-
Notifications
You must be signed in to change notification settings - Fork 0
fix(security): share one host-execution grant between startup and requests #3381
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from all commits
Commits
Show all changes
4 commits
Select commit
Hold shift + click to select a range
a2bfca8
fix(security): share one host-execution grant between startup and req…
kwakayama d2d4259
test(server): type the startup-discovery fakes against the real signa…
kwakayama f1dc4c2
docs(api-reference): repin production-server line numbers
kojiwakayama 15179ef
fix(server): stop calling discovery on a path that can only throw
kojiwakayama File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Some comments aren't visible on the classic Files Changed page.
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,134 @@ | ||
| import "#veryfront/schemas/_test-setup.ts"; | ||
| import { assertEquals } from "#veryfront/testing/assert.ts"; | ||
| import { describe, it } from "#veryfront/testing/bdd.ts"; | ||
| import type { DiscoveryConfig, DiscoveryResult } from "#veryfront/discovery/types.ts"; | ||
| import type { FileSystemAdapter } from "#veryfront/platform/adapters/base.ts"; | ||
| import type { ExtendedFileSystemAdapter } from "#veryfront/platform/adapters/fs/wrapper.ts"; | ||
| import { runStartupDiscovery } from "./startup-discovery.ts"; | ||
|
|
||
| function emptyResult(): DiscoveryResult { | ||
| return { | ||
| tools: new Map(), | ||
| agents: new Map(), | ||
| skills: new Map(), | ||
| resources: new Map(), | ||
| prompts: new Map(), | ||
| workflows: new Map(), | ||
| tasks: new Map(), | ||
| schedules: new Map(), | ||
| webhooks: new Map(), | ||
| evals: new Map(), | ||
| errors: [], | ||
| }; | ||
| } | ||
|
|
||
| function recorder() { | ||
| const calls: DiscoveryConfig[] = []; | ||
| return { | ||
| calls, | ||
| discoverAll: (config: DiscoveryConfig) => { | ||
| calls.push(config); | ||
| return Promise.resolve(emptyResult()); | ||
| }, | ||
| }; | ||
| } | ||
|
|
||
| /** Placeholder base dir: recorder() never touches the filesystem. */ | ||
| const PROJECT_DIR = "<PROJECT_DIR>"; | ||
|
|
||
| /** No adapter is extended, so discovery takes the unscoped branch. */ | ||
| const noExtendedAdapters = (_fs: FileSystemAdapter): _fs is ExtendedFileSystemAdapter => false; | ||
|
|
||
| /** Every adapter is extended, so discovery takes the scoped branch. */ | ||
| const allExtendedAdapters = (_fs: FileSystemAdapter): _fs is ExtendedFileSystemAdapter => true; | ||
|
|
||
| describe("server/startup-discovery", () => { | ||
| it("denies host execution when the deployment does not grant it", async () => { | ||
| const { calls, discoverAll } = recorder(); | ||
|
|
||
| await runStartupDiscovery({ | ||
| config: { baseDir: PROJECT_DIR }, | ||
| allowHostProjectCodeExecution: false, | ||
| discoverAll, | ||
| isExtendedFSAdapter: noExtendedAdapters, | ||
| }); | ||
|
|
||
| assertEquals(calls.length, 1); | ||
| assertEquals(calls[0]?.allowHostProjectCodeExecution, false); | ||
| }); | ||
|
|
||
| it("grants host execution when the deployment does", async () => { | ||
| const { calls, discoverAll } = recorder(); | ||
|
|
||
| await runStartupDiscovery({ | ||
| config: { baseDir: PROJECT_DIR }, | ||
| allowHostProjectCodeExecution: true, | ||
| discoverAll, | ||
| isExtendedFSAdapter: noExtendedAdapters, | ||
| }); | ||
|
|
||
| assertEquals(calls[0]?.allowHostProjectCodeExecution, true); | ||
| }); | ||
|
|
||
| it("skips the scoped multi-project path rather than calling discovery ungranted", async () => { | ||
| const { calls, discoverAll } = recorder(); | ||
| const fsAdapter = { | ||
| isMultiProjectMode: () => true, | ||
| runWithContext: <T>(_slug: string, _token: string, fn: () => Promise<T>) => fn(), | ||
| } as unknown as ExtendedFileSystemAdapter; | ||
|
|
||
| const outcome = await runStartupDiscovery({ | ||
| // Even with the deployment granting, the scoped branch must not pass it: | ||
| // that path evaluates tenant source under a project context. | ||
| config: { baseDir: PROJECT_DIR, projectSlug: "p", apiToken: "t", fsAdapter }, | ||
| allowHostProjectCodeExecution: true, | ||
| discoverAll, | ||
| isExtendedFSAdapter: allExtendedAdapters, | ||
| }); | ||
|
|
||
| assertEquals(outcome, { ran: false, reason: "scoped-multi-project" }); | ||
| assertEquals(calls.length, 0); | ||
| }); | ||
|
|
||
| it("never calls discovery in a way the real implementation would reject", async () => { | ||
| // The stub above accepts any config, but the real `discoverAll` throws on | ||
| // an ungranted one (`discovery-engine.ts`, "Executable project discovery | ||
| // requires explicit trusted-local execution"). A permissive stub is why the | ||
| // scoped branch could call it ungranted on every startup while the suite | ||
| // stayed green, so this stub enforces the same rule the real one does. | ||
| const enforcing = (config: DiscoveryConfig) => { | ||
| if (config.allowHostProjectCodeExecution !== true) { | ||
| return Promise.reject( | ||
| new TypeError("Executable project discovery requires explicit trusted-local execution"), | ||
| ); | ||
| } | ||
| return Promise.resolve(emptyResult()); | ||
| }; | ||
| const fsAdapter = { | ||
| isMultiProjectMode: () => true, | ||
| runWithContext: <T>(_slug: string, _token: string, fn: () => Promise<T>) => fn(), | ||
| } as unknown as ExtendedFileSystemAdapter; | ||
|
|
||
| // Scoped: must skip, so the enforcing stub is never reached. | ||
| assertEquals( | ||
| await runStartupDiscovery({ | ||
| config: { baseDir: PROJECT_DIR, projectSlug: "p", apiToken: "t", fsAdapter }, | ||
| allowHostProjectCodeExecution: true, | ||
| discoverAll: enforcing, | ||
| isExtendedFSAdapter: allExtendedAdapters, | ||
| }), | ||
| { ran: false, reason: "scoped-multi-project" }, | ||
| ); | ||
|
|
||
| // Unscoped and granted: must reach discovery and be accepted. | ||
| assertEquals( | ||
| await runStartupDiscovery({ | ||
| config: { baseDir: PROJECT_DIR }, | ||
| allowHostProjectCodeExecution: true, | ||
| discoverAll: enforcing, | ||
| isExtendedFSAdapter: noExtendedAdapters, | ||
| }), | ||
| { ran: true }, | ||
| ); | ||
| }); | ||
| }); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,74 @@ | ||
| /** | ||
| * Primitive discovery run once at startup, before the server accepts requests. | ||
| * | ||
| * Extracted from `production-server.ts` so the host-execution grant it passes | ||
| * can be tested. The bug this addresses (issue-inbox#363) was that the fallback | ||
| * branch hardcoded `allowHostProjectCodeExecution: true` while the request | ||
| * handler computed the real answer fifteen lines below, so a deployment that | ||
| * denied execution at request time still granted it at startup. | ||
| * | ||
| * Same shape as veryfront-code#3364, where `api-handler-wrapper.ts` passed a | ||
| * hardcoded `true` and made the computed predicate dead code. A hardcoded | ||
| * capability sitting next to a computed one is the pattern to look for. | ||
| */ | ||
|
|
||
| import type { DiscoveryConfig, DiscoveryResult } from "#veryfront/discovery/types.ts"; | ||
| import type { FileSystemAdapter } from "#veryfront/platform/adapters/base.ts"; | ||
| import type { ExtendedFileSystemAdapter } from "#veryfront/platform/adapters/fs/wrapper.ts"; | ||
| import type { DiscoveryOptions } from "./production-server.ts"; | ||
|
|
||
| export interface RunStartupDiscoveryInput { | ||
| config: DiscoveryOptions; | ||
| /** | ||
| * The deployment's posture, computed once by the host-owned entrypoint and | ||
| * shared with the request handler. Never hardcoded here. | ||
| */ | ||
| allowHostProjectCodeExecution: boolean; | ||
| discoverAll: (config: DiscoveryConfig) => Promise<DiscoveryResult>; | ||
| isExtendedFSAdapter: (fs: FileSystemAdapter) => fs is ExtendedFileSystemAdapter; | ||
| } | ||
|
|
||
| /** Whether discovery can be scoped to one project on a multi-project adapter. */ | ||
| function scopedAdapter( | ||
| input: RunStartupDiscoveryInput, | ||
| ): ExtendedFileSystemAdapter | undefined { | ||
| const { config } = input; | ||
| if (!config.projectSlug || !config.apiToken || !config.fsAdapter) return undefined; | ||
| if (!input.isExtendedFSAdapter(config.fsAdapter)) return undefined; | ||
| return config.fsAdapter.isMultiProjectMode() ? config.fsAdapter : undefined; | ||
| } | ||
|
|
||
| /** What startup discovery did, so the caller can report it accurately. */ | ||
| export type StartupDiscoveryOutcome = | ||
| | { ran: true } | ||
| | { ran: false; reason: "scoped-multi-project" }; | ||
|
|
||
| export async function runStartupDiscovery( | ||
| input: RunStartupDiscoveryInput, | ||
| ): Promise<StartupDiscoveryOutcome> { | ||
| const { config } = input; | ||
|
|
||
| if (scopedAdapter(input)) { | ||
| // Scoped to one project, so tenant source is in reach. This path stays | ||
| // ungranted whatever the deployment's posture: the capability is for a | ||
| // host-owned entrypoint evaluating its own project, not for discovery | ||
| // running inside a tenant's context. | ||
| // | ||
| // `discoverAll` refuses an ungranted config by throwing, so an ungranted | ||
| // call here cannot discover anything, it can only raise. Previously this | ||
| // branch called it anyway inside `runWithContext`, and every scoped | ||
| // multi-project startup logged "Primitive discovery failed" while the real | ||
| // meaning was "this deployment does not run startup discovery". Skipping | ||
| // is the same behaviour with an honest name and no exception as control | ||
| // flow. | ||
| return { ran: false, reason: "scoped-multi-project" }; | ||
| } | ||
|
|
||
| await input.discoverAll({ | ||
| baseDir: config.baseDir, | ||
| fsAdapter: config.fsAdapter, | ||
| verbose: config.verbose ?? false, | ||
| allowHostProjectCodeExecution: input.allowHostProjectCodeExecution, | ||
| }); | ||
| return { ran: true }; | ||
| } | ||
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.