fix(daemon): fail closed when the auth hook is silent about tenant

An auth hook that ran but returned no tenantId opted the deployment into
tenant attestation; falling back to the client's own claim (RPC body
meta.tenantId, aux-route x-agent-device-tenant header) let a holder of one
valid shared token impersonate any tenant on /rpc and on the diagnostics/
upload/download routes. resolveTrustedTenant() in the new
src/daemon/server/tenant-trust.ts is now the single seam both surfaces go
through and the only place that computes the resulting identity: hook
attests -> use it; no hook configured -> keep today's client-declared
behavior (loopback/dev unchanged); hook configured but silent with a
client-declared tenant -> refuse (401) instead of trusting the claim, and
no raw client-declared metadata survives into the dispatched request in
that case either.

Fixes #2095

Author: thymikee

CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ## Unreleased
 
+- Security (daemon, remote/proxy HTTP only): when `AGENT_DEVICE_HTTP_AUTH_HOOK` is configured and a
+  request's hook result does not attest a `tenantId`, the daemon no longer falls back to trusting a
+  client-declared tenant — RPC body `meta.tenantId`, or the `x-agent-device-tenant` header on the
+  upload/artifact-download/diagnostics routes. A request that also declares a tenant is now refused
+  (401) instead of running as whichever tenant the caller claimed; a request that declares none
+  proceeds unscoped, as before. This closes a shared-token impersonation path in multi-tenant
+  deployments. Deployments with no hook configured (the local loopback CLI) are unaffected. A hook
+  that needs per-request tenant scoping must attest `tenantId` in its own return value.
 - Breaking (0.21): removed aggregate performance compatibility (`perf`, `perf sample`, `perf metrics`, the `metrics` alias, optionless `client.observability.perf()`, and SDK `area: 'metrics'`). Use `perf frames`, `perf memory sample`, `perf cpu profile start|stop|report`, or `perf trace start|stop`; removed CLI and raw daemon forms fail with this migration guidance.
 - Breaking (0.21): removed legacy batch JSON steps with `positionals`/`flags`. Use `{"command":"...","input":{...}}`; rejected steps now include a concrete structured example.
 - Breaking (0.21): removed the deprecated Node client `command.rotate` wrapper and its `RotateCommandOptions` / `RotateCommandResult` exports. Use `command.orientation`; the already-removed CLI `rotate` form keeps its targeted migration error.

src/__tests__/test-utils/env.ts

@@ -0,0 +1,4 @@
+export function restoreEnv(key: string, previous: string | undefined): void {
+  if (previous === undefined) delete process.env[key];
+  else process.env[key] = previous;
+}

src/daemon/__tests__/http-server-tenant-trust.test.ts

@@ -0,0 +1,339 @@
+import { test } from 'vitest';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { createDaemonHttpServer } from '../server/http-server.ts';
+import { resolveSessionRequestLogPath } from '../session-store.ts';
+import { safeSessionName } from '../session-paths.ts';
+import { DAEMON_HTTP_TENANT_HEADER } from '../http-contract.ts';
+import type { DaemonRequest, DaemonResponse } from '../types.ts';
+import {
+  closeLoopbackServer,
+  listenOnLoopback,
+  skipWhenLoopbackUnavailable,
+} from '../../__tests__/test-utils/loopback.ts';
+import { mkdtempForTestSync } from '../../__tests__/test-utils/tmp-dir.ts';
+import { restoreEnv } from '../../__tests__/test-utils/env.ts';
+
+const DAEMON_TOKEN = 'daemon-secret';
+const DIAGNOSTICS_RECORD = '{"phase":"request_start"}\n{"phase":"request_failed"}\n';
+
+function writeSilentAuthHook(root: string): string {
+  const hookPath = path.join(root, 'silent-auth-hook.mjs');
+  fs.writeFileSync(hookPath, 'export default function authHook() { return { ok: true }; }\n');
+  return hookPath;
+}
+
+const ATTESTED_TENANT_ID = 'tenant-real';
+
+function writeAttestingAuthHook(root: string): string {
+  const hookPath = path.join(root, 'attesting-auth-hook.mjs');
+  fs.writeFileSync(
+    hookPath,
+    "export default function authHook() { return { tenantId: 'tenant-real' }; }\n",
+  );
+  return hookPath;
+}
+
+async function withRpcServer(
+  hookPath: string | undefined,
+  run: (ctx: { baseUrl: string; observedRequests: DaemonRequest[] }) => Promise<void>,
+): Promise<void> {
+  const previousHook = process.env.AGENT_DEVICE_HTTP_AUTH_HOOK;
+  if (hookPath) process.env.AGENT_DEVICE_HTTP_AUTH_HOOK = hookPath;
+  else delete process.env.AGENT_DEVICE_HTTP_AUTH_HOOK;
+
+  const observedRequests: DaemonRequest[] = [];
+  const server = await createDaemonHttpServer({
+    token: DAEMON_TOKEN,
+    handleRequest: async (req): Promise<DaemonResponse> => {
+      observedRequests.push(req);
+      return { ok: true, data: { meta: req.meta } };
+    },
+  });
+  try {
+    const port = await listenOnLoopback(server);
+    await run({ baseUrl: `http://127.0.0.1:${port}`, observedRequests });
+  } finally {
+    await closeLoopbackServer(server);
+    restoreEnv('AGENT_DEVICE_HTTP_AUTH_HOOK', previousHook);
+  }
+}
+
+async function callRpc(
+  baseUrl: string,
+  payload: Record<string, unknown>,
+): Promise<{ status: number; body: Record<string, any> }> {
+  const response = await fetch(`${baseUrl}/rpc`, {
+    method: 'POST',
+    headers: {
+      authorization: `Bearer ${DAEMON_TOKEN}`,
+      'content-type': 'application/json',
+    },
+    body: JSON.stringify(payload),
+  });
+  return { status: response.status, body: (await response.json()) as Record<string, any> };
+}
+
+async function withDiagnosticsHookServer(
+  hookPath: string | undefined,
+  run: (ctx: { baseUrl: string; sessionsDir: string }) => Promise<void>,
+): Promise<void> {
+  const previousHook = process.env.AGENT_DEVICE_HTTP_AUTH_HOOK;
+  if (hookPath) process.env.AGENT_DEVICE_HTTP_AUTH_HOOK = hookPath;
+  else delete process.env.AGENT_DEVICE_HTTP_AUTH_HOOK;
+
+  const stateDir = mkdtempForTestSync('agent-device-tenant-trust-diagnostics-');
+  const sessionsDir = path.join(stateDir, 'sessions');
+  const server = await createDaemonHttpServer({
+    token: DAEMON_TOKEN,
+    handleRequest: async (): Promise<DaemonResponse> => ({ ok: true, data: {} }),
+    resolveRequestDiagnosticsPath: (ref) =>
+      resolveSessionRequestLogPath(
+        path.join(sessionsDir, safeSessionName(ref.session)),
+        ref.requestId,
+      ),
+  });
+  try {
+    const port = await listenOnLoopback(server);
+    await run({ baseUrl: `http://127.0.0.1:${port}`, sessionsDir });
+  } finally {
+    await closeLoopbackServer(server);
+    restoreEnv('AGENT_DEVICE_HTTP_AUTH_HOOK', previousHook);
+    fs.rmSync(stateDir, { recursive: true, force: true });
+  }
+}
+
+function writeDiagnosticsRecord(sessionsDir: string, session: string, requestId: string): void {
+  const recordPath = resolveSessionRequestLogPath(
+    path.join(sessionsDir, safeSessionName(session)),
+    requestId,
+  );
+  fs.mkdirSync(path.dirname(recordPath), { recursive: true });
+  fs.writeFileSync(recordPath, DIAGNOSTICS_RECORD);
+}
+
+function diagnosticsUrl(baseUrl: string, session: string, requestId: string): string {
+  return `${baseUrl}/sessions/${encodeURIComponent(session)}/requests/${encodeURIComponent(requestId)}/diagnostics`;
+}
+
+test('RPC: a hook configured but silent on tenant refuses a client-declared meta.tenantId', async (t) => {
+  if (await skipWhenLoopbackUnavailable(t)) return;
+  const root = mkdtempForTestSync('agent-device-tenant-trust-rpc-');
+  try {
+    const hookPath = writeSilentAuthHook(root);
+    await withRpcServer(hookPath, async ({ baseUrl, observedRequests }) => {
+      const response = await callRpc(baseUrl, {
+        jsonrpc: '2.0',
+        id: 'rpc-impersonate',
+        method: 'agent_device.command',
+        params: {
+          command: 'session_list',
+          positionals: [],
+          meta: { tenantId: 'victim' },
+        },
+      });
+      assert.equal(response.status, 401);
+      assert.equal(response.body.error?.code, -32001);
+      assert.equal(
+        observedRequests.length,
+        0,
+        'the handler must never see the impersonated request',
+      );
+    });
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('RPC: a hook configured but silent on tenant refuses a client-declared lease tenantId', async (t) => {
+  if (await skipWhenLoopbackUnavailable(t)) return;
+  const root = mkdtempForTestSync('agent-device-tenant-trust-rpc-lease-');
+  try {
+    const hookPath = writeSilentAuthHook(root);
+    await withRpcServer(hookPath, async ({ baseUrl, observedRequests }) => {
+      const response = await callRpc(baseUrl, {
+        jsonrpc: '2.0',
+        id: 'rpc-impersonate-lease',
+        method: 'agent_device.lease.allocate',
+        params: {
+          tenantId: 'victim',
+          runId: 'run-1',
+          ttlMs: 60000,
+          backend: 'android-instance',
+        },
+      });
+      assert.equal(response.status, 401);
+      assert.equal(response.body.error?.code, -32001);
+      assert.equal(
+        observedRequests.length,
+        0,
+        'the handler must never see the impersonated request',
+      );
+    });
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('RPC: a hook that attests a tenant wins over a mismatched client-declared meta.tenantId', async (t) => {
+  if (await skipWhenLoopbackUnavailable(t)) return;
+  const root = mkdtempForTestSync('agent-device-tenant-trust-rpc-attest-');
+  try {
+    const hookPath = writeAttestingAuthHook(root);
+    await withRpcServer(hookPath, async ({ baseUrl, observedRequests }) => {
+      const response = await callRpc(baseUrl, {
+        jsonrpc: '2.0',
+        id: 'rpc-attested',
+        method: 'agent_device.command',
+        params: {
+          command: 'session_list',
+          positionals: [],
+          meta: { tenantId: 'victim' },
+        },
+      });
+      assert.equal(response.status, 200);
+      assert.equal(observedRequests[0]?.meta?.tenantId, ATTESTED_TENANT_ID);
+    });
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('RPC: no hook configured keeps a client-declared meta.tenantId unchanged (regression)', async (t) => {
+  if (await skipWhenLoopbackUnavailable(t)) return;
+  await withRpcServer(undefined, async ({ baseUrl, observedRequests }) => {
+    const response = await callRpc(baseUrl, {
+      jsonrpc: '2.0',
+      id: 'rpc-loopback',
+      method: 'agent_device.command',
+      params: {
+        command: 'session_list',
+        positionals: [],
+        meta: { tenantId: 'tenant-x' },
+      },
+    });
+    assert.equal(response.status, 200);
+    assert.equal(observedRequests[0]?.meta?.tenantId, 'tenant-x');
+  });
+});
+
+test('aux route: a hook configured but silent on tenant refuses a client-declared header claiming another tenant', async (t) => {
+  if (await skipWhenLoopbackUnavailable(t)) return;
+  const root = mkdtempForTestSync('agent-device-tenant-trust-aux-');
+  try {
+    const hookPath = writeSilentAuthHook(root);
+    await withDiagnosticsHookServer(hookPath, async ({ baseUrl, sessionsDir }) => {
+      writeDiagnosticsRecord(sessionsDir, 'victim-tenant:default', 'abc123');
+      const response = await fetch(diagnosticsUrl(baseUrl, 'victim-tenant:default', 'abc123'), {
+        headers: {
+          authorization: `Bearer ${DAEMON_TOKEN}`,
+          [DAEMON_HTTP_TENANT_HEADER]: 'victim-tenant',
+        },
+      });
+      assert.equal(response.status, 401);
+      assert.equal((await response.text()).includes('request_start'), false);
+    });
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('aux route: a hook that attests a tenant wins over a mismatched client-declared header', async (t) => {
+  if (await skipWhenLoopbackUnavailable(t)) return;
+  const root = mkdtempForTestSync('agent-device-tenant-trust-aux-attest-');
+  try {
+    const hookPath = writeAttestingAuthHook(root);
+    await withDiagnosticsHookServer(hookPath, async ({ baseUrl, sessionsDir }) => {
+      writeDiagnosticsRecord(sessionsDir, `${ATTESTED_TENANT_ID}:default`, 'abc123');
+      const owner = await fetch(
+        diagnosticsUrl(baseUrl, `${ATTESTED_TENANT_ID}:default`, 'abc123'),
+        {
+          headers: {
+            authorization: `Bearer ${DAEMON_TOKEN}`,
+            [DAEMON_HTTP_TENANT_HEADER]: 'victim-tenant',
+          },
+        },
+      );
+      assert.equal(owner.status, 200);
+      assert.equal(await owner.text(), DIAGNOSTICS_RECORD);
+    });
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('aux route: no hook configured keeps the header-declared tenant unchanged (regression)', async (t) => {
+  if (await skipWhenLoopbackUnavailable(t)) return;
+  await withDiagnosticsHookServer(undefined, async ({ baseUrl, sessionsDir }) => {
+    writeDiagnosticsRecord(sessionsDir, 'tenant-a:default', 'abc123');
+    const owner = await fetch(diagnosticsUrl(baseUrl, 'tenant-a:default', 'abc123'), {
+      headers: {
+        authorization: `Bearer ${DAEMON_TOKEN}`,
+        [DAEMON_HTTP_TENANT_HEADER]: 'tenant-a',
+      },
+    });
+    assert.equal(owner.status, 200);
+    const otherTenant = await fetch(diagnosticsUrl(baseUrl, 'tenant-a:default', 'abc123'), {
+      headers: {
+        authorization: `Bearer ${DAEMON_TOKEN}`,
+        [DAEMON_HTTP_TENANT_HEADER]: 'tenant-b',
+      },
+    });
+    assert.equal(otherTenant.status, 401);
+  });
+});
+
+test('aux route (upload): a hook configured but silent on tenant refuses a client-declared header', async (t) => {
+  if (await skipWhenLoopbackUnavailable(t)) return;
+  const root = mkdtempForTestSync('agent-device-tenant-trust-upload-');
+  const previousHook = process.env.AGENT_DEVICE_HTTP_AUTH_HOOK;
+  process.env.AGENT_DEVICE_HTTP_AUTH_HOOK = writeSilentAuthHook(root);
+  const server = await createDaemonHttpServer({
+    token: DAEMON_TOKEN,
+    handleRequest: async (): Promise<DaemonResponse> => ({ ok: true, data: {} }),
+  });
+  try {
+    const port = await listenOnLoopback(server);
+    const response = await fetch(`http://127.0.0.1:${port}/upload`, {
+      method: 'POST',
+      headers: {
+        authorization: `Bearer ${DAEMON_TOKEN}`,
+        [DAEMON_HTTP_TENANT_HEADER]: 'victim-tenant',
+        'x-artifact-type': 'file',
+        'x-artifact-filename': 'demo.apk',
+        'content-type': 'application/octet-stream',
+      },
+      body: Buffer.from('fake-apk'),
+    });
+    assert.equal(response.status, 401);
+  } finally {
+    await closeLoopbackServer(server);
+    restoreEnv('AGENT_DEVICE_HTTP_AUTH_HOOK', previousHook);
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('RPC: a whitespace-only meta.tenantId is admitted untenanted, not forwarded raw, under a silent hook', async (t) => {
+  if (await skipWhenLoopbackUnavailable(t)) return;
+  const root = mkdtempForTestSync('agent-device-tenant-trust-rpc-blank-');
+  try {
+    const hookPath = writeSilentAuthHook(root);
+    await withRpcServer(hookPath, async ({ baseUrl, observedRequests }) => {
+      const response = await callRpc(baseUrl, {
+        jsonrpc: '2.0',
+        id: 'rpc-blank-tenant',
+        method: 'agent_device.command',
+        params: {
+          command: 'session_list',
+          positionals: [],
+          meta: { tenantId: '   ' },
+        },
+      });
+      assert.equal(response.status, 200);
+      assert.equal(observedRequests[0]?.meta?.tenantId, undefined);
+    });
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});