fix(ui/security): close P2 vulnerabilities — JWT fail-closed, path redaction, identity hardening

[POWERFULMOVES]

Summary

• Fix isBootJwtExpired fail-open: JWTs without exp claim now treated as expired (fail-closed security posture)
• Redact filesystem paths: /api/audit/summary now returns only filenames via path.basename() instead of full absolute paths
• Remove x-owner-id fallback: /api/health/ingest-smoke identity comes from boot user only, never from request headers

P2 Findings Addressed

#	Finding	File
8	isBootJwtExpired returns false for no-exp JWT	lib/supabaseClient.ts
9	/api/audit/summary returns absolute filesystem paths	app/api/audit/summary/route.ts
10	/api/health/ingest-smoke accepts x-owner-id header	app/api/health/ingest-smoke/route.ts

Test plan

• npm run typecheck passes (confirmed)
• Boot JWT without exp claim is now treated as expired
• /api/audit/summary response contains only filenames, not paths
• /api/health/ingest-smoke ignores x-owner-id header

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Warning

Rate limit exceeded

@POWERFULMOVES has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 1 minutes and 1 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 263778c3-9555-407e-a111-4455ab9e821d

📥 Commits

Reviewing files that changed from the base of the PR and between 051cfef and 90908e0.

📒 Files selected for processing (3)

• pmoves/ui/app/api/audit/summary/route.ts
• pmoves/ui/app/api/health/ingest-smoke/route.ts
• pmoves/ui/lib/supabaseClient.ts

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix/ui-security-p2-v2

📝 Coding Plan

• Generate coding plan for human review comments

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Tip

CodeRabbit can approve the review once all CodeRabbit's comments are resolved.

Enable the reviews.request_changes_workflow setting to automatically approve the review once all CodeRabbit's comments are resolved.