example-org/identity-service·synthetic evidence report

PR #128Add cached viewer preferences endpoint

feature/cache-viewer-preferences → mainSHA7c91a2eAdvisory onlyFreshHigh risk

Why this PR needs review

Recommendation: High risk. This synthetic pull request caches authenticated viewer preferences under a shared key without a trusted user, session, or account identifier. Another authenticated request could receive the wrong cached response. The cache also lacks visible expiry, permission-version, revocation, and invalidation safeguards. The asynchronous database path has no visible safe failure boundary.

Review focus

Include verified user, session, and account identity in every cache key.
Invalidate authorization-sensitive entries after role, membership, or session changes.
Add an explicit safe failure boundary around asynchronous database operations.

Evidence used

Authenticated response data reused through a shared cache key
Authorization-sensitive cache without visible freshness safeguards
Asynchronous database work without a visible error boundary

This report is advisory only. Maintainers decide.

Open in GitHubCopy evidenceRe-run analysis

Affected files

6 evidence items

src/api/account/viewer-preferences.ts

6 items

High riskView source code

Code evidence

Diff inline evidence

identity-service/src/api/account/viewer-preferences.ts

1 inline finding

Affected

viewer-preferences.ts

14 const session = await requireSession(request);

15 if (!session?.user?.id) return unauthorized();

16+const cached = preferencesCache.get(sharedPreferencesKey);

17 if (cached) return json(cached);

18+const viewer = await database.viewer.findUnique({

19 where: { id: session.user.id },

20 });

21 const response = { viewer, sessionUserId: session.user.id };

23+preferencesCache.set(sharedPreferencesKey, response);

24 return json(response);

High risk · Auth-specific data cached globallysecurity

The changed endpoint reads and writes authenticated viewer data through a shared cache key. The visible code does not prove isolation by verified user, session, or account identity.

1.Changed path: src/api/account/viewer-preferences.ts
2.Lines: 16-23

Missing visible evidence

Suggested review: Include verified user, session, and account identity in the cache key, or disable shared caching for authenticated responses.

Open source code in GitHub

Evidence timeline

What happened

Evidence timeline12 steps · synthetic sequence

1. PR received

Qedix started reviewing this synthetic pull request.

+5ssample event

1 min ago

2. Changed files analyzed

Qedix reviewed the changed files for this synthetic report.

+5ssample event

55 sec ago

3. Review evidence prepared

Customer-visible findings and suggested review actions were prepared.

+5ssample event

35 sec ago

4. Risk level assigned

The synthetic report was assigned an advisory high-risk level.

+4ssample event

18 sec ago

5. Final recommendation ready

High-risk security review recommended before merge.

+4ssample event

4 sec ago

6. Report ready

The synthetic evidence report is ready for maintainer review.

+4ssample event

now