newdrive/docs/threat-model.md
Elijah 099c53badf
All checks were successful
CI / Backend (push) Successful in 26s
CI / Frontend (push) Successful in 11s
CI / Contracts and repository policy (push) Successful in 4s
CI / Container (push) Successful in 27s
Update architecture baseline for sync, sharing, and gateways
2026-07-16 18:40:12 -07:00

2 KiB

Threat model

Protected assets

  • File contents, metadata, previews, and replacement-recovery blobs.
  • Password, sessions, TOTP secrets, recovery codes, API tokens, share tokens, and OnlyOffice secrets.
  • Database-to-object mapping, backup data, and blob manifests.

Trust boundaries

  • Browser to Nginx Proxy Manager to Drive HTTP service.
  • Drive to PostgreSQL on the private container network.
  • Drive to managed cache/array mounts.
  • Drive to the existing OnlyOffice Document Server.
  • Public-link visitors to explicitly shared resources.
  • Read-only importer mounts to managed Drive storage.
  • Future WebDAV/rclone credentials to an explicitly granted Drive subtree and action set.

Primary threats

  • Unclaimed-instance takeover before first-run setup.
  • Session theft, CSRF, credential guessing, token leakage, and proxy-address spoofing.
  • Path traversal, symlink following, MIME confusion, malicious previews, and archive expansion.
  • SSRF or forged OnlyOffice callbacks.
  • Over-broad, leaked, or revoked integration credentials and protocol gateways that bypass application services.
  • Stale writes, duplicate requests, interrupted commits, and premature GC.
  • Secret disclosure through logs, images, configuration, backups, or repository history.

Phase 0 controls

  • Production setup must finish before proxy exposure; setup is disabled atomically after owner creation.
  • Secrets are environment/file inputs and ignored by Git.
  • Non-root container, explicit mounts, private PostgreSQL network, and health endpoints.
  • Architectural boundaries prevent HTTP code from reaching database or managed storage directly.
  • Security headers, CSRF, authentication, rate limits, scoped tokens, and callback validation are implemented with their Phase 1 features.
  • Phase 1 credentials are independently revocable and may be restricted by subtree and action; future gateways must use them and the canonical mutation path.

Review this document whenever a new external integration, public endpoint, preview processor, or authentication mechanism is introduced.