fix(terminal): org-token A2A routing regression — skip ValidateToken when org_token_id already set - #2025
Conversation
…ing (KI-005 followup) PR #1885 introduced a regression: HandleConnect called wsauth.ValidateToken for any bearer token when X-Workspace-ID ≠ workspaceID. Org-scoped tokens (org_api_tokens table) are not in workspace_auth_tokens, so ValidateToken always returned ErrInvalidToken for them → hard 401 for all A2A routing that uses org tokens. Fix: if WorkspaceAuth already validated an org token (org_token_id set in gin context by orgtoken.Validate), skip the workspace_auth_tokens lookup and trust the X-Workspace-ID claim. Hierarchy enforcement via canCommunicateCheck is unchanged — org token holders are still subject to the workspace hierarchy. Workspace-scoped tokens continue to require ValidateToken binding. Invalid tokens (neither workspace-bound nor org-level) still return 401. This closes the regression while preserving the KI-005 security property. Add TestKI005_OrgToken_SkipsValidateToken to terminal_test.go as a regression guard for this exact path. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
![molecule-ai[bot]](https://avatars.githubusercontent.com/u/275794187?s=60&v=4){kind=small}
There was a problem hiding this comment.
QA + Security Review ✅
PR #2025 — org-token A2A routing fix (KI-005 follow-up)
Reviewed diff vs base. Three-part fix is clean:
-
**terminal.go **: When is already set in context (org-scoped API token from canvas UI), the handler now skips the downstream call entirely. This fixes the regression where an org-token presenter was being rejected by the narrower per-workspace token check in the A2A pipeline.
-
Conditional vs. hard-fail: The fix uses an explicit guard — so a present-but-empty org_token_id does NOT bypass the token check. Correct.
-
**New test **: Provides coverage for the org-token path specifically. This supplements the existing suite without modifying it.
Security posture: org-scoped API tokens are bounded to a single org (explicit product spec per wsauth_middleware.go line 58). The fix preserves this boundary — still runs for all callers. No new attack surface.
CI: ✅ Checks passed (main branch green baseline confirmed).
Recommendation: Merge. This is a targeted regression fix for a recent change; no concerns.
There was a problem hiding this comment.
QA + Security Review
PR #2025 — org-token A2A routing fix (KI-005 follow-up)
Reviewed diff vs base. Fix targets HandleConnect in terminal.go:
- When
org_token_idis already set in context (org-scoped API token from canvas UI), the handler skips the downstreamValidateTokencall. This fixes the regression where an org-token presenter was being rejected by the narrower per-workspace token check in the A2A pipeline. - The fix uses an explicit
c.GetString("org_token_id") == ""guard — so a present-but-empty org_token_id does NOT bypass the token check. Correct. - New test
TestKI005_OrgToken_SkipsValidateTokenprovides coverage for the org-token path specifically.
Security: org-scoped API tokens remain bounded to a single org. CanCommunicate still runs for all callers. No new attack surface.
CI: green. Recommendation: Merge.
…T — codex→openai-subscription byok' (#2025) from fix/providers-ssot-sync-codex-subscription into main
Problem
PR #1885 introduced a regression in
HandleConnect: whenX-Workspace-ID ≠ workspaceID, any bearer token is validated withwsauth.ValidateTokenagainstworkspace_auth_tokens. Org-scoped tokens (org_api_tokenstable) are not in that table, soValidateTokenalways returnsErrInvalidToken— hard 401 for all A2A routing that uses org tokens.Fix
If
WorkspaceAuthalready validated an org token (setsorg_token_idin gin context viaorgtoken.Validate), skip the workspace-bound token check and trust theX-Workspace-IDclaim. Hierarchy enforcement viacanCommunicateCheckis unchanged.Test
Added
TestKI005_OrgToken_SkipsValidateTokeninterminal_test.goas a regression guard. Platform (Go) CI passes locally.Fixes regression introduced in #1885. Followup to KI-005 security hardening.