feat(gastown): add gated Gastown and Wasteland token issuance by pandemicsyn · Pull Request #6141 · Kilo-Org/cloud

pandemicsyn · 2026-09-14T15:28:01Z

Summary

Add gated Gastown control/runtime credentials and Wasteland browser/server control credentials and current account, pepper, ownership, and organization checks. Matching explicit null peppers remain valid without initialization. Legacy renewal preserves the town owner and checks concurrent authorization changes before publishing a replacement token.

Wasteland token issuance and server-side upstream resolution use the same source-authority checks. DoltHub token acquisition continues to use its internal secret and OAuth credentials, not the Wasteland control token.

Extracted from #5976, which originated in the token-issuance implementation in #5857.

Verification

No manual application or live CLI/container smoke tests were run. This extraction was verified with automated suites and source comparison; deployed runtime verification remains required before activation.

Visual Changes

N/A

Reviewer Notes

Feature toggle	Default	Where to configure
`GASTOWN_RESOURCE_TOKENS_ENABLED`	Off: unset or `false`	Web application environment variables in Vercel; redeploy Web after changes
`WASTELAND_RESOURCE_TOKENS_ENABLED`	Off: unset or `false`	Web application environment variables in Vercel; redeploy Web after changes
`SHARED_RESOURCE_TOKENS_ENABLED`	Already enabled in Vercel; code default is off	Web application environment variables in Vercel; redeploy Web after changes

Each family requires its own Web flag and SHARED_RESOURCE_TOKENS_ENABLED to be exactly true. Leave GASTOWN_RESOURCE_TOKENS_ENABLED off: Gastown is EOL, no activation is required, and the blockers below remain. Keep WASTELAND_RESOURCE_TOKENS_ENABLED off until its browser/server consumer chain is verified. Preserve the existing master setting for other families. This PR requires no Gastown Cloudflare Worker toggle.

Current-account and membership checks apply to legacy requests on deployment. No legacy expiration cutoff is added. Existing modern authority cannot downgrade to legacy during rollback.
Modern activation remains blocked by missing Session Ingest coverage, organization-bound control minting, and safe credential renewal in running CLI processes.
Automated validation: 549 full-suite unit tests, a subsequent 47-test runtime-authorization run, 20 real Durable Object identity/renewal tests, and 23 focused Web tests passed; service/Web typechecks and scoped lint passed. The CI sales-demo timeout did not reproduce locally (1.17s with its original 5s timeout). The broader integration suite previously reproduced the same 52 failures and 12 errors on main and is not claimed green.

Wasteland source-authority checks apply even with its issuance flag off; previously issued modern device credentials can receive bounded control credentials during rollback. Wasteland readers do not provide universal immediate pepper revocation. These are not changed into broader recovery guarantees by this extraction.

Wasteland extraction validation: 45 focused Web/authority tests and 126 Wasteland service tests passed, plus full Web typecheck, Web lint, changed-file formatting, and diff checks. Existing Gastown implementation remains unchanged; the two Wasteland source files are preserved exactly from #5976, with added adapter regression tests.

After merging current main and resolving the Town renewal conflict: 130 focused Gastown unit tests and 20 Durable Object identity/renewal tests passed, plus Gastown typecheck, lint, formatting, and diff checks. Guarded renewal and the Wasteland extraction are preserved.

kilo-code-bot · 2026-09-14T16:05:58Z

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

The incremental Wasteland control-token consolidation onto the shared delegated-issuance helper, plus the merge of main, introduces no new issues in the changed code.

Files Reviewed (3 files)

apps/web/src/app/api/wasteland/token/route.ts
apps/web/src/lib/wasteland/server-resolve.ts
apps/web/src/lib/wasteland/token-issuance.test.ts

Previous Review Summaries (2 snapshots, latest commit 4ed383e)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit `4ed383e`)

Status: No Issues Found | Recommendation: Merge

Executive Summary

The incremental commits resolve the prior authorization findings for the gated Gastown token-issuance paths and introduce no new issues in the changed code.

Files Reviewed (10 files)

apps/web/src/lib/auth/resource-delegation.test.ts
apps/web/src/lib/auth/resource-delegation.ts
services/gastown/src/dos/town/runtime-authorization.test.ts
services/gastown/src/dos/town/runtime-authorization.ts
services/gastown/src/handlers/town-runtime-authorization.handler.test.ts
services/gastown/src/handlers/towns.handler.test.ts
services/gastown/src/handlers/towns.handler.ts
services/gastown/src/util/town-authorization.util.test.ts
services/gastown/src/util/town-authorization.util.ts
services/gastown/test/integration/town-private-identity.test.ts

Previous review (commit `72f248b`)

Status: 5 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	1
WARNING	3
SUGGESTION	1

Issue Details (click to expand)

CRITICAL

File	Line	Issue
`services/gastown/src/handlers/towns.handler.ts`	62	New `:userId` ownership guards have no admin bypass, so admin town/rig inspection (`/api/users/:userId/towns`, `/towns/:townId/rigs`) now returns 403

WARNING

File	Line	Issue
`services/gastown/src/util/town-authorization.util.ts`	139	`authorizeTown` returns `admin` before the ownership check, so a platform admin who owns a personal modern town is treated as a non-owner and blocked from delete/config/rigs/refresh
`services/gastown/src/handlers/town-runtime-authorization.handler.ts`	32	Org owner who is also a platform admin resolves to `admin` and is rejected by the `type !== 'org'` check, so they cannot reauthorize the runtime
`apps/web/src/app/api/gastown/token/route.ts`	40	Switching to `createControlTokenForRequest` sources legacy `orgMemberships` from `membershipsFor`, which omits the `organizations.deleted_at IS NULL` filter; members of soft-deleted orgs gain legacy org-town access

SUGGESTION

File	Line	Issue
`services/gastown/src/dos/town/runtime-authorization.ts`	172	`hasActiveWork()` is only enforced when `expectedAuthorization` is set, so the exported admission path can replace a live runtime authorization while work is active

Files Reviewed (34 files)

ENVIRONMENT.md
apps/web/src/app/api/gastown/token/route.ts - 1 issue
apps/web/src/lib/auth/resource-delegation.test.ts
apps/web/src/lib/auth/resource-delegation.ts
services/gastown/src/dos/Town.do.ts
services/gastown/src/dos/town/config.ts
services/gastown/src/dos/town/legacy-token-renewal.test.ts
services/gastown/src/dos/town/legacy-token-renewal.ts
services/gastown/src/dos/town/runtime-authorization.test.ts
services/gastown/src/dos/town/runtime-authorization.ts - 1 issue
services/gastown/src/dos/town/runtime-downstream-contract.test.ts
services/gastown/src/dos/town/unattended-token-renewal.test.ts
services/gastown/src/dos/town/unattended-token-renewal.ts
services/gastown/src/gastown.worker.ts
services/gastown/src/handlers/org-towns.handler.test.ts
services/gastown/src/handlers/org-towns.handler.ts
services/gastown/src/handlers/town-runtime-authorization.handler.ts - 1 issue
services/gastown/src/handlers/towns.handler.ts - 1 issue
services/gastown/src/middleware/kilo-auth.middleware.test.ts
services/gastown/src/middleware/kilo-auth.middleware.ts
services/gastown/src/middleware/org-auth.middleware.test.ts
services/gastown/src/middleware/org-auth.middleware.ts
services/gastown/src/middleware/town-auth.middleware.test.ts
services/gastown/src/middleware/town-auth.middleware.ts
services/gastown/src/trpc/init.ts
services/gastown/src/trpc/router.ts
services/gastown/src/trpc/town-authorization.router.test.ts
services/gastown/src/types.runtime-authorization.test.ts
services/gastown/src/types.ts
services/gastown/src/util/token-pepper.util.ts
services/gastown/src/util/town-authorization.util.test.ts
services/gastown/src/util/town-authorization.util.ts - 1 issue
services/gastown/test/integration/town-private-identity.test.ts
services/gastown/vitest.workers.config.ts

Fix these issues in Kilo Cloud

_{Reviewed by deepseek-v4.1-flash · Input: 249.4K · Output: 24K · Cached: 1.1M}

_{Review guidance: REVIEW.md from base branch main}

feat(gastown): isolate gated token issuance and runtime authorization

d773fe1

pandemicsyn mentioned this pull request Sep 14, 2026

feat(auth): add gated mobile and Chat token issuance #5976

Open

pandemicsyn changed the title ~~feat(gastown): gated token issuance and runtime authorization~~ feat(gastown): add gated token issuance and runtime authorization Sep 14, 2026

docs(gastown): remove standalone token issuance guide

72f248b

kilo-code-bot Bot reviewed Sep 14, 2026

View reviewed changes

pandemicsyn added 3 commits September 14, 2026 12:08

fix(auth): exclude deleted organizations from delegated claims

3f9efd2

fix(gastown): preserve admin inspection and owner permissions

6482524

fix(gastown): require guarded replacement of runtime grants

4ed383e

iscekic approved these changes Sep 14, 2026

View reviewed changes

feat(wasteland): group gated control issuance with Gastown

3041eaf

pandemicsyn changed the title ~~feat(gastown): add gated token issuance and runtime authorization~~ feat(gastown): add gated Gastown and Wasteland token issuance Sep 14, 2026

Merge main into Gastown and Wasteland token issuance

bb0abf5

Navigation Menu

Uh oh!

feat(gastown): add gated Gastown and Wasteland token issuance - #6141

feat(gastown): add gated Gastown and Wasteland token issuance#6141
pandemicsyn wants to merge 7 commits into
mainfrom
split/gastown-token-issuance

pandemicsyn commented Sep 14, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kilo-code-bot Bot commented Sep 14, 2026 •

edited

Loading

Previous review (commit `4ed383e`)

Executive Summary

Previous review (commit `72f248b`)

Overview

CRITICAL

WARNING

SUGGESTION

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

pandemicsyn commented Sep 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Verification

Visual Changes

Reviewer Notes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kilo-code-bot Bot commented Sep 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Summary

Executive Summary

Previous review (commit 4ed383e)

Executive Summary

Previous review (commit 72f248b)

Overview

CRITICAL

WARNING

SUGGESTION

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

pandemicsyn commented Sep 14, 2026 •

edited

Loading

kilo-code-bot Bot commented Sep 14, 2026 •

edited

Loading

Previous review (commit `4ed383e`)

Previous review (commit `72f248b`)