fix(gate-7): Pattern 8 is keyed on the signature, so a SOAP endpoint is invisible to it (#413)

[rubenvdlinde]

Closes #413.

Reproduced first

Three arms in one file, varying only the selector's source:

arm	selector	gate-7
armVisible(string $id)	method parameter → ->find($id)	1 finding
armRawBody()	->dispatch(rawBody: file_get_contents('php://input'), service: 'zaken')	0 findings
armRawBodyVerified()	same, WSSE-verified delegate	0 findings

The middle arm is the defect: same delegate, same unscoped resolution, invisible. Pattern 8 decides scope by asking whether a caller-supplied scalar reaches a selection call, and every source of such a scalar it knows about is a declared parameter or a ->getParam()-family read. It has no opinion at all about a method that takes no parameters and carries its selector in the body.

The live instance is procest StufController::{zaken,personen} — #[PublicPage] + #[NoCSRFRequired], reaching a responder that dispatches zakLk01, zakLv01, npsLv01 (person query by BSN) and edcLk01 with no authentication of any kind. gate-7 reported zero findings on that app's 79 public methods. Right 77 times, wrong twice — the ratio that makes a silence persuasive.

What changes — scope only, no new clear

Pattern 8b puts a #[PublicPage] method in scope when it reads the raw request body and hands a derived value to a ->/:: call. Everything that already clears then applies unchanged (401/403 body guard, Pattern 7 ownership, Pattern 1 same-class helper, Pattern 4 resolved collaborator guard). Every fleet app that gets this right is cleared by machinery that was already here — checkSignature()/verifyWsse() by the Pattern 1/4 name rules, validateSignature() by its inline 401, and procest's repaired dispatch() by Pattern 4 reading authenticateSender()'s STATUS_UNAUTHORIZED out of the collaborator's own file.

One clear is added and it is Pattern 8's own: the scalar half already holds that "a $token/$secret is the authorisation", so a webhook signature travelling with the bytes it authenticates clears the same way. It was added because it was measured to be needed — see below.

IRequest::getContent() is added to _REQUEST_INPUT_RE, which already carried php://input. Without it Pattern 3b cleared the same method as a "zero-input READ" one branch after Pattern 8b had put it in scope. Anchored on the request receiver, so $file->getContent() is untouched.

Measured before/after — gate-7 on lib/Controller, all 18 core apps

repo	before	after	Δ
decidesk	15	15	0
docudesk	23	23	0
doriath	4	4	0
hermiq	17	17	0
larpingapp	1	1	0
launchpad	1	1	0
nldesign	0	0	0
openbuild	6	6	0
opencatalogi	14	14	0
openconnector	80	80	0
openregister	95	95	0
pipelinq	50	50	0
portaliq	1	1	0
procest	27	27	0
scholiq	4	4	0
shillinq	18	18	0
softwarecatalog	30	30	0
zaakafhandelapp	89	89	0
TOTAL	475	475	+0

The first draft, without the credential clear, produced exactly two new findings across those 18 apps, and both were false positives of one shape: pipelinq's BRP and CTI webhooks, each reading an X-…-Signature header and forwarding it to the verifier. Neither was reachable by any existing clear (the CTI one refuses on $result['valid'] === false, a bare field comparison _public_refuses_on_scope_predicate deliberately does not read), so their only remedy would have been an exempt tag. Characterised, then closed properly rather than shipped.

Residual risk, stated rather than hidden: an app that collects a signature and never verifies it clears here. That is the risk Pattern 8 already accepts for $token, and it is smaller than the raw-body blindness this closes.

Two-directional control on the real repo

procest with authenticateSender() removed — the state it shipped before ConductionNL/procest#828 — reports 27 findings without this change and 29 with it, the two extra being method=zaken and method=personen. procest as it ships today reports 27 either way: the fix does not punish the repair. Same file, same checker, one hop of difference.

Revert control — which arms are evidence

Suite re-run with the fixtures kept and the checker reverted:

• EVIDENCE — publicpage-scope/planted rawBodyDispatch(): FAIL — gate-7 failed but 'method=rawBodyDispatch rule=publicpage-unscoped-object-lookup' is not in hydra-gate-no-admin-idor.log — it failed for some OTHER reason. With the fix: PASS.
• CONTROL — publicpage-scope/clean rawBodyDispatch(): byte-identical apart from EnvelopeService::authenticateSender(). Silent before and after, so "flag every public method that reads the body" is not a passing repair.
• CONTROL — publicpage-scope/planted arbitraryId(): unchanged in both directions.

test_gate_acceptance_matrix.sh: 134 passed / 0 failed on this branch (137/0 with #414 also applied). test_check_no_admin_idor.py: 148 pass. test_gate_orphaned_capability_fixtures.sh fails identically on pristine main (missing fixture dirs) — pre-existing, not this branch.

🤖 Generated with Claude Code