fix(server): use peer identity for recovery

Author: root

src/agentnet/cli.py

@@ -25,7 +25,7 @@
 from contextlib import contextmanager
 from datetime import UTC, datetime, timedelta
 from pathlib import Path
-from urllib.parse import urlencode, urlsplit
+from urllib.parse import unquote, urlencode, urlsplit
 from typing import Any
 from uuid import NAMESPACE_URL, UUID, uuid4, uuid5
 
@@ -1034,19 +1034,43 @@ def _open_server_agent_activation_store(
         config.data_dir / "secrets" / "records.key",
         create=False,
     )
-    return PostgreSQLStore(
-        database_url_override or config.resolved_database_url(),
-        cipher,
-        instance_id=config.runtime_instance_id,
-        lease_owner_id=f"activation-{uuid4().hex}",
-        connect_timeout=config.postgres_connect_timeout_seconds,
-        statement_timeout_ms=config.postgres_statement_timeout_ms,
-        lock_timeout_ms=config.postgres_lock_timeout_ms,
-        lease_ttl_seconds=config.postgres_lease_ttl_seconds,
-        run_migrations=False,
-        start_lease_keeper=False,
-        require_recovery_topology=config.postgres_recovery_topology,
-    )
+    database_url = database_url_override or config.resolved_database_url()
+
+    def open_store() -> PostgreSQLStore:
+        return PostgreSQLStore(
+            database_url,
+            cipher,
+            instance_id=config.runtime_instance_id,
+            lease_owner_id=f"activation-{uuid4().hex}",
+            connect_timeout=config.postgres_connect_timeout_seconds,
+            statement_timeout_ms=config.postgres_statement_timeout_ms,
+            lock_timeout_ms=config.postgres_lock_timeout_ms,
+            lease_ttl_seconds=config.postgres_lease_ttl_seconds,
+            run_migrations=False,
+            start_lease_keeper=False,
+            require_recovery_topology=config.postgres_recovery_topology,
+        )
+
+    parsed = urlsplit(database_url)
+    if (
+        os.geteuid() == 0
+        and parsed.username == CORE_USER
+        and parsed.password is None
+        and unquote(parsed.hostname or "").startswith("/")
+    ):
+        import pwd as posix_pwd
+
+        account = posix_pwd.getpwnam(CORE_USER)
+        original_uid = os.geteuid()
+        original_gid = os.getegid()
+        try:
+            os.setegid(account.pw_gid)
+            os.seteuid(account.pw_uid)
+            return open_store()
+        finally:
+            os.seteuid(original_uid)
+            os.setegid(original_gid)
+    return open_store()
 
 
 def _require_server_agent_activation_binding(

tests/cli/test_server_agent_activation.py

@@ -413,6 +413,7 @@ def fake_postgres(database_url, passed_cipher, **kwargs):
     )
     assert reauthorization.func is cli.command_server_agent_reauthorize_expired_credential
     assert reauthorization.replace_terminal_state is False
+
     defaults = parser.parse_args(["server-agent", "reauthorize-expired-credential"])
     assert defaults.config == str(cli.CORE_CONFIG)
     assert defaults.identity == str(cli.SERVER_AGENT_IDENTITY)
@@ -729,6 +730,62 @@ def replace_journal(path: Path, *, expected, replacement, uid, gid):
 
 
 
+def test_root_activation_store_connects_to_exact_peer_socket_as_core_user(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    import pwd
+
+    state = activation_fixture(tmp_path)
+    peer_url = "postgresql://agentnet@%2Fvar%2Frun%2Fpostgresql/agentnet"
+    ids = {"uid": 0, "gid": 0}
+    transitions: list[tuple[str, int]] = []
+    fake_store = FakeStore()
+    monkeypatch.setattr(
+        cli.LocalEnvelopeCipher,
+        "from_key_file",
+        lambda _path, *, create: object(),
+    )
+    monkeypatch.setattr(cli.os, "geteuid", lambda: ids["uid"])
+    monkeypatch.setattr(cli.os, "getegid", lambda: ids["gid"])
+    monkeypatch.setattr(
+        cli.os,
+        "seteuid",
+        lambda value: transitions.append(("uid", value)) or ids.update(uid=value),
+    )
+    monkeypatch.setattr(
+        cli.os,
+        "setegid",
+        lambda value: transitions.append(("gid", value)) or ids.update(gid=value),
+    )
+    monkeypatch.setattr(
+        pwd,
+        "getpwnam",
+        lambda name: SimpleNamespace(pw_uid=123, pw_gid=456)
+        if name == cli.CORE_USER
+        else pytest.fail("unexpected account"),
+    )
+
+    def fake_postgres(database_url, _cipher, **_kwargs):
+        assert database_url == peer_url
+        assert ids == {"uid": 123, "gid": 456}
+        return fake_store
+
+    monkeypatch.setattr(cli, "PostgreSQLStore", fake_postgres)
+
+    assert cli._open_server_agent_activation_store(
+        state.config,
+        database_url_override=peer_url,
+    ) is fake_store
+    assert ids == {"uid": 0, "gid": 0}
+    assert transitions == [
+        ("gid", 456),
+        ("uid", 123),
+        ("uid", 0),
+        ("gid", 0),
+    ]
+
+
 def test_managed_scope_replacement_is_resumable_and_waits_before_commit(
     tmp_path: Path,
     monkeypatch: pytest.MonkeyPatch,