# Threat Model — Majoor Assets Manager

**Version**: 2.4.9
**Date**: April 5, 2026 (Updated from 2026-01-24)

## Scope
This model covers the Majoor Assets Manager backend routes under `/mjr/am/*` and the associated local filesystem/database operations.

**Recent highlights**: Enhanced API token authentication, improved CSRF protection, and better rate limiting for remote access scenarios.

## Assets to Protect
- User files on disk (input/output/custom roots).
- SQLite index database and collections JSON files.
- ComfyUI server availability (avoid crashes / runaway CPU / locks).
- Privacy of metadata (prompts/workflows embedded in images/videos).

## Trust Boundaries
- **Browser/UI** → **ComfyUI HTTP server**: untrusted inputs via query params and JSON bodies.
- **Extension backend** → **Filesystem**: path traversal and symlink/junction concerns.
- **Extension backend** → **External tools** (`exiftool`, `ffprobe`): command execution and parsing.
- **Extension backend** → **SQLite**: injection/locking/corruption risks.

## Threats & Mitigations

### 1) Path Traversal / Unauthorized File Access
**Threat:** An attacker (or malicious workflow) calls `/mjr/am/*` with paths pointing outside allowed roots.

**Mitigations:**
- Normalize paths and reject invalid/unsafe paths (`_safe_rel_path`, `_is_within_root`, allow-lists).
- Exception: `/mjr/am/open-in-folder` may reveal any existing local path in the OS file manager when the action is enabled. It does not provide file content reads, writes, deletes, downloads, or indexing access.
- Custom roots are resolved and validated (root-id → canonical directory).
- Avoid exposing arbitrary “open file” primitives; use explicit allow-listed actions.

### 2) Symlink/Junction Escape (TOCTOU)
**Threat:** A path initially validated as within root later resolves to a different location (symlink swap).

**Mitigations:**
- Resolve roots/targets with `resolve(strict=True)` where possible.
- Validate after resolution and before use.
- Treat mid-scan disappearance as a benign failure and continue (best-effort).

### 3) CSRF / Cross-Site Requests
**Threat:** A local web page triggers state-changing endpoints (delete/rename/stage) against `localhost`.

**Mitigations:**
- CSRF checks on state-changing routes.
- Prefer returning `Result.Err("CSRF", ...)` instead of throwing.

### 4) Denial of Service (Large Listings / Heavy Scans)
**Threat:** Repeated list/index requests cause CPU/disk thrash.

**Mitigations:**
- Bounded queues for background work (scan pending max).
- Rate limiting for expensive endpoints.
- TTL-based filesystem listing cache with bounded size.

### 5) External Tool Execution Risks
**Threat:** Tool invocation on untrusted media can be slow or crash; tool may be missing.

**Mitigations:**
- Timeouts and best-effort fallbacks (`code="DEGRADED"`).
- Never crash UI: return `Result.Err/Ok` with degraded metadata.
- Avoid shell string interpolation; prefer argv lists.

### 6) Data Corruption / Concurrent Writes
**Threat:** Concurrent updates corrupt JSON stores or SQLite schema state.

**Mitigations:**
- Atomic writes for JSON stores (write tmp + replace).
- SQLite locking strategy and bounded transactions.

## Residual Risk
- Localhost endpoints are inherently accessible to local malware.
- Media parsing remains a complex attack surface (mitigated by timeouts and least-privilege execution).

## Non-Goals
- Remote multi-user authentication/authorization (ComfyUI is typically local-only).
- Protecting against a fully compromised host OS.