

None of these is fixed here. Whether to fix, accept or defer each is the review's output, and several (F3, F5, F7, F8) are product decisions.

• make security-evidence runs the tests behind the pack: 231 pass.
• The frontend's print window is the one place HTML is built by hand (same origin as the session token) and had no test. export.test.ts now checks that every user-supplied value is escaped there; breaking the escaping fails it.
• pip-audit (Python) and npm audit --omit=dev (frontend) found nothing on 2026-11-10.

Decisions to check

• The accessibility job now also runs the frontend's vitest suite (17 files, 171 tests). No job ran it before. It passes locally with the same Node 22 and npm ci. The step is separable: drop it from quality-gate.yml if you'd rather add it yourselves. (I first made it a separate job, but tests/unit/test_ci_quality_gate.py requires every job to have a Python setup and an artifact upload step, so it lives in the job that already has Node and npm ci.)
• The pack is not a substitute for the review. It does not cover a penetration test, the live state of Key Vault and the Terraform state account (I didn't check them), a secret scan of git history, or TLS and proxy configuration. Section 9 lists these.
• Severities in the pack are my estimates, for the reviewer to overrule.

What's still needed to close the trackers

• Security review of the threat model before the first external tenant #112: you name an owner and a reviewer; they work through the pack and fill in section 10.
• Check OIDC sign-in against the real IdP (https JWKS path) #113: someone with access to the IdP runs scripts/check_oidc.py once and pastes the (secret-free) output on the issue.

Verification

Full suite for the M7 base passes (584 tests); this branch adds 29 Python tests (test_oidc_https.py 12, test_check_oidc.py 17) plus 3 frontend tests, and all 38 OIDC tests pass together. scripts/lint.sh clean, bandit shows only the existing api/db.py notes, docs/TEST_CASES.md regenerated.

https://claude.ai/code/session_011T6WqhUfEMZv2Dxerqs2Eq

---

Generated by Claude Code

[amar-python]

The accessibility (Playwright + axe-core) check failed on the previous head with the same scenario and violation as on #226 and #228: upload_mapping_dialog, a color-contrast result on 13 muted-text elements. It isn't caused by this PR (no frontend files change here; the frontend tests in the same job passed, 171 of 171).

A fix for it already exists: 715469c on #226's branch makes the scan wait for running animations to finish, because a dialog still fading in is blended with the page behind it. That branch hadn't reached this one, so I've merged it in (via the M7 branch) rather than leave this PR red until #226 merges. This push re-runs the checks.

---

Generated by Claude Code