fix(api): let source-auth callers read runs under portal enforcement - #332
Open
xianjixiance wants to merge 2 commits into
Open
fix(api): let source-auth callers read runs under portal enforcement#332xianjixiance wants to merge 2 commits into
xianjixiance wants to merge 2 commits into
Conversation
GET /v1/runs/:id and GET /v1/runs are declared auth: "source" in the turns route table, but they were also listed in USER_SCOPED. In production requireSignedPortalIdentity is on, so the gate in server.ts demanded a portal identity from callers that only hold the source-auth signing secret, and a correctly signed surface request got 401. The two routes carry no user-scoped field, so the entry only ever added the portal requirement — it never bound a caller-named actor to the request. Drop them from USER_SCOPED so the route table is the single source of truth for how they authenticate. They stay fail closed: without a capability token the request must still pass source-auth verification, which runs before the portal gate. POST /v1/runs/:id/signal is a write and keeps its existing classification.
…ource-auth fixture createServer refuses to boot with portal identity enforcement on unless CAPABILITY_SECRET, PORTAL_IDENTITY_SECRET and CORE_SIGNING_SECRET are three distinct values, so the fixture cancelled during before(). Pass the same core-only capability secret the other enforcement fixtures use. The suite's security assertions are unchanged: the wrong-secret and unsigned cases still expect 401, and the user-scoped route still demands a portal identity.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The run read routes declare source authentication, but they were also classified as user-scoped. When signed portal identity enforcement is enabled, a correctly source-signed caller without a portal identity is rejected before the run handler executes.
These read routes do not carry a caller-provided actor field, so the user-scoped classification adds a second authentication requirement without binding the request to a user.
Change
GET /v1/runs/:idandGET /v1/runsfrom the user-scoped route table.The write route
POST /v1/runs/:id/signalkeeps its existing classification.Security
The read routes remain fail-closed. A request without a capability token still has to pass source-auth verification before it reaches the portal identity gate. The regression also provisions distinct source, capability, and portal identity secrets to exercise the production isolation contract.
Verification
node --test test/run-query-source-auth.test.ts— 7 passed, 0 failednpm run typechecknpm run lintnpm run lint:oxgit diff --checkNeed help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.