Threat Model

Method: STRIDE across trust boundaries, mapped to the OWASP API Security Top 10 (2023), with attack trees for crown-jewel assets and a ranked risk register.

:::danger Critical risks Cross-tenant data leak and encryption key compromise are classified Critical. Every deployment must pass the cross-tenant isolation test before going to production. :::

1. Assets & Adversaries

Assets (what we protect):

1. Tenant data — file bytes and metadata
2. Credentials & encryption keys — tokens, API keys, DEKs, KEKs
3. Audit log integrity — the tamper-evident record of actions
4. Availability — service continuity and SLOs
5. Namespace correctness — the file tree’s consistency guarantees

Cross-tenant confidentiality and key compromise are catastrophic (unrecoverable). Availability and integrity failures are severe but recoverable.

Adversaries:

• External attacker (unauthenticated)
• Malicious tenant or user (authenticated, attacking other tenants)
• Compromised credential or API key
• Malicious insider / rogue DBA
• Malicious plugin author
• Supply-chain attacker
• Anonymous public-link abuser

2. STRIDE by Trust Boundary

3. OWASP API Top 10 (2023)

4. Cross-Tenant Attack Vectors

These deserve explicit call-out because authentication and authorization alone do not prevent them:

• Forged tenant_id — tenant context must derive from the verified token, resolved before any business logic, and re-checked on every authorization decision, never accepted from client input.
• Cache-key collision — prefs:{user_id} identical across tenants → tenant-prefix every Redis key by construction.
• Connection-pool contamination — a global tenant_id written during an await lets a concurrent request adopt it (identity swap) → request-scoped context + PgBouncer session pooling with mandatory server_reset_query.
• SQLi overriding tenant_id — parameterized queries at every call site; RLS as a backstop that cannot be bypassed by SQL injection.
• Sensitive values in URLs — leak into access logs and Referer headers (CWE-532) → identifiers only in request body or headers, never in the query string.
• Side-channels (dedup existence, timing) — per-tenant dedup scope (ADR-0018) prevents existence probes across tenants.

5. Attack Tree: Read Another Tenant’s File

flowchart TB
    classDef g fill:#fecaca,stroke:#b91c1c,color:#111827;
    classDef a fill:#fde68a,stroke:#b45309,color:#111827;
    classDef m fill:#bbf7d0,stroke:#15803d,color:#111827;
    G["GOAL: read tenant B's file as tenant A"]:::g
    G --> A1["forge / alter tenant_id claim"]:::a --> M1["signed tokens + verify on every decision (RLS)"]:::m
    G --> A2["BOLA: access B's node_id directly"]:::a --> M2["PDP object-authz + RLS backstop"]:::m
    G --> A3["cache-key collision read"]:::a --> M3["tenant-prefixed cache keys"]:::m
    G --> A4["connection-pool identity swap"]:::a --> M4["request-scoped context + server_reset_query"]:::m
    G --> A5["search index cross-tenant hit"]:::a --> M5["tenant-scoped index + filter (ADR-0009)"]:::m
    G --> A6["leaked / over-broad presigned URL"]:::a --> M6["scoped, short-TTL, exact-key URLs"]:::m
    G --> A7["read B's backup / object directly"]:::a --> M7["per-tenant keys — crypto isolation"]:::m

Every branch is independently mitigated. Defense in depth means no single control failure exposes tenant data.

6. Attack Tree: Account / Tenant Takeover

flowchart TB
    classDef g fill:#fecaca,stroke:#b91c1c,color:#111827;
    classDef a fill:#fde68a,stroke:#b45309,color:#111827;
    classDef m fill:#bbf7d0,stroke:#15803d,color:#111827;
    G["GOAL: take over an account / org admin"]:::g
    G --> A1["credential stuffing / brute force"]:::a --> M1["MFA + lockout + breach-password check"]:::m
    G --> A2["steal access / refresh token"]:::a --> M2["short TTL + rotation + reuse detection + DPoP"]:::m
    G --> A3["leaked API key (git / logs)"]:::a --> M3["hashed, scoped, rotatable + secret scanning"]:::m
    G --> A4["session fixation / XSS"]:::a --> M4["secure cookies + CSP + httpOnly + SameSite=Strict"]:::m
    G --> A5["self-elevate role"]:::a --> M5["deny-by-default authz on role change"]:::m
    G --> A6["phishing OAuth consent"]:::a --> M6["exact redirect-URI match + PKCE mandatory"]:::m

7. Risk Register

8. Keeping the Model Honest

• Continuous CI tests for top risks: the cross-tenant access test (forged tenant_id blocked by RLS), BOLA fuzzing, token-reuse detection, rate-limit tests.
• Pen testing + bug bounty on a scheduled cadence.
• Living document: revisited on every new trust boundary — new principal type, new external integration, new plugin capability.