fix(integration): require signed event workspace authority

[seonghobae]

Security outcome

Remove the Integration event-preparation endpoint's trust in a browser-selectable x-workspace-id. POST /v1/events/prepare now derives the workspace only from the short-lived signed life-os.workspace.v1 context before the plugin SDK can stamp tenant authority into a prepared CloudEvent.

Test-first sequence

The first commit changes the real NestJS integration test to send signed workspace evidence and requires missing, forged, or unavailable verifier context to fail closed. That contract is RED on protected main because the old controller reads only x-workspace-id.

A source-level regression also forbids reintroducing the legacy header and pins the reviewed signed-header/secret boundary.

Implementation

• verifies UUIDv4 workspace identity, canonical Unix seconds, a 43-character base64url SHA-256 HMAC, a minimum 32-byte verifier secret, 60-second maximum age, 5-second future skew, and equal-length constant-time digest comparison;
• accepts only x-life-os-workspace-id, x-life-os-context-issued-at, and x-life-os-context-signature for event preparation;
• uses INTEGRATION_GATEWAY_CONTEXT_SECRET only as verifier material and returns bounded credential-free 401/503 problems for invalid/unavailable context;
• leaves manifest validation, plugin SDK canonicalization, event-size/schema checks, and the active feat(plugin): persist tenant-scoped installation authority [superseded by #169] #156 installation-persistence files untouched.

Scope

This hardens the existing event-preparation surface but does not grant plugin installation, secret storage, outbound delivery, inbound commands, or direct database authority. It remains compatible with #130/#156 as a disjoint tenant-authority correction.

Verification

Merge only after the unchanged exact head passes integration-service tests/typecheck/build, repository CI, AppGuardrail, SAST Semgrep, Security Scan, Commercial Readiness, current review findings, and current-live-base compatibility without administrative bypass.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 18 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f51db23d-fa5f-4d6f-94c9-09abc24ea7fa

📥 Commits

Reviewing files that changed from the base of the PR and between c88016e and 71f88c3.

📒 Files selected for processing (3)

• apps/integration-service/src/integration-controller-authority.test.ts
• apps/integration-service/src/main.ts
• apps/integration-service/src/plugin-contract.integration.test.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}