fix(gateway): validate user authorization before auto-resume - #56347
Merged
Conversation
Auto-resume of restart-interrupted sessions bypassed auth checks. The session owner was never validated against TELEGRAM_ALLOWED_USERS (or equivalent) before the synthetic resume event was dispatched. An attacker with an active session before the allowlist was configured could receive a full agent response on gateway restart (issue #23778). Clean rebase of #23800 onto current main (egilewski flagged a merge conflict in gateway/run.py on the old branch). Fix: check _is_user_authorized() for the session owner before scheduling auto-resume. Unauthorized sessions are skipped with a warning log instead of silently resuming. Fixes #23778 (partial - auto-resume auth bypass)
Two tests for the auto-resume authorization gate: an unauthorized session owner is skipped without claiming a _running_agents slot or persisting one, and a raising auth check fails closed (session skipped, not resumed).
alt-glitch
added
type/security
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Auto-resume of restart-interrupted gateway sessions now validates the session owner against the current allowlist before synthesizing a recovery turn. Previously the resume path dispatched a full agent turn with no authorization check, so a session whose owner was removed from
TELEGRAM_ALLOWED_USERS(or created before the allowlist existed) still received a full agent response on gateway restart (#23778).Salvage of #47761 by @ygd58 (itself a rebase of the earlier #23800), re-applied at the current
_schedule_resume_pending_sessionssite and covered with tests.Changes
gateway/run.py_schedule_resume_pending_sessions: check_is_user_authorized(source)before auto-resuming. Unauthorized owners are skipped with a warning log; a raising auth check fails closed (session skipped, not resumed). The gate runs after the adapter-ready check and before the_running_agentsslot claim, so a skipped session never claims a slot or persists one.tests/gateway/test_restart_resume_pending.py: two tests — unauthorized owner is skipped (no slot claimed, nothing persisted) and a raising auth check fails closed.Root cause
The normal inbound path enforces auth (
run.pydrop-in-active-session guard and the main dispatch gate), but the auto-resume path (startup + platform-reconnect) synthesizes an internalMessageEventand runs a full turn directly — bypassing that gate. The merged adapter-level hardening (#28492) covers real inbound messages, not this synthetic-event path.Validation
tests/gateway/test_restart_resume_pending.py)Fixes #23778 (auto-resume auth bypass). Closes #47761 — @ygd58's fix commit authorship preserved via rebase-merge.
Infographic