fix(session-ingest): deny blocked users and stale token peppers

[eshurakov]

Summary

Session-ingest now treats user existence, blocked_reason, and token pepper as part of the auth/admission boundary.

• Cache a versioned user-auth:v1 KV record (pepper + blocked reason) with a short TTL, plus an internal invalidation route.
• Reject ordinary user tokens when the user is missing, blocked, or the pepper does not match. Legacy internal tokens without a pepper still require only that the user exists.
• Refuse CLI session creation (HTTP + Cloud Agent RPC) unless the user row exists and is unblocked, locking the user row in the same transaction as the insert.

This Worker can be deployed on its own. Callers keep their existing service bindings; blocked/missing users start getting 403 / RPC errors immediately.

Verification

• pnpm test, pnpm typecheck, and pnpm lint in services/session-ingest
• No manual production-path test of a blocked-user token or session-create denial

Visual Changes

N/A

Reviewer Notes

The packages/worker-utils change is a comment only. The RPC method signature is unchanged; createSessionForCloudAgent now throws User session creation is not allowed for blocked/missing users.

[kilo-code-bot]

Code Review Summary

Status: 1 Issue Found | Recommendation: Address before merge

Executive Summary

Incremental review of commit fe7a81e (pepper-bearing getToken + 503-on-secret-store-failure) found no new issues; the only open item remains the caller-less /internal/user-auth/invalidate route, which the author has explicitly deferred to follow-up wiring.

Overview

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	1

Issue Details (click to expand)

SUGGESTION

File	Line	Issue
services/session-ingest/src/app.ts	144	/internal/user-auth/invalidate still has no caller in the monorepo; enforcement relies on the 60s KV TTL until one lands (author acknowledged, follow-up)

Files Reviewed (4 files)

• apps/web/src/routers/active-sessions-router.ts - 0 issues (getToken now mints a 1-hour pepper-bearing user token via generateApiToken; remaining generateInternalServiceToken call sites are server-to-server and intentionally legacy-class per PR design)
• apps/web/src/routers/active-sessions-router.test.ts - 0 issues (assertions cover pepper, version, and one-hour exp/iat delta; patterns match existing repo tests)
• services/session-ingest/src/app.ts - 0 issues (secret-store failure now logged with structured console.error and surfaced as 503, matching the kilo-jwt-auth pattern; no secret material in logs or response)
• services/session-ingest/src/index.test.ts - 0 issues (503 test asserts no leakage of supplied secret or store error into body/logs, and that the cache delete is not reached)

Fix these issues in Kilo Cloud

Previous Review Summaries (3 snapshots, latest commit 7764a9a)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 7764a9a)

Status: 1 Issue Found | Recommendation: Address before merge

Executive Summary

Incremental review of commit 7764a9a (auth-path failure logging) found no new issues; the prior WARNING on silent 503s is resolved by this commit, leaving only the known caller-less /internal/user-auth/invalidate route, which the author has deferred to follow-up wiring.

Overview

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	1

Issue Details (click to expand)

SUGGESTION

File	Line	Issue
services/session-ingest/src/app.ts	138	/internal/user-auth/invalidate still has no caller in the monorepo; enforcement relies on the 60s KV TTL until one lands (author acknowledged, follow-up)

Files Reviewed (2 files)

• services/session-ingest/src/middleware/kilo-jwt-auth.ts - 0 issues (new logging resolves prior WARNING; no secrets/tokens logged, pattern matches existing cache-put warn)
• services/session-ingest/src/middleware/kilo-jwt-auth.test.ts - 0 issues (assertions cover both new log paths)

Resolved Since Last Review

• services/session-ingest/src/middleware/kilo-jwt-auth.ts - WARNING: KV/Postgres/secret-store failures now logged with structured console.error before returning 503

Fix these issues in Kilo Cloud

Previous review (commit aaccc3b)

Status: 2 Issues Found | Recommendation: Address before merge

Executive Summary

Incremental review of the share-token cutover (public /session/:shareToken + /metadata endpoints and JWT-minting share route) found no new issues; the two prior findings — unlogged auth-path infrastructure failures and a caller-less user-auth invalidation route — remain valid on current HEAD.

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	1

Issue Details (click to expand)

WARNING

File	Line	Issue
services/session-ingest/src/middleware/kilo-jwt-auth.ts	105	KV/Postgres/secret-store failures swallowed into a bare 503 with no logging, hiding outages

SUGGESTION

File	Line	Issue
services/session-ingest/src/app.ts	138	/internal/user-auth/invalidate still has no caller in the monorepo; enforcement relies on the 60s KV TTL until one lands

Files Reviewed (5 files)

• services/session-ingest/src/app.ts - 1 issue (share-token endpoints reviewed, no new issues)
• services/session-ingest/src/index.test.ts - 0 issues
• services/session-ingest/src/routes/api.ts - 0 issues (share route JWT cutover verified against web consumers)
• services/session-ingest/src/routes/api.test.ts - 0 issues
• services/session-ingest/src/middleware/kilo-jwt-auth.ts - 1 issue (carried forward, re-verified on current HEAD)

Fix these issues in Kilo Cloud

Previous review (commit 33f6496)

Status: 2 Issues Found | Recommendation: Address before merge

Executive Summary

The auth-boundary hardening is well-tested and correct, but infrastructure failures in the new auth path are swallowed into silent 503s with no logging, and the new user-auth invalidation route has no caller in the monorepo yet.

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	1

Issue Details (click to expand)

WARNING

File	Line	Issue
services/session-ingest/src/middleware/kilo-jwt-auth.ts	105	KV/Postgres/secret-store failures swallowed into a bare 503 with no logging, hiding outages

SUGGESTION

File	Line	Issue
services/session-ingest/src/app.ts	142	/internal/user-auth/invalidate has no caller in the monorepo; enforcement relies on the 60s KV TTL until one lands

Files Reviewed (13 files)

• packages/worker-utils/src/kilo-token-auth.ts - 0 issues (comment-only change)
• services/session-ingest/src/app.ts - 1 issue
• services/session-ingest/src/index.test.ts - 0 issues
• services/session-ingest/src/middleware/kilo-jwt-auth.test.ts - 0 issues
• services/session-ingest/src/middleware/kilo-jwt-auth.ts - 1 issue
• services/session-ingest/src/routes/api.test.ts - 0 issues
• services/session-ingest/src/routes/api.ts - 0 issues
• services/session-ingest/src/routes/cloud-agent-session-scope.test.ts - 0 issues
• services/session-ingest/src/routes/cloud-agent-session-scope.ts - 0 issues
• services/session-ingest/src/services/user-session-admission.test.ts - 0 issues
• services/session-ingest/src/services/user-session-admission.ts - 0 issues
• services/session-ingest/src/session-ingest-rpc.test.ts - 0 issues
• services/session-ingest/src/session-ingest-rpc.ts - 0 issues

Fix these issues in Kilo Cloud

---

_{Reviewed by kimi-k3 · Input: 91.3K · Output: 13K · Cached: 601.2K}

_{Review guidance: REVIEW.md from base branch main}