QA-04 (Connect): Sicherheitspruefung Drittsystem-Credentials #320
Closed
patrick
wants to merge 1 commits from
feature/qa-04-04-sicherheitspruefung-drittsystem-credentials into feature/eng-07-drittsystem-zugangsdaten-ber-core-tenant-kek-hierarchie-verschl-sseln
pull from: feature/qa-04-04-sicherheitspruefung-drittsystem-credentials
merge into: scripte:feature/eng-07-drittsystem-zugangsdaten-ber-core-tenant-kek-hierarchie-verschl-sseln
scripte:main
scripte:fix/ai-app-write-timeout
scripte:chore/migration-kanban-board
scripte:chore/connect-kanban-board
scripte:chore/workflow-kanban-board
scripte:chore/archive-kanban-board
scripte:chore/mail-kanban-board
scripte:chore/dms-kanban-board
scripte:chore/core-kanban-board
scripte:chore/ai-kanban-board
scripte:chore/ai-kanban-security-folgetickets
scripte:feat/ai-app-deployment
scripte:feat/ai-app-vorschlaege
scripte:feat/ai-cls09-herkunftsmarkierung
scripte:feat/ai-eng09-gemini
scripte:feat/ai-cls08-mehrsprachig
scripte:feat/ai-titel-korrespondent
scripte:feat/dms-backup-s3
scripte:feat/dms-s3-verdrahten
scripte:docs/alfresco-vergleich
scripte:refactor/common-batch-2
scripte:refactor/common-modul-pilot
scripte:fix/dms-httpharden-normalize
scripte:feature/shl-02-pagecontainer-dedup
scripte:test/dedup-fakekek-testutil
scripte:feature/nav-01-mail-postfach-registry-eintrag
scripte:feature/sec-08-09-rbac-cmis-audit
scripte:feature/shl-04-globale-modul-navigation
scripte:chore/mail-kanban-security-folgetickets
scripte:chore/dms-kanban-security-folgetickets
scripte:chore/core-kanban-security-folgetickets
scripte:chore/archive-kanban-security-folgetickets
scripte:chore/workflow-kanban-security-folgetickets
scripte:chore/connect-kanban-security-folgetickets
scripte:feature/qa-08-barrierefreiheits-audit-workflow
scripte:feature/tsk-04-aufgaben-oberflaeche-workflow
scripte:feature/qa-08-barrierefreiheits-audit-connect
scripte:feature/int-18-smtp-gateway-weiterleitung-an-feste-adresse-dms
scripte:docs/rollout-131-vorbereitung
scripte:feature/met-08-facturx-zugferd-szenarien-validator-dms
scripte:feature/qa-15-sicherheitspruefung-gesamtprojekt
scripte:fix/testrun-2026-09-21-dms
scripte:feature/cmp-07-dsgvo-loeschantrag-recht-auf-loeschung
scripte:feature/cmp-06-vier-augen-freigabe-fuer-loeschungen
scripte:feature/cmp-02-dsgvo-datenschutz-berichte
scripte:feature/ret-03-loeschworkflow-und-aufbewahrungssperre-legal-hold
1
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
  patrickandClaude Sonnet 5
|
87263c6cb5 |
QA-04: 04 sicherheitspruefung drittsystem credentials
CI / Web-Barrierefreiheitspruefung (axe, Tastatur, Reflow, Textabstaende) (push) Canceled after 0s
CI / Web-Barrierefreiheitspruefung (axe, Tastatur, Reflow, Textabstaende) (pull_request) Canceled after 0s
CI / Core-Modul (Build/Vet/Test) (push) Canceled after 0s
CI / DMS Security-Test-Gate (AC5, Merge-Gate) (push) Canceled after 0s
CI / Connect Security-Test-Gate (QA-01 AC4, Merge-Gate) (push) Canceled after 0s
CI / DMS-Modul Supply-Chain-Scan (govulncheck) (push) Canceled after 0s
CI / Web (dms-browser) (push) Canceled after 0s
CI / Web (pdf-viewer) (push) Canceled after 0s
CI / Web (shl) (push) Canceled after 0s
Supply-Chain-Scan (Go) / govulncheck (push) Canceled after 0s
CI / Core-Modul (Build/Vet/Test) (pull_request) Canceled after 0s
CI / DMS Security-Test-Gate (AC5, Merge-Gate) (pull_request) Canceled after 0s
CI / Connect Security-Test-Gate (QA-01 AC4, Merge-Gate) (pull_request) Canceled after 0s
CI / DMS-Modul Supply-Chain-Scan (govulncheck) (pull_request) Canceled after 0s
CI / Web (dms-browser) (pull_request) Canceled after 0s
CI / Web (pdf-viewer) (pull_request) Canceled after 0s
CI / Web (shl) (pull_request) Canceled after 0s
Core-Schnittstellen-Vertragstests / contract-tests (pull_request) Canceled after 0s
Supply-Chain-Scan (Go) / govulncheck (pull_request) Canceled after 0s
Supply-Chain-Scan (npm) / npm-audit (pull_request) Canceled after 0s
Core-Pflichttest-Gate / pflichttest-gate (pull_request) Canceled after 0s
RBAC-Rollenhierarchie-Pflichtgate / rbac-policy-invariant (pull_request) Canceled after 0s
CI / DMS-Modul (Lint/Build/Test/Coverage/Artefakt) (push) Canceled after 0s
CI / DMS-Modul (Lint/Build/Test/Coverage/Artefakt) (pull_request) Canceled after 0s
Sicherheitspruefung von Verschluesselung, Zugriffskontrolle und Schluesselverwaltung der Connect-Drittsystem-Credentials (Basis: ENG-07, PR #313, noch unmerged). Dabei Luecke gefunden und behoben: Connect hatte keinen Rewrap-Mechanismus fuer Tenant-KEK-Rotation (dms/internal/crypto FDN-09 hat RewrapDEK, Connect nicht) - nach einer Core-Tenant-KEK-Rotation waeren alle gespeicherten Credentials eines Mandanten dauerhaft nicht mehr entschluesselbar gewesen. Fix analog DMS: crypto.RewrapDEK + credential.Store.RewrapTenantKEK, real gegen Postgres-Testdatenbank auf Host 204 geprueft (Rotation ohne Datenverlust nachgewiesen). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> |