diff --git a/cmd/subrouter/authority_routes.go b/cmd/subrouter/authority_routes.go new file mode 100644 index 0000000..f839b9d --- /dev/null +++ b/cmd/subrouter/authority_routes.go @@ -0,0 +1,1009 @@ +package main + +import ( + "context" + "crypto/sha256" + "encoding/json" + "errors" + "flag" + "fmt" + "io" + "net" + "net/http" + "net/url" + "os" + "path/filepath" + "strings" + "syscall" + "time" + + "github.com/manaflow-ai/subrouter/internal/accounts" + agentclaude "github.com/manaflow-ai/subrouter/internal/agents/claude" + "github.com/manaflow-ai/subrouter/internal/authority" +) + +const authorityAdminFileName = "authority-admin" + +type authorityClaudeLoginResult struct { + Credential agentclaude.CredentialInfo + IdentityFingerprint string +} + +func authorityClaudeProviderIdentity(email, orgID string) string { + email = strings.ToLower(strings.TrimSpace(email)) + orgID = strings.TrimSpace(orgID) + if email == "" && orgID == "" { + return "" + } + digest := sha256.Sum256([]byte(email + "\x00" + orgID)) + return fmt.Sprintf("%x", digest[:]) +} + +func authorityClaudeIdentityPath(stateDir, accountID string) string { + digest := sha256.Sum256([]byte(accountID)) + return filepath.Join(stateDir, "providers", "claude", ".authority-identities", fmt.Sprintf("%x.identity", digest[:16])) +} + +func writeAuthorityClaudeIdentity(stateDir, accountID, fingerprint string) error { + if len(fingerprint) != 64 { + return errors.New("invalid Claude identity fingerprint") + } + path := authorityClaudeIdentityPath(stateDir, accountID) + if err := os.MkdirAll(filepath.Dir(path), 0700); err != nil { + return err + } + temporary, err := os.CreateTemp(filepath.Dir(path), ".identity-") + if err != nil { + return err + } + temporaryName := temporary.Name() + defer os.Remove(temporaryName) + if err := temporary.Chmod(0600); err != nil { + temporary.Close() + return err + } + if _, err := io.WriteString(temporary, fingerprint+"\n"); err != nil { + temporary.Close() + return err + } + if err := temporary.Sync(); err != nil { + temporary.Close() + return err + } + if err := temporary.Close(); err != nil { + return err + } + return os.Rename(temporaryName, path) +} + +func readAuthorityClaudeIdentity(stateDir, accountID string) (string, error) { + body, err := os.ReadFile(authorityClaudeIdentityPath(stateDir, accountID)) + if err != nil { + return "", err + } + value := strings.TrimSpace(string(body)) + if len(value) != 64 { + return "", errors.New("invalid Claude identity fingerprint") + } + return value, nil +} + +var runAuthorityCodexLogin = func(ctx context.Context, loginHome string, in io.Reader, out, errOut io.Writer) (accounts.CodexAuthFile, error) { + if err := (execSRCommandRunner{}).RunWithEnv(ctx, "codex", []string{"login", "--device-auth"}, []string{"CODEX_HOME=" + loginHome}, in, out, errOut); err != nil { + return accounts.CodexAuthFile{}, fmt.Errorf("codex login failed") + } + auth, ok, err := accounts.ReadCodexAuthFile(filepath.Join(loginHome, "auth.json")) + if err != nil { + return accounts.CodexAuthFile{}, err + } + if !ok || auth.Tokens == nil || strings.TrimSpace(auth.Tokens.AccessToken) == "" || strings.TrimSpace(auth.Tokens.RefreshToken) == "" || strings.TrimSpace(auth.Tokens.IDToken) == "" { + return accounts.CodexAuthFile{}, errors.New("codex login did not produce complete OAuth auth") + } + return auth, nil +} + +var runAuthorityClaudeLogin = func(ctx context.Context, loginHome, accountID string, in io.Reader, out, errOut io.Writer) (authorityClaudeLoginResult, error) { + store := agentclaude.Store{Dir: filepath.Join(loginHome, "store"), SharedStateDir: ""} + runner := claudeRunner{store: store, in: in, out: out, errOut: errOut, client: http.DefaultClient} + if err := runner.add(ctx, accountID); err != nil { + return authorityClaudeLoginResult{}, fmt.Errorf("claude login failed") + } + profile, ok := store.FindProfile(accountID) + if !ok { + return authorityClaudeLoginResult{}, errors.New("claude login profile unavailable") + } + configDir := store.PreferredInstancePath(filepath.Join(store.InstancesDir(), profile.Dir)) + credential, err := store.ReadCredential(ctx, configDir) + if err != nil || credential == nil || strings.TrimSpace(credential.AccessToken) == "" || strings.TrimSpace(credential.RefreshToken) == "" { + return authorityClaudeLoginResult{}, errors.New("claude login did not produce complete OAuth auth") + } + claudePath, ok := agentclaude.DetectCLI() + if !ok { + return authorityClaudeLoginResult{}, errors.New("claude CLI unavailable after login") + } + status, err := agentclaude.AuthStatusForPath(ctx, claudePath, configDir) + if err != nil || status == nil || !status.LoggedIn { + return authorityClaudeLoginResult{}, errors.New("claude login identity unavailable") + } + identity := authorityClaudeProviderIdentity(status.Email, status.OrgID) + if identity == "" { + return authorityClaudeLoginResult{}, errors.New("claude login identity unavailable") + } + return authorityClaudeLoginResult{Credential: *credential, IdentityFingerprint: identity}, nil +} + +func authorityAccountCommand(args []string) error { + if len(args) == 0 { + return errors.New("authority-account requires login, repair, status, or remove") + } + switch args[0] { + case "login": + return authorityAccountLogin(args[1:], false) + case "repair": + return authorityAccountLogin(args[1:], true) + case "status": + return authorityAccountStatus(args[1:]) + case "remove": + return authorityAccountRemove(args[1:]) + default: + return errors.New("unknown authority-account action") + } +} + +func authorityCodexByLabel(store accounts.CodexStore, label string) (accounts.StoredCodexAccount, bool, error) { + all, err := store.ListStored() + if err != nil { + return accounts.StoredCodexAccount{}, false, err + } + var match accounts.StoredCodexAccount + found := false + for _, item := range all { + if item.ProviderOrDefault() != accounts.ProviderCodex || item.Label != label { + continue + } + if found { + return accounts.StoredCodexAccount{}, false, errors.New("duplicate owner label") + } + match, found = item, true + } + return match, found, nil +} + +func authorityAccountLogin(args []string, repair bool) error { + name := "authority-account login" + if repair { + name = "authority-account repair" + } + flags := quietFlags(name) + stateDir := flags.String("state-dir", "", "authority state directory") + provider := flags.String("provider", "", "provider") + accountID := flags.String("account-id", "", "owner account identifier") + deviceAuth := flags.Bool("device-auth", false, "use supported Codex device authentication") + if err := flags.Parse(args); err != nil { + return boundedAdminError("invalid account login request") + } + adminStore, err := protectedAuthorityStore(*stateDir) + if err != nil { + return err + } + _ = adminStore.Close() + if strings.TrimSpace(*accountID) == "" || (*provider != "codex" && *provider != "claude") || (*provider == "codex" && !*deviceAuth) || (*provider == "claude" && *deviceAuth) { + return boundedAdminError("account login provider, identifier, or login method refused") + } + leaseState, err := accounts.StoreLeaseState(*stateDir) + if err != nil || leaseState != "held" { + return boundedAdminError("authority service is not ready for account login") + } + if *provider == "claude" { + return authorityClaudeAccountLogin(*stateDir, *accountID, repair) + } + return authorityCodexAccountLogin(*stateDir, *accountID, repair) +} + +func authorityCodexAccountLogin(stateDir, accountID string, repair bool) error { + store := authorityCodexStore(stateDir) + existing, exists, err := authorityCodexByLabel(store, accountID) + if err != nil { + return boundedAdminError("authority account state unavailable") + } + if repair && !exists { + return boundedAdminError("authority account repair requires an existing account") + } + if !repair && exists { + return boundedAdminError("authority account already exists") + } + loginHome, err := os.MkdirTemp(stateDir, ".codex-login-") + if err != nil { + return boundedAdminError("authority account login workspace unavailable") + } + defer os.RemoveAll(loginHome) + if err := os.Chmod(loginHome, 0700); err != nil { + return boundedAdminError("authority account login workspace unavailable") + } + auth, err := runAuthorityCodexLogin(context.Background(), loginHome, os.Stdin, os.Stdout, os.Stderr) + if err != nil { + return boundedAdminError("authority account login did not complete") + } + email, err := accounts.ExtractEmailFromJWT(auth.Tokens.IDToken) + if err != nil || strings.TrimSpace(email) == "" { + return boundedAdminError("authority account login identity unavailable") + } + if repair { + if !strings.EqualFold(existing.Email, email) { + return boundedAdminError("authority account repair identity mismatch") + } + if existing.Auth.Tokens != nil && existing.Auth.Tokens.AccountID != "" && auth.Tokens.AccountID != "" && existing.Auth.Tokens.AccountID != auth.Tokens.AccountID { + return boundedAdminError("authority account repair identity mismatch") + } + existing.Auth = auth + existing.Label = accountID + existing.Provider = accounts.ProviderCodex + if err := store.ReplaceStoredOAuthCredential(existing); err != nil { + return boundedAdminError("authority account repair persistence failed") + } + fmt.Println("Authority account repair: complete") + return nil + } + fresh := accounts.StoredCodexAccount{ + Email: email, Label: accountID, Provider: accounts.ProviderCodex, + AddedAt: time.Now().UTC().Format(time.RFC3339), Auth: auth, + } + if err := store.ReplaceStoredOAuthCredential(fresh); err != nil { + return boundedAdminError("authority account login persistence failed") + } + fmt.Println("Authority account login: complete") + return nil +} + +func authorityClaudeAccountLogin(stateDir, accountID string, repair bool) error { + store := authorityClaudeStore(stateDir) + _, exists := store.FindProfile(accountID) + if repair && !exists { + return boundedAdminError("authority account repair requires an existing account") + } + if !repair && exists { + return boundedAdminError("authority account already exists") + } + loginHome, err := os.MkdirTemp(stateDir, ".claude-login-") + if err != nil { + return boundedAdminError("authority account login workspace unavailable") + } + defer os.RemoveAll(loginHome) + if err := os.Chmod(loginHome, 0700); err != nil { + return boundedAdminError("authority account login workspace unavailable") + } + result, err := runAuthorityClaudeLogin(context.Background(), loginHome, accountID, os.Stdin, os.Stdout, os.Stderr) + if err != nil { + return boundedAdminError("authority account login did not complete") + } + if repair { + identity, err := readAuthorityClaudeIdentity(stateDir, accountID) + if err != nil || identity != result.IdentityFingerprint { + return boundedAdminError("authority account repair identity mismatch") + } + if err := store.ImportProfileCredential(accountID, result.Credential); err != nil { + return boundedAdminError("authority account repair persistence failed") + } + fmt.Println("Authority account repair: complete") + return nil + } + if err := store.ImportProfileCredential(accountID, result.Credential); err != nil { + return boundedAdminError("authority account login persistence failed") + } + if err := writeAuthorityClaudeIdentity(stateDir, accountID, result.IdentityFingerprint); err != nil { + _, _ = store.RemoveProfile(accountID) + return boundedAdminError("authority account login persistence failed") + } + fmt.Println("Authority account login: complete") + return nil +} + +func authorityAccountStatus(args []string) error { + flags := quietFlags("authority-account status") + stateDir := flags.String("state-dir", "", "authority state directory") + provider := flags.String("provider", "", "provider") + accountID := flags.String("account-id", "", "owner account identifier") + if err := flags.Parse(args); err != nil { + return boundedAdminError("invalid account status request") + } + adminStore, err := protectedAuthorityStore(*stateDir) + if err != nil { + return err + } + _ = adminStore.Close() + if strings.TrimSpace(*accountID) == "" || (*provider != "codex" && *provider != "claude") { + return boundedAdminError("account status provider or identifier refused") + } + credentialKey := *accountID + if *provider == "codex" { + store := authorityCodexStore(*stateDir) + stored, exists, err := authorityCodexByLabel(store, *accountID) + if err != nil || !exists || stored.Auth.Tokens == nil || strings.TrimSpace(stored.Auth.Tokens.AccessToken) == "" { + return boundedAdminError("authority account unavailable") + } + credentialKey = stored.Email + } else { + store := authorityClaudeStore(*stateDir) + profile, exists := store.FindProfile(*accountID) + if !exists { + return boundedAdminError("authority account unavailable") + } + configDir := store.PreferredInstancePath(filepath.Join(store.InstancesDir(), profile.Dir)) + credential, err := store.ReadCredential(context.Background(), configDir) + if err != nil || credential == nil || strings.TrimSpace(credential.AccessToken) == "" || strings.TrimSpace(credential.RefreshToken) == "" { + return boundedAdminError("authority account unavailable") + } + if _, err := readAuthorityClaudeIdentity(*stateDir, *accountID); err != nil { + return boundedAdminError("authority account identity unavailable") + } + } + providerStoreDir := authorityCodexStore(*stateDir).Dir + if *provider == "claude" { + providerStoreDir = authorityClaudeStore(*stateDir).Dir + } + generation, err := accounts.RefreshCredentialGeneration(providerStoreDir, credentialKey) + if err != nil || generation == 0 { + return boundedAdminError("authority account generation unavailable") + } + unresolved, err := accounts.RefreshCredentialBlocked(providerStoreDir, credentialKey) + if err != nil { + return boundedAdminError("authority account state unavailable") + } + state := "ready" + if unresolved { + state = "repair required" + } + fmt.Printf("Authority account: %s\nProvider: %s\nCredential generation: %d\nUnresolved refresh: %s\nAccount state: %s\n", *accountID, *provider, generation, map[bool]string{true: "yes", false: "no"}[unresolved], state) + return nil +} + +func authorityAccountRemove(args []string) error { + flags := quietFlags("authority-account remove") + stateDir := flags.String("state-dir", "", "authority state directory") + provider := flags.String("provider", "", "provider") + accountID := flags.String("account-id", "", "owner account identifier") + if err := flags.Parse(args); err != nil { + return boundedAdminError("invalid account removal request") + } + adminStore, err := protectedAuthorityStore(*stateDir) + if err != nil { + return err + } + _ = adminStore.Close() + if strings.TrimSpace(*accountID) == "" || (*provider != "codex" && *provider != "claude") { + return boundedAdminError("account removal provider or identifier refused") + } + if *provider == "codex" { + store := authorityCodexStore(*stateDir) + stored, exists, err := authorityCodexByLabel(store, *accountID) + if err != nil || !exists { + return boundedAdminError("authority account unavailable") + } + if _, removed, err := store.RemoveStored(stored.Email); err != nil || !removed { + return boundedAdminError("authority account removal failed") + } + } else { + store := authorityClaudeStore(*stateDir) + removed, err := store.RemoveProfile(*accountID) + if err != nil || !removed { + return boundedAdminError("authority account removal failed") + } + if err := os.Remove(authorityClaudeIdentityPath(*stateDir, *accountID)); err != nil && !errors.Is(err, os.ErrNotExist) { + return boundedAdminError("authority account removal failed") + } + } + fmt.Println("Authority account: removed") + return nil +} + +func authorityRouteCommand(args []string) error { + if len(args) == 0 { + return errors.New("authority-route requires create, disable, remove, or status") + } + switch args[0] { + case "create": + return authorityRouteCreate(args[1:]) + case "disable": + return authorityRouteDisable(args[1:]) + case "remove": + return authorityRouteRemove(args[1:]) + case "status": + return authorityRouteStatus(args[1:]) + default: + return errors.New("unknown authority-route action") + } +} + +func authorityRouteCreate(args []string) error { + flags := quietFlags("authority-route create") + stateDir := flags.String("state-dir", "", "authority state directory") + tenantID := flags.String("tenant-id", "", "opaque tenant identifier") + provider := flags.String("provider", "", "provider") + accountID := flags.String("account-id", "", "exact account identifier") + enabled := flags.Bool("enabled", false, "enable exact route") + routeIDFile := flags.String("route-id-file", "", "protected route identifier destination") + if err := flags.Parse(args); err != nil { + return boundedAdminError("invalid route request") + } + store, err := protectedAuthorityStore(*stateDir) + if err != nil { + return err + } + defer store.Close() + if *routeIDFile != "" { + if _, err := protectedDestination(*routeIDFile); err != nil { + return err + } + } + route := authority.Route{RouteID: authority.NewID(), TenantID: *tenantID, Provider: *provider, AccountID: *accountID, Enabled: *enabled} + if err := store.CreateRoute(route); err != nil { + return boundedAdminError("route creation refused") + } + if *routeIDFile != "" { + if err := writeProtectedKey(*routeIDFile, route.RouteID); err != nil { + _ = store.RemoveRoute(route.RouteID) + return err + } + } + fmt.Println("Authority route: created") + return nil +} + +func authorityRouteDisable(args []string) error { + flags := quietFlags("authority-route disable") + stateDir := flags.String("state-dir", "", "authority state directory") + routeID := flags.String("route-id", "", "route identifier") + if err := flags.Parse(args); err != nil { + return boundedAdminError("invalid route request") + } + store, err := protectedAuthorityStore(*stateDir) + if err != nil { + return err + } + defer store.Close() + if err := store.SetRouteEnabled(*routeID, false); err != nil { + return boundedAdminError("route disable refused") + } + fmt.Println("Authority route: disabled") + return nil +} + +func authorityRouteRemove(args []string) error { + flags := quietFlags("authority-route remove") + stateDir := flags.String("state-dir", "", "authority state directory") + routeID := flags.String("route-id", "", "route identifier") + if err := flags.Parse(args); err != nil { + return boundedAdminError("invalid route request") + } + store, err := protectedAuthorityStore(*stateDir) + if err != nil { + return err + } + defer store.Close() + if err := store.RemoveRoute(*routeID); err != nil { + return boundedAdminError("route removal refused") + } + fmt.Println("Authority route: removed") + return nil +} + +func authorityRouteStatus(args []string) error { + flags := quietFlags("authority-route status") + stateDir := flags.String("state-dir", "", "authority state directory") + if err := flags.Parse(args); err != nil { + return boundedAdminError("invalid status request") + } + store, err := protectedAuthorityStore(*stateDir) + if err != nil { + return err + } + defer store.Close() + routes, grants, err := store.Counts() + if err != nil { + return boundedAdminError("authority status unavailable") + } + fmt.Printf("Authority routes: %d\nProxy grants: %d\n", routes, grants) + return nil +} + +func authorityGrantCommand(args []string) error { + if len(args) == 0 { + return errors.New("authority-grant requires create, revoke, remove, or remove-route") + } + switch args[0] { + case "create": + return authorityGrantCreate(args[1:]) + case "revoke": + return authorityGrantRevoke(args[1:]) + case "remove": + return authorityGrantRemove(args[1:]) + case "remove-route": + return authorityGrantRemoveRoute(args[1:]) + default: + return errors.New("unknown authority-grant action") + } +} + +func authorityGrantCreate(args []string) error { + flags := quietFlags("authority-grant create") + stateDir := flags.String("state-dir", "", "authority state directory") + routeID := flags.String("route-id", "", "route identifier") + audience := flags.String("audience", "", "grant audience") + expiresRaw := flags.String("expires-at", "", "RFC3339 expiration") + keyPath := flags.String("proxy-key-file", "", "protected key destination") + grantIDFile := flags.String("grant-id-file", "", "protected grant identifier destination") + if err := flags.Parse(args); err != nil { + return boundedAdminError("invalid grant request") + } + store, err := protectedAuthorityStore(*stateDir) + if err != nil { + return err + } + defer store.Close() + expiresAt, err := time.Parse(time.RFC3339, *expiresRaw) + if err != nil { + return boundedAdminError("invalid grant expiry") + } + if *grantIDFile != "" { + if _, err := protectedDestination(*grantIDFile); err != nil { + return err + } + } + key, err := authority.NewKey() + if err != nil { + return boundedAdminError("grant generation failed") + } + if err := writeProtectedKey(*keyPath, key); err != nil { + return err + } + keyHash := authority.HashKey(key) + grant, err := store.CreateGrant(*routeID, *audience, expiresAt, keyHash) + if err != nil { + _ = store.RemoveGrantByHash(keyHash) + _ = os.Remove(*keyPath) + return boundedAdminError("grant creation refused") + } + if *grantIDFile != "" { + if err := writeProtectedKey(*grantIDFile, grant.GrantID); err != nil { + _ = store.RemoveGrant(grant.GrantID) + _ = os.Remove(*keyPath) + return err + } + } + fmt.Println("Proxy grant: created") + return nil +} + +func authorityGrantRemove(args []string) error { + flags := quietFlags("authority-grant remove") + stateDir := flags.String("state-dir", "", "authority state directory") + grantID := flags.String("grant-id", "", "grant identifier") + if err := flags.Parse(args); err != nil { + return boundedAdminError("invalid grant request") + } + store, err := protectedAuthorityStore(*stateDir) + if err != nil { + return err + } + defer store.Close() + if err := store.RemoveGrant(*grantID); err != nil { + return boundedAdminError("grant removal refused") + } + fmt.Println("Proxy grant: removed") + return nil +} + +func authorityGrantRemoveRoute(args []string) error { + flags := quietFlags("authority-grant remove-route") + stateDir := flags.String("state-dir", "", "authority state directory") + routeID := flags.String("route-id", "", "route identifier") + if err := flags.Parse(args); err != nil { + return boundedAdminError("invalid grant request") + } + store, err := protectedAuthorityStore(*stateDir) + if err != nil { + return err + } + defer store.Close() + if err := store.RemoveGrantsForRoute(*routeID); err != nil { + return boundedAdminError("route grant removal refused") + } + fmt.Println("Proxy route grants: removed") + return nil +} + +func authorityGrantRevoke(args []string) error { + flags := quietFlags("authority-grant revoke") + stateDir := flags.String("state-dir", "", "authority state directory") + grantID := flags.String("grant-id", "", "grant identifier") + if err := flags.Parse(args); err != nil { + return boundedAdminError("invalid grant request") + } + store, err := protectedAuthorityStore(*stateDir) + if err != nil { + return err + } + defer store.Close() + if err := store.RevokeGrant(*grantID); err != nil { + return boundedAdminError("grant revocation refused") + } + fmt.Println("Proxy grant: revoked") + return nil +} + +func authorityProof(args []string) error { + flags := quietFlags("authority-proof") + stateDir := flags.String("state-dir", "", "authority state directory") + origin := flags.String("origin", "", "loopback authority origin") + keyPath := flags.String("proxy-key-file", "", "run-owned protected key path") + if err := flags.Parse(args); err != nil { + return boundedAdminError("proof configuration refused") + } + store, err := protectedAuthorityStore(*stateDir) + if err != nil { + return err + } + defer store.Close() + base, err := localAuthorityOrigin(*origin) + if err != nil { + return err + } + if _, err := protectedDestination(*keyPath); err != nil { + return err + } + before, err := providerCredentialCount(*stateDir) + if err != nil || before != 0 { + return boundedAdminError("provider credential boundary failed") + } + routeID := authority.NewID() + wrongRouteID := authority.NewID() + tenantID := authority.NewID() + accountID := authority.NewID() + grantID := "" + expiryGrantID := "" + cleanup := func() { + for _, fixtureGrantID := range []string{grantID, expiryGrantID} { + if fixtureGrantID != "" { + _ = store.RevokeGrant(fixtureGrantID) + _ = store.RemoveGrant(fixtureGrantID) + } + } + _ = store.SetRouteEnabled(routeID, false) + _ = store.RemoveRoute(routeID) + _ = store.RemoveRoute(wrongRouteID) + _ = store.RemoveFixtureAccount("claude", accountID) + _ = os.Remove(*keyPath) + } + defer cleanup() + if err := store.AddFixtureAccount(authority.FixtureAccount{Provider: "claude", AccountID: accountID, State: "unavailable"}); err != nil { + return boundedAdminError("proof fixture account setup failed") + } + if err := store.CreateRoute(authority.Route{RouteID: routeID, TenantID: tenantID, Provider: "claude", AccountID: accountID, Enabled: true}); err != nil { + return boundedAdminError("proof exact route setup failed") + } + if err := store.CreateRoute(authority.Route{RouteID: wrongRouteID, TenantID: tenantID, Provider: "claude", AccountID: authority.NewID(), Enabled: true}); err != nil { + return boundedAdminError("proof wrong route setup failed") + } + key, err := authority.NewKey() + if err != nil || writeProtectedKey(*keyPath, key) != nil { + return boundedAdminError("proof key setup failed") + } + grant, err := store.CreateGrant(routeID, "workstation", time.Now().Add(10*time.Minute), authority.HashKey(key)) + if err != nil { + return boundedAdminError("proof grant setup failed") + } + grantID = grant.GrantID + client := &http.Client{Timeout: 3 * time.Second} + status, statusValid := proofStatusRequest(client, base, routeID, key) + missing := proofRequest(client, base, routeID, "/_subrouter/status", "", "") + malformed := proofMalformedRequest(client, base, routeID) + conflict := proofRequest(client, base, routeID, "/v1/messages", key, "conflict") + wrong := proofRequest(client, base, wrongRouteID, "/_subrouter/status", key, "") + admin := proofRequest(client, base, routeID, "/_subrouter/accounts", key, "") + globalAdmin := proofGlobalRequest(client, base, "/_subrouter/accounts", key) + provider := proofRequest(client, base, routeID, "/v1/messages", key, "") + if status != http.StatusOK || !statusValid || missing != http.StatusUnauthorized || malformed != http.StatusUnauthorized || conflict != http.StatusConflict || wrong != http.StatusUnauthorized || admin != http.StatusNotFound || globalAdmin != http.StatusNotFound || provider != http.StatusServiceUnavailable { + return boundedAdminError("authority policy proof failed") + } + if err := store.RevokeGrant(grantID); err != nil { + return boundedAdminError("proof cleanup failed") + } + if proofRequest(client, base, routeID, "/_subrouter/status", key, "") != http.StatusUnauthorized { + return boundedAdminError("revocation proof failed") + } + expiryKey, err := authority.NewKey() + if err != nil { + return boundedAdminError("expiry proof setup failed") + } + expiryGrant, err := store.CreateGrant(routeID, "workstation", time.Now().Add(50*time.Millisecond), authority.HashKey(expiryKey)) + if err != nil { + return boundedAdminError("expiry proof setup failed") + } + expiryGrantID = expiryGrant.GrantID + expiryDeadline := time.Now().Add(2 * time.Second) + for proofRequest(client, base, routeID, "/_subrouter/status", expiryKey, "") != http.StatusUnauthorized { + if time.Now().After(expiryDeadline) { + return boundedAdminError("expiry proof failed") + } + } + cleanup() + after, err := providerCredentialCount(*stateDir) + if err != nil || after != 0 { + return boundedAdminError("provider credential boundary failed") + } + fmt.Println("Exact dark route: PASS") + fmt.Println("Proxy grant scope: PASS") + fmt.Println("Admin isolation: PASS") + fmt.Println("Provider credentials: 0") + return nil +} + +func proofStatusRequest(client *http.Client, origin *url.URL, routeID, key string) (int, bool) { + target := *origin + target.Path = "/r/" + routeID + "/_subrouter/status" + request, err := http.NewRequestWithContext(context.Background(), http.MethodGet, target.String(), nil) + if err != nil { + return 0, false + } + request.Header.Set("Authorization", "Bearer "+key) + response, err := client.Do(request) + if err != nil { + return 0, false + } + defer response.Body.Close() + body, err := io.ReadAll(io.LimitReader(response.Body, (16<<10)+1)) + if err != nil || len(body) > 16<<10 { + return response.StatusCode, false + } + var payload map[string]json.RawMessage + if err := json.Unmarshal(body, &payload); err != nil || len(payload) != 7 { + return response.StatusCode, false + } + var state, provider, availability, routeFingerprint, grantFingerprint, expiry string + var revoked bool + valid := json.Unmarshal(payload["state"], &state) == nil && state == "migration-required" && + json.Unmarshal(payload["provider"], &provider) == nil && provider == "claude" && + json.Unmarshal(payload["account_availability"], &availability) == nil && availability == "unavailable" && + json.Unmarshal(payload["route_fingerprint"], &routeFingerprint) == nil && len(routeFingerprint) == 12 && + json.Unmarshal(payload["grant_fingerprint"], &grantFingerprint) == nil && len(grantFingerprint) == 12 && + json.Unmarshal(payload["grant_expires_at"], &expiry) == nil && + json.Unmarshal(payload["grant_revoked"], &revoked) == nil && !revoked + if _, err := time.Parse(time.RFC3339, expiry); err != nil { + valid = false + } + return response.StatusCode, valid +} + +func proofRequest(client *http.Client, origin *url.URL, routeID, suffix, key, selector string) int { + target := *origin + target.Path = "/r/" + routeID + suffix + request, err := http.NewRequestWithContext(context.Background(), http.MethodGet, target.String(), nil) + if err != nil { + return 0 + } + if key != "" { + request.Header.Set("Authorization", "Bearer "+key) + } + if selector != "" { + request.Header.Set("X-Subrouter-Account-ID", selector) + } + response, err := client.Do(request) + if err != nil { + return 0 + } + defer response.Body.Close() + _, _ = io.Copy(io.Discard, io.LimitReader(response.Body, 16<<10)) + return response.StatusCode +} + +func proofMalformedRequest(client *http.Client, origin *url.URL, routeID string) int { + target := *origin + target.Path = "/r/" + routeID + "/_subrouter/status" + request, err := http.NewRequestWithContext(context.Background(), http.MethodGet, target.String(), nil) + if err != nil { + return 0 + } + request.Header.Set("Authorization", "Basic synthetic") + response, err := client.Do(request) + if err != nil { + return 0 + } + defer response.Body.Close() + _, _ = io.Copy(io.Discard, io.LimitReader(response.Body, 16<<10)) + return response.StatusCode +} + +func proofGlobalRequest(client *http.Client, origin *url.URL, path, key string) int { + target := *origin + target.Path = path + request, err := http.NewRequestWithContext(context.Background(), http.MethodGet, target.String(), nil) + if err != nil { + return 0 + } + if key != "" { + request.Header.Set("Authorization", "Bearer "+key) + } + response, err := client.Do(request) + if err != nil { + return 0 + } + defer response.Body.Close() + _, _ = io.Copy(io.Discard, io.LimitReader(response.Body, 16<<10)) + return response.StatusCode +} + +func providerCredentialCount(stateDir string) (int, error) { + roots := []string{ + filepath.Join(stateDir, "providers", "codex", "accounts"), + filepath.Join(stateDir, "providers", "claude"), + } + count := 0 + seen := 0 + for _, root := range roots { + if _, err := os.Lstat(root); errors.Is(err, os.ErrNotExist) { + continue + } else if err != nil { + return 0, err + } + err := filepath.WalkDir(root, func(path string, entry os.DirEntry, walkErr error) error { + if walkErr != nil { + return walkErr + } + seen++ + if seen > 256 || len(path) > 4096 || entry.Type()&os.ModeSymlink != 0 { + return errors.New("provider credential tree policy refused") + } + relative, err := filepath.Rel(root, path) + if err != nil || relative == ".." || strings.HasPrefix(relative, ".."+string(filepath.Separator)) || len(strings.Split(relative, string(filepath.Separator))) > 5 { + return errors.New("provider credential tree path refused") + } + if path == root { + if !entry.IsDir() { + return errors.New("provider credential root is not a directory") + } + return nil + } + info, err := entry.Info() + if err != nil { + return err + } + if info.IsDir() { + return nil + } + stat, ok := info.Sys().(*syscall.Stat_t) + if !ok || !info.Mode().IsRegular() || info.Mode().Perm() != 0600 || stat.Nlink != 1 { + return errors.New("provider credential tree type refused") + } + if root == roots[0] && filepath.Dir(path) == root && info.Size() == 0 && strings.HasPrefix(entry.Name(), ".") && strings.HasSuffix(entry.Name(), ".json.lock") { + return nil + } + count++ + return nil + }) + if err != nil { + return 0, err + } + } + return count, nil +} + +func protectedAuthorityStore(stateDir string) (*authority.Store, error) { + if err := validateAuthorityStateDir(stateDir); err != nil { + return nil, boundedAdminError("protected authority state refused") + } + if err := protectedPath(stateDir, true, 0700); err != nil { + return nil, boundedAdminError("protected authority state refused") + } + if err := protectedPath(filepath.Join(stateDir, authorityAdminFileName), false, 0600); err != nil { + return nil, boundedAdminError("protected authority administration refused") + } + store, err := authority.Open(stateDir) + if err != nil { + return nil, boundedAdminError("protected authority state refused") + } + return store, nil +} + +func protectedPath(path string, directory bool, maximum os.FileMode) error { + if !filepath.IsAbs(path) { + return errors.New("path must be absolute") + } + clean := filepath.Clean(path) + current := string(filepath.Separator) + parts := strings.Split(strings.TrimPrefix(clean, string(filepath.Separator)), string(filepath.Separator)) + for index, part := range parts { + current = filepath.Join(current, part) + info, err := os.Lstat(current) + if err != nil { + return err + } + if info.Mode()&os.ModeSymlink != 0 { + return errors.New("symlink path refused") + } + if index == len(parts)-1 { + stat, ok := info.Sys().(*syscall.Stat_t) + if !ok || directory != info.IsDir() || info.Mode().Perm() != maximum || stat.Uid != uint32(os.Geteuid()) || (!directory && (!info.Mode().IsRegular() || stat.Nlink != 1)) { + return errors.New("path ownership, type, link count, or mode refused") + } + } + } + return nil +} + +func protectedDestination(path string) (string, error) { + if !filepath.IsAbs(path) || filepath.Clean(path) != path { + return "", boundedAdminError("protected key destination refused") + } + if _, err := os.Lstat(path); !errors.Is(err, os.ErrNotExist) { + return "", boundedAdminError("protected key destination occupied") + } + parent := filepath.Dir(path) + if err := protectedPath(parent, true, 0700); err != nil { + return "", boundedAdminError("protected key destination refused") + } + return parent, nil +} + +func writeProtectedKey(path, key string) error { + parent, err := protectedDestination(path) + if err != nil { + return err + } + file, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_EXCL|syscall.O_NOFOLLOW, 0600) + if err != nil { + return boundedAdminError("protected key creation failed") + } + ok := false + defer func() { + file.Close() + if !ok { + os.Remove(path) + } + }() + if _, err := file.WriteString(key + "\n"); err != nil { + return boundedAdminError("protected key creation failed") + } + if err := file.Sync(); err != nil || file.Close() != nil { + return boundedAdminError("protected key creation failed") + } + directory, err := os.Open(parent) + if err != nil { + return boundedAdminError("protected key creation failed") + } + defer directory.Close() + if err := directory.Sync(); err != nil { + return boundedAdminError("protected key creation failed") + } + ok = true + return nil +} + +func localAuthorityOrigin(raw string) (*url.URL, error) { + parsed, err := url.Parse(strings.TrimSpace(raw)) + if err != nil || parsed.Scheme != "http" || parsed.User != nil || parsed.Host == "" || parsed.Path != "" || parsed.RawQuery != "" || parsed.Fragment != "" { + return nil, boundedAdminError("loopback authority origin refused") + } + host := parsed.Hostname() + ip := net.ParseIP(host) + if host != "localhost" && (ip == nil || !ip.IsLoopback()) { + return nil, boundedAdminError("loopback authority origin refused") + } + return parsed, nil +} + +func quietFlags(name string) *flag.FlagSet { + flags := flag.NewFlagSet(name, flag.ContinueOnError) + flags.SetOutput(io.Discard) + return flags +} + +func boundedAdminError(class string) error { + return errors.New(class) +} + +func ensureAuthorityAdminFile(path string) error { + if !filepath.IsAbs(path) { + return errors.New("authority admin file must be absolute") + } + return protectedPath(path, false, 0600) +} diff --git a/cmd/subrouter/authority_routes_test.go b/cmd/subrouter/authority_routes_test.go new file mode 100644 index 0000000..6c6f1f1 --- /dev/null +++ b/cmd/subrouter/authority_routes_test.go @@ -0,0 +1,487 @@ +package main + +import ( + "context" + "errors" + "io" + "os" + "path/filepath" + "strings" + "testing" + "time" + + "net/http/httptest" + + "github.com/manaflow-ai/subrouter/internal/accounts" + agentclaude "github.com/manaflow-ai/subrouter/internal/agents/claude" + "github.com/manaflow-ai/subrouter/internal/authority" + "github.com/manaflow-ai/subrouter/internal/proxy" +) + +func TestAuthorityCodexLoginStatusRepairAndRedaction(t *testing.T) { + stateDir := protectedTestState(t) + lease, err := accounts.AcquireStoreLease(stateDir) + if err != nil { + t.Fatal(err) + } + defer lease.Close() + original := runAuthorityCodexLogin + defer func() { runAuthorityCodexLogin = original }() + runAuthorityCodexLogin = func(context.Context, string, io.Reader, io.Writer, io.Writer) (accounts.CodexAuthFile, error) { + return testCodexAuth("zync2@example.com", "acct_zync2"), nil + } + login := captureStdout(t, func() error { + return authorityAccountLogin([]string{"--state-dir", stateDir, "--provider", "codex", "--account-id", "zync2", "--device-auth"}, false) + }) + if login != "Authority account login: complete\n" { + t.Fatalf("login output = %q", login) + } + store := authorityCodexStore(stateDir) + stored, ok, err := authorityCodexByLabel(store, "zync2") + if err != nil || !ok { + t.Fatalf("stored account unavailable: ok=%v err=%v", ok, err) + } + if stored.Label != "zync2" || stored.Email != "zync2@example.com" { + t.Fatalf("stored identity mismatch: label=%q email=%q", stored.Label, stored.Email) + } + generation, err := accounts.RefreshCredentialGeneration(store.Dir, stored.Email) + if err != nil || generation != 1 { + t.Fatalf("generation = %d err=%v, want 1", generation, err) + } + status := captureStdout(t, func() error { + return authorityAccountStatus([]string{"--state-dir", stateDir, "--provider", "codex", "--account-id", "zync2"}) + }) + for _, required := range []string{"Authority account: zync2", "Provider: codex", "Credential generation: 1", "Unresolved refresh: no", "Account state: ready"} { + if !strings.Contains(status, required) { + t.Fatalf("status missing %q: %q", required, status) + } + } + for _, forbidden := range []string{"zync2@example.com", "acct_zync2", "access-", "refresh-", "auth.json", stateDir} { + if strings.Contains(status, forbidden) { + t.Fatalf("status exposed protected identity/material %q", forbidden) + } + } + if err := authorityAccountLogin([]string{"--state-dir", stateDir, "--provider", "codex", "--account-id", "zync2", "--device-auth"}, false); err == nil { + t.Fatal("existing authority account login was accepted") + } + if err := authorityAccountLogin([]string{"--state-dir", stateDir, "--provider", "codex", "--account-id", "zync2", "--device-auth"}, true); err != nil { + t.Fatalf("repair failed: %v", err) + } + generation, err = accounts.RefreshCredentialGeneration(store.Dir, stored.Email) + if err != nil || generation != 2 { + t.Fatalf("generation after repair = %d err=%v, want 2", generation, err) + } +} + +func TestAuthorityCodexLoginFailureAndRepairIdentityMismatchDoNotPersistReplacement(t *testing.T) { + stateDir := protectedTestState(t) + lease, err := accounts.AcquireStoreLease(stateDir) + if err != nil { + t.Fatal(err) + } + defer lease.Close() + original := runAuthorityCodexLogin + defer func() { runAuthorityCodexLogin = original }() + runAuthorityCodexLogin = func(context.Context, string, io.Reader, io.Writer, io.Writer) (accounts.CodexAuthFile, error) { + return accounts.CodexAuthFile{}, errors.New("synthetic cancelled login") + } + if err := authorityAccountLogin([]string{"--state-dir", stateDir, "--provider", "codex", "--account-id", "zync2", "--device-auth"}, false); err == nil { + t.Fatal("failed login was accepted") + } + if _, ok, err := authorityCodexByLabel(authorityCodexStore(stateDir), "zync2"); err != nil || ok { + t.Fatalf("failed login persisted account: ok=%v err=%v", ok, err) + } + runAuthorityCodexLogin = func(context.Context, string, io.Reader, io.Writer, io.Writer) (accounts.CodexAuthFile, error) { + return testCodexAuth("zync2@example.com", "acct_zync2"), nil + } + if err := authorityAccountLogin([]string{"--state-dir", stateDir, "--provider", "codex", "--account-id", "zync2", "--device-auth"}, false); err != nil { + t.Fatal(err) + } + store := authorityCodexStore(stateDir) + stored, _, _ := authorityCodexByLabel(store, "zync2") + before, err := accounts.RefreshCredentialGeneration(store.Dir, stored.Email) + if err != nil { + t.Fatal(err) + } + runAuthorityCodexLogin = func(context.Context, string, io.Reader, io.Writer, io.Writer) (accounts.CodexAuthFile, error) { + return testCodexAuth("other@example.com", "acct_other"), nil + } + if err := authorityAccountLogin([]string{"--state-dir", stateDir, "--provider", "codex", "--account-id", "zync2", "--device-auth"}, true); err == nil { + t.Fatal("repair identity mismatch was accepted") + } + after, err := accounts.RefreshCredentialGeneration(store.Dir, stored.Email) + if err != nil || after != before { + t.Fatalf("mismatched repair changed generation: before=%d after=%d err=%v", before, after, err) + } +} + + +func TestAuthorityClaudeLoginStatusRepairRemovalAndRedaction(t *testing.T) { + stateDir := protectedTestState(t) + lease, err := accounts.AcquireStoreLease(stateDir) + if err != nil { + t.Fatal(err) + } + defer lease.Close() + original := runAuthorityClaudeLogin + defer func() { runAuthorityClaudeLogin = original }() + identity := authorityClaudeProviderIdentity("fixture-claude@example.invalid", "org_fixture") + runAuthorityClaudeLogin = func(context.Context, string, string, io.Reader, io.Writer, io.Writer) (authorityClaudeLoginResult, error) { + return authorityClaudeLoginResult{ + Credential: agentclaude.CredentialInfo{ + AccessToken: "synthetic-claude-access-1", RefreshToken: "synthetic-claude-refresh-1", ExpiresAt: time.Now().Add(time.Hour).UnixMilli(), + }, + IdentityFingerprint: identity, + }, nil + } + login := captureStdout(t, func() error { + return authorityAccountLogin([]string{"--state-dir", stateDir, "--provider", "claude", "--account-id", "fixture-claude"}, false) + }) + if login != "Authority account login: complete\n" { + t.Fatalf("login output = %q", login) + } + store := authorityClaudeStore(stateDir) + if _, ok := store.FindProfile("fixture-claude"); !ok { + t.Fatal("Claude authority profile missing after login") + } + if got, err := accounts.RefreshCredentialGeneration(store.Dir, "fixture-claude"); err != nil || got != 1 { + t.Fatalf("generation = %d err=%v, want 1", got, err) + } + status := captureStdout(t, func() error { + return authorityAccountStatus([]string{"--state-dir", stateDir, "--provider", "claude", "--account-id", "fixture-claude"}) + }) + for _, required := range []string{"Authority account: fixture-claude", "Provider: claude", "Credential generation: 1", "Unresolved refresh: no", "Account state: ready"} { + if !strings.Contains(status, required) { + t.Fatalf("status missing %q: %q", required, status) + } + } + for _, forbidden := range []string{"fixture-claude@example.invalid", "org_fixture", "synthetic-claude-access", "synthetic-claude-refresh", stateDir} { + if strings.Contains(status, forbidden) { + t.Fatalf("status exposed protected identity/material %q", forbidden) + } + } + if err := authorityAccountLogin([]string{"--state-dir", stateDir, "--provider", "claude", "--account-id", "fixture-claude", "--device-auth"}, true); err == nil { + t.Fatal("Claude device-auth flag was unexpectedly accepted") + } + runAuthorityClaudeLogin = func(context.Context, string, string, io.Reader, io.Writer, io.Writer) (authorityClaudeLoginResult, error) { + return authorityClaudeLoginResult{ + Credential: agentclaude.CredentialInfo{ + AccessToken: "synthetic-claude-access-2", RefreshToken: "synthetic-claude-refresh-2", ExpiresAt: time.Now().Add(time.Hour).UnixMilli(), + }, + IdentityFingerprint: identity, + }, nil + } + if err := authorityAccountLogin([]string{"--state-dir", stateDir, "--provider", "claude", "--account-id", "fixture-claude"}, true); err != nil { + t.Fatalf("Claude repair failed: %v", err) + } + if got, err := accounts.RefreshCredentialGeneration(store.Dir, "fixture-claude"); err != nil || got != 2 { + t.Fatalf("generation after repair = %d err=%v, want 2", got, err) + } + before, _ := accounts.RefreshCredentialGeneration(store.Dir, "fixture-claude") + runAuthorityClaudeLogin = func(context.Context, string, string, io.Reader, io.Writer, io.Writer) (authorityClaudeLoginResult, error) { + return authorityClaudeLoginResult{ + Credential: agentclaude.CredentialInfo{AccessToken: "other-access", RefreshToken: "other-refresh", ExpiresAt: time.Now().Add(time.Hour).UnixMilli()}, + IdentityFingerprint: authorityClaudeProviderIdentity("other@example.invalid", "org_other"), + }, nil + } + if err := authorityAccountLogin([]string{"--state-dir", stateDir, "--provider", "claude", "--account-id", "fixture-claude"}, true); err == nil { + t.Fatal("Claude repair identity mismatch was accepted") + } + after, _ := accounts.RefreshCredentialGeneration(store.Dir, "fixture-claude") + if after != before { + t.Fatalf("mismatched Claude repair changed generation: before=%d after=%d", before, after) + } + removed := captureStdout(t, func() error { + return authorityAccountRemove([]string{"--state-dir", stateDir, "--provider", "claude", "--account-id", "fixture-claude"}) + }) + if removed != "Authority account: removed\n" { + t.Fatalf("remove output = %q", removed) + } + if _, ok := store.FindProfile("fixture-claude"); ok { + t.Fatal("Claude authority profile remained after removal") + } + if _, err := os.Stat(authorityClaudeIdentityPath(stateDir, "fixture-claude")); !errors.Is(err, os.ErrNotExist) { + t.Fatalf("Claude identity metadata remained after removal: %v", err) + } +} + +func TestAuthorityClaudeFailedLoginDoesNotPersist(t *testing.T) { + stateDir := protectedTestState(t) + lease, err := accounts.AcquireStoreLease(stateDir) + if err != nil { + t.Fatal(err) + } + defer lease.Close() + original := runAuthorityClaudeLogin + defer func() { runAuthorityClaudeLogin = original }() + runAuthorityClaudeLogin = func(context.Context, string, string, io.Reader, io.Writer, io.Writer) (authorityClaudeLoginResult, error) { + return authorityClaudeLoginResult{}, errors.New("synthetic cancelled login") + } + if err := authorityAccountLogin([]string{"--state-dir", stateDir, "--provider", "claude", "--account-id", "fixture-claude"}, false); err == nil { + t.Fatal("failed Claude login was accepted") + } + if _, ok := authorityClaudeStore(stateDir).FindProfile("fixture-claude"); ok { + t.Fatal("failed Claude login persisted a profile") + } +} + +func TestAuthorityRouteAndGrantIdentifiersWriteOnlyToProtectedFiles(t *testing.T) { + stateDir := protectedTestState(t) + idDir := filepath.Join(t.TempDir(), "ids") + if err := os.Mkdir(idDir, 0700); err != nil { + t.Fatal(err) + } + routeFile := filepath.Join(idDir, "route.id") + output := captureStdout(t, func() error { + return authorityRouteCreate([]string{ + "--state-dir", stateDir, "--tenant-id", authority.NewID(), "--provider", "codex", + "--account-id", "zync2", "--enabled", "--route-id-file", routeFile, + }) + }) + if output != "Authority route: created\n" { + t.Fatalf("route output = %q", output) + } + routeID := strings.TrimSpace(string(mustReadFile(t, routeFile))) + if routeID == "" || strings.Contains(output, routeID) { + t.Fatal("route identifier missing from file or leaked to stdout") + } + keyFile := filepath.Join(idDir, "proxy.key") + grantFile := filepath.Join(idDir, "grant.id") + expires := time.Now().Add(time.Hour).UTC().Format(time.RFC3339) + output = captureStdout(t, func() error { + return authorityGrantCreate([]string{ + "--state-dir", stateDir, "--route-id", routeID, "--audience", "workstation", + "--expires-at", expires, "--proxy-key-file", keyFile, "--grant-id-file", grantFile, + }) + }) + grantID := strings.TrimSpace(string(mustReadFile(t, grantFile))) + key := strings.TrimSpace(string(mustReadFile(t, keyFile))) + if output != "Proxy grant: created\n" || grantID == "" || key == "" || strings.Contains(output, grantID) || strings.Contains(output, key) { + t.Fatal("grant output leaked protected identifiers or key") + } + for _, path := range []string{routeFile, grantFile, keyFile} { + info, err := os.Stat(path) + if err != nil || info.Mode().Perm() != 0600 { + t.Fatalf("protected file %s mode/error = %v %v", path, info, err) + } + } +} + +func TestAuthorityRouteAndGrantRemoveReturnCountsToZero(t *testing.T) { + stateDir := protectedTestState(t) + idDir := filepath.Join(t.TempDir(), "ids") + if err := os.Mkdir(idDir, 0700); err != nil { + t.Fatal(err) + } + routeFile := filepath.Join(idDir, "route.id") + if err := authorityRouteCreate([]string{ + "--state-dir", stateDir, "--tenant-id", authority.NewID(), "--provider", "codex", + "--account-id", "cleanup-fixture", "--enabled", "--route-id-file", routeFile, + }); err != nil { + t.Fatal(err) + } + routeID := strings.TrimSpace(string(mustReadFile(t, routeFile))) + grantFile := filepath.Join(idDir, "grant.id") + keyFile := filepath.Join(idDir, "proxy.key") + if err := authorityGrantCreate([]string{ + "--state-dir", stateDir, "--route-id", routeID, "--audience", "buildbox-run", + "--expires-at", time.Now().Add(time.Hour).UTC().Format(time.RFC3339), + "--proxy-key-file", keyFile, "--grant-id-file", grantFile, + }); err != nil { + t.Fatal(err) + } + grantID := strings.TrimSpace(string(mustReadFile(t, grantFile))) + secondKey := filepath.Join(idDir, "proxy-second.key") + if err := authorityGrantCreate([]string{ + "--state-dir", stateDir, "--route-id", routeID, "--audience", "buildbox-run", + "--expires-at", time.Now().Add(time.Hour).UTC().Format(time.RFC3339), + "--proxy-key-file", secondKey, + }); err != nil { + t.Fatal(err) + } + grantOut := captureStdout(t, func() error { + return authorityGrantRemoveRoute([]string{"--state-dir", stateDir, "--route-id", routeID}) + }) + if grantOut != "Proxy route grants: removed\n" { + t.Fatalf("route grant remove output = %q", grantOut) + } + if err := authorityGrantRemove([]string{"--state-dir", stateDir, "--grant-id", grantID}); err == nil { + t.Fatal("grant remained after route-scoped grant cleanup") + } + routeOut := captureStdout(t, func() error { + return authorityRouteRemove([]string{"--state-dir", stateDir, "--route-id", routeID}) + }) + if routeOut != "Authority route: removed\n" { + t.Fatalf("route remove output = %q", routeOut) + } + store, err := authority.Open(stateDir) + if err != nil { + t.Fatal(err) + } + defer store.Close() + routes, grants, err := store.Counts() + if err != nil { + t.Fatal(err) + } + if routes != 0 || grants != 0 { + t.Fatalf("counts after cleanup = routes:%d grants:%d", routes, grants) + } + if err := authorityRouteRemove([]string{"--state-dir", stateDir, "--route-id", routeID}); err == nil { + t.Fatal("missing route removal unexpectedly succeeded") + } +} + +func mustReadFile(t *testing.T, path string) []byte { + t.Helper() + body, err := os.ReadFile(path) + if err != nil { + t.Fatal(err) + } + return body +} + +func TestAuthorityGrantFileIsProtectedAndNeverPrinted(t *testing.T) { + stateDir := protectedTestState(t) + store, err := authority.Open(stateDir) + if err != nil { + t.Fatal(err) + } + route := authority.Route{RouteID: authority.NewID(), TenantID: authority.NewID(), Provider: "codex", AccountID: authority.NewID()} + if err := store.CreateRoute(route); err != nil { + t.Fatal(err) + } + keyDir := filepath.Join(t.TempDir(), "keys") + if err := os.Mkdir(keyDir, 0700); err != nil { + t.Fatal(err) + } + keyPath := filepath.Join(keyDir, "proxy.key") + expiresAt := time.Now().Add(time.Hour).UTC().Format(time.RFC3339) + output := captureStdout(t, func() error { + return authorityGrantCreate([]string{ + "--state-dir", stateDir, + "--route-id", route.RouteID, + "--audience", "workstation", + "--expires-at", expiresAt, + "--proxy-key-file", keyPath, + }) + }) + info, err := os.Stat(keyPath) + if err != nil { + t.Fatal(err) + } + if info.Mode().Perm() != 0600 { + t.Fatalf("key mode = %o", info.Mode().Perm()) + } + key, err := os.ReadFile(keyPath) + if err != nil { + t.Fatal(err) + } + if strings.Contains(output, strings.TrimSpace(string(key))) || strings.Contains(output, keyPath) || strings.Contains(output, route.RouteID) { + t.Fatal("grant output exposed protected material") + } + if err := authorityGrantCreate([]string{ + "--state-dir", stateDir, "--route-id", route.RouteID, "--audience", "workstation", + "--expires-at", expiresAt, "--proxy-key-file", keyPath, + }); err == nil { + t.Fatal("occupied key destination accepted") + } +} + +func TestProviderCredentialCountIgnoresCodexLockMetadata(t *testing.T) { + stateDir := protectedTestState(t) + accountsDir := filepath.Join(stateDir, "providers", "codex", "accounts") + if err := os.MkdirAll(accountsDir, 0700); err != nil { + t.Fatal(err) + } + if err := os.WriteFile(filepath.Join(accountsDir, "..subrouter-migration-batch-control.json.lock"), nil, 0600); err != nil { + t.Fatal(err) + } + count, err := providerCredentialCount(stateDir) + if err != nil { + t.Fatal(err) + } + if count != 0 { + t.Fatalf("lock metadata counted as provider credential: %d", count) + } + if err := os.WriteFile(filepath.Join(accountsDir, "synthetic.json"), []byte("synthetic credential fixture\n"), 0600); err != nil { + t.Fatal(err) + } + count, err = providerCredentialCount(stateDir) + if err != nil { + t.Fatal(err) + } + if count != 1 { + t.Fatalf("provider credential count = %d, want 1", count) + } +} + +func TestAuthorityProofUsesCredentiallessHTTPFixtureAndCleansUp(t *testing.T) { + stateDir := protectedTestState(t) + store, err := authority.Open(stateDir) + if err != nil { + t.Fatal(err) + } + handler := authorityRestrictedHandler((proxy.Server{AuthorityRoutes: store}).Handler()) + server := httptest.NewServer(handler) + defer server.Close() + keyDir := filepath.Join(t.TempDir(), "proof") + if err := os.Mkdir(keyDir, 0700); err != nil { + t.Fatal(err) + } + keyPath := filepath.Join(keyDir, "fixture.key") + output := captureStdout(t, func() error { + return authorityProof([]string{"--state-dir", stateDir, "--origin", server.URL, "--proxy-key-file", keyPath}) + }) + expected := "Exact dark route: PASS\nProxy grant scope: PASS\nAdmin isolation: PASS\nProvider credentials: 0\n" + if output != expected { + t.Fatalf("proof output = %q", output) + } + if _, err := os.Stat(keyPath); !os.IsNotExist(err) { + t.Fatal("proof key was not removed") + } + if _, err := os.Stat(filepath.Join(stateDir, "authority-proof-accounts.json")); !os.IsNotExist(err) { + t.Fatal("synthetic unavailable account fixture was not removed") + } + routes, grants, err := store.Counts() + if err != nil { + t.Fatal(err) + } + if routes != 0 || grants != 0 { + t.Fatalf("fixture state remains: routes=%d grants=%d", routes, grants) + } +} + +func protectedTestState(t *testing.T) string { + t.Helper() + stateDir := filepath.Join(t.TempDir(), "state") + if err := os.Mkdir(stateDir, 0700); err != nil { + t.Fatal(err) + } + if err := os.WriteFile(filepath.Join(stateDir, authorityAdminFileName), []byte("synthetic-admin-marker\n"), 0600); err != nil { + t.Fatal(err) + } + return stateDir +} + +func captureStdout(t *testing.T, run func() error) string { + t.Helper() + reader, writer, err := os.Pipe() + if err != nil { + t.Fatal(err) + } + original := os.Stdout + os.Stdout = writer + runErr := run() + os.Stdout = original + if err := writer.Close(); err != nil { + t.Fatal(err) + } + body, err := io.ReadAll(reader) + if err != nil { + t.Fatal(err) + } + if runErr != nil { + t.Fatal(runErr) + } + return string(body) +} diff --git a/cmd/subrouter/authority_status.go b/cmd/subrouter/authority_status.go new file mode 100644 index 0000000..5359889 --- /dev/null +++ b/cmd/subrouter/authority_status.go @@ -0,0 +1,186 @@ +package main + +import ( + "context" + "errors" + "flag" + "fmt" + "io" + "net/http" + "os" + "path/filepath" + "strconv" + "strings" + + "github.com/manaflow-ai/subrouter/internal/accounts" + agentclaude "github.com/manaflow-ai/subrouter/internal/agents/claude" + "github.com/manaflow-ai/subrouter/internal/authority" +) + +var ( + authorityRevision = "29c7ebb306ac54739206f4752449e437047dd150" + authoritySourceDigest = "unknown" + authorityPatchDigest = "unknown" +) + +func authorityCodexStore(stateDir string) accounts.CodexStore { + return accounts.CodexStore{Dir: filepath.Join(stateDir, "providers", "codex", "accounts")} +} + +func authorityClaudeStore(stateDir string) agentclaude.Store { + return agentclaude.Store{Dir: filepath.Join(stateDir, "providers", "claude"), SharedStateDir: ""} +} + +func recoverAuthorityState(ctx context.Context, stateDir string) (classified, unresolved int, err error) { + codexStore := authorityCodexStore(stateDir) + claudeStore := authorityClaudeStore(stateDir) + codexBlocked, err := codexStore.RecoverStoredRefreshAttempts() + if err != nil { + return 0, 0, fmt.Errorf("recover Codex refresh attempts: %w", err) + } + claudeBlocked, err := claudeStore.RecoverRefreshAttempts(ctx) + if err != nil { + return 0, 0, fmt.Errorf("recover Claude refresh attempts: %w", err) + } + codexUnresolved, err := accounts.CountUnresolvedRefreshAttempts(codexStore.Dir) + if err != nil { + return 0, 0, fmt.Errorf("enumerate Codex refresh attempts: %w", err) + } + claudeUnresolved, err := accounts.CountUnresolvedRefreshAttempts(claudeStore.Dir) + if err != nil { + return 0, 0, fmt.Errorf("enumerate Claude refresh attempts: %w", err) + } + return codexBlocked + claudeBlocked, codexUnresolved + claudeUnresolved, nil +} + +func authorityStatus(args []string) error { + return authorityStatusTo(args, os.Stdout) +} + +func authorityStatusTo(args []string, output io.Writer) error { + flags := flag.NewFlagSet("authority-status", flag.ContinueOnError) + flags.SetOutput(io.Discard) + stateDir := flags.String("state-dir", "", "explicit authority state directory") + if err := flags.Parse(args); err != nil { + return err + } + if err := validateAuthorityStateDir(*stateDir); err != nil { + return err + } + return writeAuthorityStatus(*stateDir, output) +} + +func writeAuthorityStatus(stateDir string, output io.Writer) error { + leaseState, err := accounts.StoreLeaseState(stateDir) + if err != nil { + return err + } + codexStore := authorityCodexStore(stateDir) + claudeStore := authorityClaudeStore(stateDir) + codexAccounts, err := codexStore.ListStored() + if err != nil { + return fmt.Errorf("count provider credentials: %w", err) + } + claudeAccounts, err := claudeStore.ListAccounts(context.Background()) + if err != nil { + return fmt.Errorf("count provider credentials: %w", err) + } + codexAttempts, err := accounts.CountUnresolvedRefreshAttempts(codexStore.Dir) + if err != nil { + return fmt.Errorf("count unresolved attempts: %w", err) + } + claudeAttempts, err := accounts.CountUnresolvedRefreshAttempts(claudeStore.Dir) + if err != nil { + return fmt.Errorf("count unresolved attempts: %w", err) + } + sourceDigest := sanitizedDigest(authoritySourceDigest) + if sourceDigest == "unknown" { + sourceDigest = sanitizedDigest(os.Getenv("SUBROUTER_SOURCE_DIGEST")) + } + patchDigest := sanitizedDigest(authorityPatchDigest) + if patchDigest == "unknown" { + patchDigest = sanitizedDigest(os.Getenv("SUBROUTER_PATCH_DIGEST")) + } + serviceIdentity := strings.TrimSpace(os.Getenv("OVERDECK_SUBROUTER_SERVICE_IDENTITY")) + if serviceIdentity == "" { + serviceIdentity = "uid-" + strconv.Itoa(os.Getuid()) + } + if !safeStatusValue(serviceIdentity) { + serviceIdentity = "unknown" + } + gateway := "unavailable" + if leaseState == "held" && codexAttempts+claudeAttempts == 0 { + gateway = "ready" + } + routeStore, err := authority.Open(stateDir) + if err != nil { + return fmt.Errorf("count authority routes: %w", err) + } + defer routeStore.Close() + routeCount, grantCount, err := routeStore.Counts() + if err != nil { + return fmt.Errorf("count authority routes: %w", err) + } + _, err = fmt.Fprintf(output, + "Upstream revision: %s\nSource digest: %s\nPatch digest: %s\nService identity: %s\nStore lease: %s\nProvider credentials: %d\nAuthority routes: %d\nProxy grants: %d\nUnresolved attempts: %d\nGateway: %s\n", + authorityRevision, sourceDigest, patchDigest, serviceIdentity, leaseState, + len(codexAccounts)+len(claudeAccounts), routeCount, grantCount, codexAttempts+claudeAttempts, gateway, + ) + return err +} + +func authorityRestrictedHandler(existing http.Handler) http.Handler { + return http.HandlerFunc(func(response http.ResponseWriter, request *http.Request) { + switch request.URL.Path { + case "/_subrouter/health", "/_subrouter/ready": + if request.Method != http.MethodGet && request.Method != http.MethodHead { + http.Error(response, "method not allowed", http.StatusMethodNotAllowed) + return + } + existing.ServeHTTP(response, request) + default: + if strings.HasPrefix(request.URL.Path, "/r/") { + existing.ServeHTTP(response, request) + return + } + http.NotFound(response, request) + } + }) +} + +func validateAuthorityStateDir(path string) error { + if strings.TrimSpace(path) == "" { + return errors.New("authority mode requires --state-dir") + } + if !filepath.IsAbs(path) { + return errors.New("authority state directory must be absolute") + } + return nil +} + +func sanitizedDigest(value string) string { + value = strings.ToLower(strings.TrimSpace(value)) + if len(value) != 64 { + return "unknown" + } + for _, character := range value { + if !strings.ContainsRune("0123456789abcdef", character) { + return "unknown" + } + } + return value +} + +func safeStatusValue(value string) bool { + if value == "" || len(value) > 64 { + return false + } + for _, character := range value { + if !(character == '-' || character == '_' || character == '.' || + character >= 'a' && character <= 'z' || character >= 'A' && character <= 'Z' || + character >= '0' && character <= '9') { + return false + } + } + return true +} diff --git a/cmd/subrouter/authority_status_test.go b/cmd/subrouter/authority_status_test.go new file mode 100644 index 0000000..d7b4401 --- /dev/null +++ b/cmd/subrouter/authority_status_test.go @@ -0,0 +1,196 @@ +package main + +import ( + "bytes" + "net/http" + "net/http/httptest" + "os" + "path/filepath" + "strings" + "testing" + + "github.com/manaflow-ai/subrouter/internal/accounts" +) + +func TestAuthorityStatusIsSanitizedAndCountsOnlyIsolatedStore(t *testing.T) { + stateDir := protectedStatusStateDir(t) + t.Setenv("SUBROUTER_SOURCE_DIGEST", strings.Repeat("a", 64)) + t.Setenv("SUBROUTER_PATCH_DIGEST", strings.Repeat("b", 64)) + t.Setenv("OVERDECK_SUBROUTER_SERVICE_IDENTITY", "overdeck-subrouter") + secret := "fixture-status-secret-never-print" + account := accounts.StoredCodexAccount{ + Email: "private-owner-label@example.invalid", + Auth: accounts.CodexAuthFile{Tokens: &accounts.CodexTokens{ + AccessToken: secret + "-access", RefreshToken: secret + "-refresh", IDToken: secret + "-id", + }}, + } + if err := authorityCodexStore(stateDir).SaveStored(account); err != nil { + t.Fatal(err) + } + var output bytes.Buffer + if err := authorityStatusTo([]string{"--state-dir", stateDir}, &output); err != nil { + t.Fatal(err) + } + got := output.String() + for _, forbidden := range []string{secret, account.Email, stateDir, "Authorization", "access_token", "refresh_token"} { + if strings.Contains(got, forbidden) { + t.Fatalf("status exposed forbidden value %q: %s", forbidden, got) + } + } + for _, required := range []string{ + "Upstream revision: " + authorityRevision, + "Source digest: " + strings.Repeat("a", 64), + "Patch digest: " + strings.Repeat("b", 64), + "Service identity: overdeck-subrouter", + "Store lease: available", + "Provider credentials: 1", + "Authority routes: 0", + "Proxy grants: 0", + "Unresolved attempts: 0", + "Gateway: unavailable", + } { + if !strings.Contains(got, required) { + t.Fatalf("status missing %q: %s", required, got) + } + } +} + +func TestAuthorityStatusReportsHeldLeaseAndUnresolvedCount(t *testing.T) { + stateDir := protectedStatusStateDir(t) + lease, err := accounts.AcquireStoreLease(stateDir) + if err != nil { + t.Fatal(err) + } + defer lease.Close() + if _, err := accounts.PrepareRefresh(authorityCodexStore(stateDir).Dir, "fixture", "synthetic-refresh"); err != nil { + t.Fatal(err) + } + var output bytes.Buffer + if err := authorityStatusTo([]string{"--state-dir", stateDir}, &output); err != nil { + t.Fatal(err) + } + if !strings.Contains(output.String(), "Store lease: held") || + !strings.Contains(output.String(), "Unresolved attempts: 1") || + !strings.Contains(output.String(), "Gateway: unavailable") { + t.Fatalf("status = %s", output.String()) + } +} + +func TestAuthorityHandlerExposesOnlyHealthAndReadiness(t *testing.T) { + base := http.HandlerFunc(func(response http.ResponseWriter, request *http.Request) { + response.WriteHeader(http.StatusOK) + _, _ = response.Write([]byte(request.URL.Path)) + }) + handler := authorityRestrictedHandler(base) + for _, path := range []string{"/_subrouter/health", "/_subrouter/ready"} { + for _, method := range []string{http.MethodGet, http.MethodHead} { + response := httptest.NewRecorder() + handler.ServeHTTP(response, httptest.NewRequest(method, path, nil)) + if response.Code != http.StatusOK { + t.Fatalf("allowed %s %s returned %d", method, path, response.Code) + } + } + for _, method := range []string{http.MethodPost, http.MethodPut, http.MethodDelete, http.MethodPatch} { + response := httptest.NewRecorder() + handler.ServeHTTP(response, httptest.NewRequest(method, path, nil)) + if response.Code != http.StatusMethodNotAllowed { + t.Fatalf("wrong method %s %s returned %d", method, path, response.Code) + } + } + } + routeResponse := httptest.NewRecorder() + handler.ServeHTTP(routeResponse, httptest.NewRequest(http.MethodPost, "/r/synthetic-route/v1/messages", nil)) + if routeResponse.Code != http.StatusOK { + t.Fatalf("exact route was blocked by authority wrapper: %d", routeResponse.Code) + } + for _, path := range []string{ + "/", "/v1/responses", "/v1/messages", "/_subrouter/authority-status", + "/_subrouter/accounts", "/_subrouter/whoami", "/_subrouter/import", + "/_subrouter/sessions", "/_subrouter/drain", "/_subrouter/tenants", + "/_subrouter/streams", "/tenant/example", "/api/admin", + } { + for _, method := range []string{http.MethodGet, http.MethodHead, http.MethodPost} { + response := httptest.NewRecorder() + handler.ServeHTTP(response, httptest.NewRequest(method, path, strings.NewReader("synthetic"))) + if response.Code != http.StatusNotFound { + t.Fatalf("forbidden %s %s returned %d", method, path, response.Code) + } + } + } +} + +func TestAuthorityRecoveryCountsOrphanMarkerWithoutProviderCall(t *testing.T) { + stateDir := protectedStatusStateDir(t) + if _, err := accounts.PrepareRefresh(authorityCodexStore(stateDir).Dir, "orphan", "synthetic-orphan-refresh"); err != nil { + t.Fatal(err) + } + classified, unresolved, err := recoverAuthorityState(t.Context(), stateDir) + if err != nil { + t.Fatal(err) + } + if classified != 0 || unresolved != 1 { + t.Fatalf("classified=%d unresolved=%d, want 0/1", classified, unresolved) + } +} + +func TestAuthorityServeRejectsCompetingStoreOwner(t *testing.T) { + stateDir := protectedStatusStateDir(t) + lease, err := accounts.AcquireStoreLease(stateDir) + if err != nil { + t.Fatal(err) + } + defer lease.Close() + adminFile := filepath.Join(stateDir, authorityAdminFileName) + if err := os.WriteFile(adminFile, []byte("synthetic\n"), 0600); err != nil { + t.Fatal(err) + } + if err := serve([]string{"--authority-mode", "--state-dir", stateDir, "--authority-admin-file", adminFile, "--addr", "127.0.0.1:0"}); err == nil || !strings.Contains(err.Error(), "already owned") { + t.Fatalf("competing authority error = %v", err) + } +} + +func TestAuthorityStatusRequiresLocalStateDir(t *testing.T) { + for _, args := range [][]string{nil, {"--url", "http://127.0.0.1:31415"}} { + if err := authorityStatusTo(args, &bytes.Buffer{}); err == nil { + t.Fatalf("authority-status args %v unexpectedly accepted", args) + } + } +} + +func TestAuthorityStateRequiresExplicitAbsolutePath(t *testing.T) { + for _, path := range []string{"", "relative"} { + if err := validateAuthorityStateDir(path); err == nil { + t.Fatalf("path %q accepted", path) + } + } +} + +func protectedStatusStateDir(t *testing.T) string { + t.Helper() + dir := t.TempDir() + if err := os.Chmod(dir, 0700); err != nil { + t.Fatal(err) + } + return dir +} + +func TestAuthorityStoresDoNotDiscoverHome(t *testing.T) { + home := t.TempDir() + stateDir := protectedStatusStateDir(t) + t.Setenv("HOME", home) + sentinel := filepath.Join(home, ".codex", "accounts", "native.json") + if err := os.MkdirAll(filepath.Dir(sentinel), 0o700); err != nil { + t.Fatal(err) + } + if err := os.WriteFile(sentinel, []byte(`{"secret":"native"}`), 0o600); err != nil { + t.Fatal(err) + } + codex, err := authorityCodexStore(stateDir).ListStored() + if err != nil || len(codex) != 0 { + t.Fatalf("isolated Codex store discovered home: count=%d err=%v", len(codex), err) + } + claude, err := authorityClaudeStore(stateDir).ListAccounts(t.Context()) + if err != nil || len(claude) != 0 { + t.Fatalf("isolated Claude store discovered home: count=%d err=%v", len(claude), err) + } +} diff --git a/cmd/subrouter/main.go b/cmd/subrouter/main.go index e24a572..e730110 100644 --- a/cmd/subrouter/main.go +++ b/cmd/subrouter/main.go @@ -25,6 +25,7 @@ import ( awsconfig "github.com/aws/aws-sdk-go-v2/config" "github.com/manaflow-ai/subrouter/internal/accounts" agentclaude "github.com/manaflow-ai/subrouter/internal/agents/claude" + "github.com/manaflow-ai/subrouter/internal/authority" "github.com/manaflow-ai/subrouter/internal/broker" "github.com/manaflow-ai/subrouter/internal/proxy" "github.com/manaflow-ai/subrouter/internal/stackauth" @@ -153,6 +154,16 @@ func runForProgram(program string, args []string) error { return runListenerTransfer(args[1:]) case "probe": return probe(args[1:]) + case "authority-status": + return authorityStatus(args[1:]) + case "authority-account": + return authorityAccountCommand(args[1:]) + case "authority-route": + return authorityRouteCommand(args[1:]) + case "authority-grant": + return authorityGrantCommand(args[1:]) + case "authority-proof": + return authorityProof(args[1:]) case "accounts": return listAccounts() case "codex": @@ -277,6 +288,9 @@ func isDirectSRCommand(command string) bool { func serve(args []string) error { flags := flag.NewFlagSet("serve", flag.ContinueOnError) + authorityMode := flags.Bool("authority-mode", false, "run isolated single-writer credential authority") + authorityStateDir := flags.String("state-dir", "", "explicit authority state directory") + authorityAdminFile := flags.String("authority-admin-file", "", "protected local authority administration marker") addr := flags.String("addr", "127.0.0.1:31415", "listen address") upstreamRaw := flags.String("upstream", "", "force one upstream base URL for all accounts") codexUpstreamRaw := flags.String("codex-upstream", "https://chatgpt.com/backend-api/codex", "Codex subscription upstream base URL") @@ -284,7 +298,7 @@ func serve(args []string) error { claudeUpstreamRaw := flags.String("claude-upstream", "https://api.anthropic.com", "Claude subscription upstream base URL") kimiUpstreamRaw := flags.String("kimi-upstream", "https://api.kimi.com/coding/v1", "Kimi For Coding upstream base URL") zaiUpstreamRaw := flags.String("zai-upstream", "https://api.z.ai/api/coding/paas/v4", "Z.AI coding upstream base URL") - sessionPath := flags.String("sessions", session.DefaultStorePath(), "session assignment store") + sessionPath := flags.String("sessions", "", "session assignment store; defaults to the local store outside authority mode") transcriptDir := flags.String("transcripts", "", "directory for raw Subrouter transcript JSONL files") transcriptGCSURI := flags.String("transcript-gcs-uri", "", "optional gs:// bucket/prefix for background transcript sync") transcriptGCSSyncInterval := flags.Duration("transcript-gcs-sync-interval", 5*time.Minute, "interval for background transcript GCS sync; 0 disables") @@ -325,6 +339,52 @@ func serve(args []string) error { if err := flags.Parse(args); err != nil { return err } + var authorityLease *accounts.StoreLease + if *authorityMode { + if err := validateAuthorityStateDir(*authorityStateDir); err != nil { + return err + } + if *authorityAdminFile != filepath.Join(*authorityStateDir, authorityAdminFileName) || ensureAuthorityAdminFile(*authorityAdminFile) != nil { + return errors.New("authority mode requires the protected local administration marker") + } + host, _, err := net.SplitHostPort(*addr) + if err != nil { + return fmt.Errorf("authority listen address: %w", err) + } + ip := net.ParseIP(host) + if host != "localhost" && (ip == nil || !ip.IsLoopback()) { + return errors.New("authority mode requires a loopback listen address") + } + if strings.TrimSpace(*transcriptDir) != "" || strings.TrimSpace(*transcriptGCSURI) != "" || + *multiTenant || *tailscaleAuth || *bedrockEnable || strings.TrimSpace(*cloudConfigPath) != "" || + strings.TrimSpace(*accountImportToken) != "" { + return errors.New("authority mode disables transcripts, remote auth, cloud storage, Bedrock, tenants, and account import") + } + authorityLease, err = accounts.AcquireStoreLease(*authorityStateDir) + if err != nil { + return err + } + defer authorityLease.Close() + accounts.EnableAuthorityMode() + *sessionPath = filepath.Join(*authorityStateDir, "sessions.json") + *transcriptDir = "" + *transcriptGCSURI = "" + *transcriptGCSSyncInterval = 0 + *transcriptLocalRetention = 0 + *transcriptMaxLocalBytesRaw = "0" + srSwitchInterval = 0 + *fetchUsage = false + *accountImportToken = "" + *publicURL = "" + *stackProjectID = "" + *stackPublishableClientKey = "" + *stackTenantKeySecret = "" + *stackTenantDeleteToken = "" + *bedrockEnable = false + *fableBedrockPrimary = false + } else if strings.TrimSpace(*sessionPath) == "" { + *sessionPath = session.DefaultStorePath() + } if strings.TrimSpace(*transcriptGCSURI) != "" && strings.TrimSpace(*transcriptDir) == "" { return errors.New("--transcripts is required when --transcript-gcs-uri is set") } @@ -332,13 +392,18 @@ func serve(args []string) error { if err != nil { return fmt.Errorf("transcript-max-local-bytes: %w", err) } - *adminToken, err = secretValue(*adminToken, "SUBROUTER_ADMIN_TOKEN", "SUBROUTER_ADMIN_TOKEN_FILE") - if err != nil { - return err - } - *accountImportToken, err = secretValue(*accountImportToken, "SUBROUTER_ACCOUNT_IMPORT_TOKEN", "SUBROUTER_ACCOUNT_IMPORT_TOKEN_FILE") - if err != nil { - return err + if !*authorityMode { + *adminToken, err = secretValue(*adminToken, "SUBROUTER_ADMIN_TOKEN", "SUBROUTER_ADMIN_TOKEN_FILE") + if err != nil { + return err + } + *accountImportToken, err = secretValue(*accountImportToken, "SUBROUTER_ACCOUNT_IMPORT_TOKEN", "SUBROUTER_ACCOUNT_IMPORT_TOKEN_FILE") + if err != nil { + return err + } + } else { + *adminToken = "" + *accountImportToken = "" } if *publicURL == "" { *publicURL = strings.TrimSpace(os.Getenv("SUBROUTER_PUBLIC_URL")) @@ -355,21 +420,23 @@ func serve(args []string) error { if *stackPublishableClientKey == "" { *stackPublishableClientKey = strings.TrimSpace(os.Getenv("SUBROUTER_STACK_PUBLISHABLE_CLIENT_KEY")) } - *stackTenantKeySecret, err = secretValue( - *stackTenantKeySecret, - "SUBROUTER_STACK_TENANT_KEY_SECRET", - "SUBROUTER_STACK_TENANT_KEY_SECRET_FILE", - ) - if err != nil { - return err - } - *stackTenantDeleteToken, err = secretValue( - *stackTenantDeleteToken, - "SUBROUTER_STACK_TENANT_DELETE_TOKEN", - "SUBROUTER_STACK_TENANT_DELETE_TOKEN_FILE", - ) - if err != nil { - return err + if !*authorityMode { + *stackTenantKeySecret, err = secretValue( + *stackTenantKeySecret, + "SUBROUTER_STACK_TENANT_KEY_SECRET", + "SUBROUTER_STACK_TENANT_KEY_SECRET_FILE", + ) + if err != nil { + return err + } + *stackTenantDeleteToken, err = secretValue( + *stackTenantDeleteToken, + "SUBROUTER_STACK_TENANT_DELETE_TOKEN", + "SUBROUTER_STACK_TENANT_DELETE_TOKEN_FILE", + ) + if err != nil { + return err + } } stackLoginValues := []string{ *stackProjectID, @@ -391,6 +458,14 @@ func serve(args []string) error { if *stackTenantDeleteToken != "" && len(*stackTenantDeleteToken) < 32 { return errors.New("--stack-tenant-delete-token or SUBROUTER_STACK_TENANT_DELETE_TOKEN must be at least 32 bytes") } + if *authorityMode { + *publicURL = "" + *stackAPIURL = "" + *stackProjectID = "" + *stackPublishableClientKey = "" + *stackTenantKeySecret = "" + *stackTenantDeleteToken = "" + } *publicURL, err = normalizePublicSubrouterURL(*publicURL) if err != nil { return err @@ -425,9 +500,12 @@ func serve(args []string) error { return err } - cloudConfig, err := broker.LoadConfig(*cloudConfigPath) - if err != nil { - return fmt.Errorf("load cmux.com config: %w", err) + var cloudConfig broker.Config + if !*authorityMode { + cloudConfig, err = broker.LoadConfig(*cloudConfigPath) + if err != nil { + return fmt.Errorf("load cmux.com config: %w", err) + } } if strings.TrimSpace(*cloudBaseURL) != "" { cloudConfig.BaseURL = *cloudBaseURL @@ -453,9 +531,12 @@ func serve(args []string) error { return errors.New("team credential storage has no local proxy secret; run 'sr setup' to repair it") } localProxyToken := cloudServerProxyToken(cloudConfig) - configuredProxyToken, err := secretFromEnvironment("SUBROUTER_PROXY_TOKEN", "SUBROUTER_PROXY_TOKEN_FILE") - if err != nil { - return err + configuredProxyToken := "" + if !*authorityMode { + configuredProxyToken, err = secretFromEnvironment("SUBROUTER_PROXY_TOKEN", "SUBROUTER_PROXY_TOKEN_FILE") + if err != nil { + return err + } } if configuredProxyToken != "" { if localProxyToken != "" && localProxyToken != configuredProxyToken { @@ -463,11 +544,12 @@ func serve(args []string) error { } localProxyToken = configuredProxyToken } - fableAPIKey := strings.TrimSpace( - os.Getenv("SUBROUTER_CLAUDE_FABLE_API_KEY"), - ) - fableBedrockEnabled := *fableBedrockPrimary || - envTrue("SUBROUTER_FABLE_BEDROCK_PRIMARY") + fableAPIKey := "" + if !*authorityMode { + fableAPIKey = strings.TrimSpace(os.Getenv("SUBROUTER_CLAUDE_FABLE_API_KEY")) + } + fableBedrockEnabled := !*authorityMode && (*fableBedrockPrimary || + envTrue("SUBROUTER_FABLE_BEDROCK_PRIMARY")) if cloudConfig.TeamModeReady() && (*bedrockEnable || fableAPIKey != "" || fableBedrockEnabled) { return errors.New( @@ -485,8 +567,24 @@ func serve(args []string) error { return err } - codexStore := accounts.DefaultCodexStore() - claudeStore := agentclaude.DefaultStore() + var codexStore accounts.CodexStore + var claudeStore agentclaude.Store + if *authorityMode { + codexStore = authorityCodexStore(*authorityStateDir) + claudeStore = authorityClaudeStore(*authorityStateDir) + } else { + codexStore = accounts.DefaultCodexStore() + claudeStore = agentclaude.DefaultStore() + } + if *authorityMode { + classified, unresolved, recoverErr := recoverAuthorityState(context.Background(), *authorityStateDir) + if recoverErr != nil { + return recoverErr + } + if unresolved > 0 { + slog.Warn("authority has frozen credentials requiring fresh login", "unresolved_attempts", unresolved, "classified_accounts", classified) + } + } var accountRef *proxy.AccountRef var accountGeneration uint64 var codexAccounts, claudeAccounts []accounts.Account @@ -586,6 +684,15 @@ func serve(args []string) error { ) } + var authorityRoutes *authority.Store + if *authorityMode { + authorityRoutes, err = authority.Open(*authorityStateDir) + if err != nil { + return fmt.Errorf("open authority routes: %w", err) + } + defer authorityRoutes.Close() + } + server := proxy.Server{ StreamDrops: &proxy.StreamDropStats{}, Upstream: upstream, @@ -609,6 +716,7 @@ func serve(args []string) error { RequireSessionLease: *requireSessionLeases || envTrue("SUBROUTER_REQUIRE_SESSION_LEASES"), ForwardSessionHeaders: envTrue("SUBROUTER_FORWARD_SESSION_HEADERS"), LocalProxyToken: localProxyToken, + AuthorityRoutes: authorityRoutes, MaxBodyBytes: *maxBodyBytes, Bedrock: bedrockConfig, ClaudeFableAPIKey: fableAPIKey, @@ -654,7 +762,13 @@ func serve(args []string) error { ) } - tenantRegistry := tenant.NewRegistry(storepath.StateDir()) + var tenantStateDir string + if *authorityMode { + tenantStateDir = *authorityStateDir + } else { + tenantStateDir = storepath.StateDir() + } + tenantRegistry := tenant.NewRegistry(tenantStateDir) multiTenantHandler := &proxy.MultiTenant{ Base: server, Registry: tenantRegistry, @@ -689,9 +803,13 @@ func serve(args []string) error { "cutoff", cutoff.Format(time.RFC3339), ) } + handler := multiTenantHandler.Handler(server.Handler()) + if *authorityMode { + handler = authorityRestrictedHandler(handler) + } httpServer := &http.Server{ Addr: *addr, - Handler: multiTenantHandler.Handler(server.Handler()), + Handler: handler, ReadHeaderTimeout: 10 * time.Second, // Bound how long an idle client connection can pin this worker. The // supervisor's drain waits for a retired generation's connections to @@ -1366,7 +1484,9 @@ Usage: %[1]s spend Show AWS Bedrock spend tracked by the server %[1]s gemini Manage Gemini profiles - %[1]s serve [--addr 127.0.0.1:31415] [--fetch-usage=true] [--multi-tenant] [--codex-upstream URL] [--claude-upstream URL] [--kimi-upstream URL] [--zai-upstream URL] [--transcripts DIR] [--transcript-gcs-uri gs://bucket/prefix] [--transcript-gcs-sync-timeout 30m] [--transcript-local-retention 24h] [--transcript-max-local-bytes 2GiB] + %[1]s serve [--addr 127.0.0.1:31415] [--authority-mode --state-dir /absolute/path] [--fetch-usage=true] [--multi-tenant] [--codex-upstream URL] [--claude-upstream URL] [--kimi-upstream URL] [--zai-upstream URL] [--transcripts DIR] [--transcript-gcs-uri gs://bucket/prefix] [--transcript-gcs-sync-timeout 30m] [--transcript-local-retention 24h] [--transcript-max-local-bytes 2GiB] + %[1]s authority-status --state-dir /absolute/path + %[1]s authority-account login|repair|status|remove --state-dir /absolute/path --provider --account-id [--device-auth] %[1]s supervise --worker-bin PATH [--addr 127.0.0.1:31415] [--control-socket /var/run/subrouter-supervisor.sock] [--expect-proxy-protocol] [--drain-timeout 10m] [--worker-stop-grace 30s] -- [serve flags] %[1]s front --backend-id ID --backend-address ADDRESS [--backend-network tcp|unix] [--addr 127.0.0.1:31415] [--control-socket /var/run/subrouter-front.sock] [--listener-transfer-socket /var/run/subrouter-front-listener.sock] %[1]s probe [--url http://127.0.0.1:31415] diff --git a/internal/accounts/codex_auth.go b/internal/accounts/codex_auth.go index 49b9bb1..5aa6dc3 100644 --- a/internal/accounts/codex_auth.go +++ b/internal/accounts/codex_auth.go @@ -9,6 +9,7 @@ import ( "encoding/json" "errors" "fmt" + "io" "log/slog" "net/http" "os" @@ -20,6 +21,11 @@ import ( // that models the provider's rotate-on-use semantics. Nothing in production // reassigns it. var codexOAuthTokenURL = "https://auth.openai.com/oauth/token" +var authorityMode bool + +// EnableAuthorityMode disables native auth synchronization for an isolated store. +// It is process-wide and must be called before serving requests. +func EnableAuthorityMode() { authorityMode = true } const codexOAuthClientID = "app_EMoamEEZ73f0CkXaXp7hrann" const codexAuthBreadcrumbLimit = 50 @@ -130,6 +136,34 @@ func (s CodexStore) SyncActiveToStore() error { return nil } +// ReplaceStoredOAuthCredential is the authority-safe fresh-login/repair seam. +// It holds the account mutation lock through durable replacement, generation +// advance, and block removal. Callers must supply a newly authenticated chain; +// importing an old rotating credential remains unsupported. +func (s CodexStore) ReplaceStoredOAuthCredential(account StoredCodexAccount) (err error) { + if account.Auth.Tokens == nil || strings.TrimSpace(account.Auth.Tokens.AccessToken) == "" || + strings.TrimSpace(account.Auth.Tokens.RefreshToken) == "" || strings.TrimSpace(account.Auth.Tokens.IDToken) == "" { + return errors.New("fresh Codex OAuth credential is incomplete") + } + lock, err := s.lockStoredAccount(account.Email) + if err != nil { + return err + } + defer func() { + if closeErr := lock.Close(); err == nil { + err = closeErr + } + }() + if err := s.saveStoredUnlocked(account); err != nil { + return err + } + path := account.SourcePath(s) + if err := VerifyCredentialDurable(path); err != nil { + return err + } + return RecordFreshCredential(s.Dir, account.Email, account.Auth.Tokens.RefreshToken) +} + func (s CodexStore) ImportActive() (StoredCodexAccount, bool, error) { auth, ok, err := ReadActiveCodexAuth() if err != nil || !ok { @@ -155,7 +189,7 @@ func (s CodexStore) ImportActive() (StoredCodexAccount, bool, error) { previous := account account.Auth = auth appendCodexAuthBreadcrumb(context.Background(), s, &account, "active_auth_imported", "active_auth", false, &previous, &account, nil, nil) - err = s.SaveStored(account) + err = s.ReplaceStoredOAuthCredential(account) if err == nil { logCodexAuthStoreUpdated("codex oauth active auth imported", s, previous, account, "active_auth") } @@ -189,6 +223,41 @@ func (s CodexStore) AddAPIKey(label, key string) (StoredCodexAccount, bool, erro return account, existed, s.SaveStored(account) } +// RecoverStoredRefreshAttempts classifies durable markers before the authority +// publishes readiness. It never calls a provider. +func (s CodexStore) RecoverStoredRefreshAttempts() (int, error) { + stored, err := s.ListStored() + if err != nil { + return 0, err + } + blocked := 0 + for _, candidate := range stored { + if candidate.Auth.Tokens == nil || candidate.Auth.Tokens.RefreshToken == "" { + continue + } + lock, err := s.lockStoredAccount(candidate.Email) + if err != nil { + return blocked, err + } + latest, found, readErr := s.findStoredExact(candidate.Email) + if readErr == nil && found && latest.Auth.Tokens != nil { + var frozen bool + frozen, readErr = RecoverRefreshAttempt(s.Dir, latest.Email, latest.Auth.Tokens.RefreshToken) + if frozen { + blocked++ + } + } + closeErr := lock.Close() + if readErr != nil { + return blocked, readErr + } + if closeErr != nil { + return blocked, closeErr + } + } + return blocked, nil +} + func (s CodexStore) RefreshStoredIfExpired(ctx context.Context, client *http.Client, account StoredCodexAccount) (StoredCodexAccount, bool, error) { return s.refreshStored(ctx, client, account, false) } @@ -202,10 +271,6 @@ func (s CodexStore) refreshStored(ctx context.Context, client *http.Client, acco logCodexRefreshSkipped(ctx, s, account, force, "missing_tokens") return account, false, nil } - if !force && !IsJWTExpired(account.Auth.Tokens.AccessToken, 60*time.Second) { - logCodexRefreshSkipped(ctx, s, account, force, "access_token_fresh") - return account, false, nil - } if err := terminalStoredRefreshFailure(account); err != nil { logCodexRefreshSkipped(ctx, s, account, force, "terminal_refresh_failure") return account, false, err @@ -230,6 +295,16 @@ func (s CodexStore) refreshStored(ctx context.Context, client *http.Client, acco logCodexRefreshSkipped(ctx, s, account, force, "missing_tokens_after_lock") return account, false, nil } + frozen, err := RecoverRefreshAttempt(s.Dir, account.Email, account.Auth.Tokens.RefreshToken) + if err != nil { + logCodexRefreshFailed(ctx, s, account, force, err) + return account, false, err + } + if frozen { + err := &RefreshBlockedError{AccountFingerprint: boundedFingerprint(account.Email)} + logCodexRefreshFailed(ctx, s, account, force, err) + return account, false, err + } if !force && !IsJWTExpired(account.Auth.Tokens.AccessToken, 60*time.Second) { logCodexRefreshSkipped(ctx, s, account, force, "access_token_fresh_after_lock") return account, false, nil @@ -240,8 +315,19 @@ func (s CodexStore) refreshStored(ctx context.Context, client *http.Client, acco } previous := account + if err := PreflightCredential(account.SourcePath(s)); err != nil { + logCodexRefreshFailed(ctx, s, account, force, err) + return account, false, err + } + handle, err := PrepareRefresh(s.Dir, account.Email, account.Auth.Tokens.RefreshToken) + if err != nil { + logCodexRefreshFailed(ctx, s, account, force, err) + return account, false, err + } logCodexRefreshStart(ctx, s, previous, force) - auth, err := RefreshCodexAuth(ctx, client, account.Auth) + authorityCtx, cancelAuthority := AuthorityRefreshContext() + defer cancelAuthority() + auth, err := RefreshCodexAuth(authorityCtx, client, account.Auth) if err != nil { if recovered, ok := s.recoverRefreshedAccount(account); ok { appendCodexAuthBreadcrumb(ctx, s, &recovered, "refresh_recovered_concurrent_update", "oauth_refresh", force, &previous, nil, &recovered, err) @@ -264,10 +350,22 @@ func (s CodexStore) refreshStored(ctx context.Context, client *http.Client, acco auth.RefreshFailure = nil account.Auth = auth appendCodexAuthBreadcrumb(ctx, s, &account, "refresh_succeeded", "oauth_refresh", force, &previous, &account, nil, nil) + if err := BeforeCredentialCommit(); err != nil { + logCodexRefreshFailed(ctx, s, account, force, err) + return account, true, err + } if err := s.saveStoredUnlocked(account); err != nil { logCodexRefreshFailed(ctx, s, account, force, err) return account, true, err } + if err := VerifyCredentialDurable(account.SourcePath(s)); err != nil { + logCodexRefreshFailed(ctx, s, account, force, err) + return account, true, err + } + if err := CompleteRefresh(handle, account.Auth.Tokens.RefreshToken); err != nil { + logCodexRefreshFailed(ctx, s, account, force, err) + return account, true, err + } if err := syncActiveCodexAuthIfAccountActive(account); err != nil { logCodexRefreshFailed(ctx, s, account, force, err) return account, true, err @@ -373,6 +471,9 @@ func accountAuthNewerThanIncoming(stored, incoming CodexAuthFile) bool { } func syncActiveCodexAuthIfAccountActive(account StoredCodexAccount) error { + if authorityMode { + return nil + } activeEmail, ok, err := activeCodexAuthEmail() if err != nil || !ok || activeEmail != account.Email { return err @@ -432,9 +533,8 @@ func RefreshCodexAuth(ctx context.Context, client *http.Client, auth CodexAuthFi } defer res.Body.Close() if res.StatusCode < 200 || res.StatusCode >= 300 { - var buf bytes.Buffer - _, _ = buf.ReadFrom(res.Body) - return auth, newCodexAuthRefreshError(res.StatusCode, strings.TrimSpace(buf.String())) + body, _ := io.ReadAll(io.LimitReader(res.Body, 64<<10)) + return auth, newCodexAuthRefreshError(res.StatusCode, strings.TrimSpace(string(body))) } var refreshed struct { AccessToken string `json:"access_token"` @@ -468,17 +568,13 @@ func cloneCodexAuthFile(auth CodexAuthFile) CodexAuthFile { type CodexAuthRefreshError struct { StatusCode int - Body string ProviderType string ProviderCode string ProviderMessage string } func newCodexAuthRefreshError(statusCode int, body string) *CodexAuthRefreshError { - err := &CodexAuthRefreshError{ - StatusCode: statusCode, - Body: body, - } + err := &CodexAuthRefreshError{StatusCode: statusCode} var payload struct { Error struct { Message string `json:"message"` @@ -487,21 +583,47 @@ func newCodexAuthRefreshError(statusCode int, body string) *CodexAuthRefreshErro } `json:"error"` } if json.Unmarshal([]byte(body), &payload) == nil { - err.ProviderMessage = payload.Error.Message - err.ProviderType = payload.Error.Type - err.ProviderCode = payload.Error.Code + err.ProviderMessage = classifyCodexProviderMessage(payload.Error.Message) + err.ProviderType = boundedProviderIdentifier(payload.Error.Type) + err.ProviderCode = boundedProviderIdentifier(payload.Error.Code) } return err } +func boundedProviderIdentifier(value string) string { + value = strings.ToLower(strings.TrimSpace(value)) + if value == "" || len(value) > 64 { + return "" + } + for _, character := range value { + if !(character == '_' || character == '-' || character >= 'a' && character <= 'z' || character >= '0' && character <= '9') { + return "" + } + } + return value +} + +func classifyCodexProviderMessage(value string) string { + value = strings.ToLower(value) + switch { + case strings.Contains(value, "refresh token"): + return "refresh token rejected" + case strings.Contains(value, "logged out or signed in to another account") || + strings.Contains(value, "access token could not be refreshed because you have since"): + return "account changed; fresh login required" + default: + return "" + } +} + func (e *CodexAuthRefreshError) Error() string { if e == nil { return "" } - if strings.TrimSpace(e.Body) == "" { - return fmt.Sprintf("token refresh failed (%d)", e.StatusCode) + if e.ProviderCode != "" { + return fmt.Sprintf("token refresh failed (%d): %s", e.StatusCode, e.ProviderCode) } - return fmt.Sprintf("token refresh failed (%d): %s", e.StatusCode, e.Body) + return fmt.Sprintf("token refresh failed (%d)", e.StatusCode) } func logCodexRefreshStart(ctx context.Context, store CodexStore, account StoredCodexAccount, force bool) { diff --git a/internal/accounts/codex_auth_test.go b/internal/accounts/codex_auth_test.go index 3bd96df..92418cb 100644 --- a/internal/accounts/codex_auth_test.go +++ b/internal/accounts/codex_auth_test.go @@ -63,9 +63,9 @@ func TestRefreshStoredIfExpiredSerializesConcurrentRefresh(t *testing.T) { })} var wg sync.WaitGroup - errs := make(chan error, 2) - results := make(chan StoredCodexAccount, 2) - for i := 0; i < 2; i++ { + errs := make(chan error, 8) + results := make(chan StoredCodexAccount, 8) + for i := 0; i < 8; i++ { wg.Add(1) go func() { defer wg.Done() @@ -86,6 +86,9 @@ func TestRefreshStoredIfExpiredSerializesConcurrentRefresh(t *testing.T) { if calls.Load() != 1 { t.Fatalf("refresh calls = %d, want 1", calls.Load()) } + if generation, err := RefreshCredentialGeneration(store.Dir, stale.Email); err != nil || generation != 1 { + t.Fatalf("generation = %d, err=%v; want 1", generation, err) + } for got := range results { if got.Auth.Tokens.RefreshToken != "new-refresh" { t.Fatalf("refresh token = %q, want new-refresh", got.Auth.Tokens.RefreshToken) @@ -127,8 +130,9 @@ func TestRefreshStoredIfExpiredReturnsProviderRefreshError(t *testing.T) { t.Fatal(err) } + fixtureSecret := "synthetic-provider-body-secret" client := &http.Client{Transport: codexRoundTripFunc(func(*http.Request) (*http.Response, error) { - return jsonResponse(http.StatusUnauthorized, `{"error":{"message":"invalidated","type":"invalid_request_error","code":"refresh_token_invalidated"}}`), nil + return jsonResponse(http.StatusUnauthorized, `{"error":{"message":"`+fixtureSecret+`","type":"invalid_request_error","code":"refresh_token_invalidated"}}`), nil })} _, _, err := store.RefreshStoredIfExpired(context.Background(), client, stale) @@ -139,6 +143,9 @@ func TestRefreshStoredIfExpiredReturnsProviderRefreshError(t *testing.T) { if !errors.As(err, &refreshErr) { t.Fatalf("error type = %T, want CodexAuthRefreshError", err) } + if strings.Contains(err.Error(), fixtureSecret) || strings.Contains(refreshErr.ProviderMessage, fixtureSecret) { + t.Fatalf("provider response body leaked through refresh error: %v", err) + } if refreshErr.StatusCode != http.StatusUnauthorized || refreshErr.ProviderCode != "refresh_token_invalidated" || refreshErr.ProviderType != "invalid_request_error" { t.Fatalf("unexpected refresh error: %+v", refreshErr) } @@ -193,7 +200,7 @@ func TestRefreshStoredIfExpiredCachesTerminalRefreshError(t *testing.T) { } } -func TestRefreshStoredIfExpiredDoesNotCacheTransientRefreshError(t *testing.T) { +func TestRefreshStoredIfExpiredFreezesTransportAmbiguity(t *testing.T) { t.Setenv("HOME", t.TempDir()) store := CodexStore{Dir: t.TempDir()} stale := storedOAuthAccount("founders@example.com", "old", time.Now().Add(-time.Hour)) @@ -223,15 +230,156 @@ func TestRefreshStoredIfExpiredDoesNotCacheTransientRefreshError(t *testing.T) { t.Fatalf("unexpected cached refresh failure: %+v", stored.Auth.RefreshFailure) } - got, _, err := store.RefreshStoredIfExpired(context.Background(), client, stale) - if err != nil { + if _, _, err := store.RefreshStoredIfExpired(context.Background(), client, stale); err == nil { + t.Fatal("transport ambiguity did not freeze the old generation") + } else { + var blocked *RefreshBlockedError + if !errors.As(err, &blocked) { + t.Fatalf("second error = %T %v, want RefreshBlockedError", err, err) + } + } + if calls.Load() != 1 { + t.Fatalf("refresh calls = %d, want 1", calls.Load()) + } +} + +func TestRefreshStoredLostMalformedAndTerminalOutcomesNeverRetryGeneration(t *testing.T) { + cases := []struct { + name string + transport func(*http.Request) (*http.Response, error) + }{ + {"lost-response", func(*http.Request) (*http.Response, error) { return nil, errors.New("synthetic connection lost") }}, + {"malformed-success", func(*http.Request) (*http.Response, error) { + return jsonResponse(http.StatusOK, `{"access_token":`), nil + }}, + {"terminal", func(*http.Request) (*http.Response, error) { + return jsonResponse(http.StatusUnauthorized, `{"error":{"code":"refresh_token_rejected","message":"refresh token rejected"}}`), nil + }}, + } + for _, test := range cases { + t.Run(test.name, func(t *testing.T) { + store := CodexStore{Dir: t.TempDir()} + stale := storedOAuthAccount("fixture@example.invalid", "old", time.Now().Add(-time.Hour)) + if err := store.SaveStored(stale); err != nil { + t.Fatal(err) + } + var calls atomic.Int32 + client := &http.Client{Transport: codexRoundTripFunc(func(request *http.Request) (*http.Response, error) { + calls.Add(1) + return test.transport(request) + })} + if _, _, err := store.RefreshStoredIfExpired(context.Background(), client, stale); err == nil { + t.Fatal("first ambiguous/terminal outcome succeeded") + } + if _, _, err := store.RefreshStoredIfExpired(context.Background(), client, stale); err == nil { + t.Fatal("old generation retried") + } + if calls.Load() != 1 { + t.Fatalf("provider calls = %d, want 1", calls.Load()) + } + if unresolved, err := CountUnresolvedRefreshAttempts(store.Dir); err != nil || unresolved != 1 { + t.Fatalf("unresolved=%d err=%v", unresolved, err) + } + }) + } +} + +func TestReplaceStoredOAuthCredentialAdvancesGenerationAndClearsBlock(t *testing.T) { + store := CodexStore{Dir: t.TempDir()} + old := storedOAuthAccount("founders@example.com", "old", time.Now().Add(-time.Hour)) + if err := store.SaveStored(old); err != nil { + t.Fatal(err) + } + if _, err := PrepareRefresh(store.Dir, old.Email, old.Auth.Tokens.RefreshToken); err != nil { t.Fatal(err) } - if calls.Load() != 2 { - t.Fatalf("refresh calls = %d, want 2", calls.Load()) + fresh := storedOAuthAccount("founders@example.com", "fresh-login", time.Now().Add(time.Hour)) + if err := store.ReplaceStoredOAuthCredential(fresh); err != nil { + t.Fatalf("fresh replacement: %v", err) } - if got.Auth.Tokens.RefreshToken != "new-refresh" { - t.Fatalf("refresh token = %q, want new-refresh", got.Auth.Tokens.RefreshToken) + if frozen, err := RecoverRefreshAttempt(store.Dir, fresh.Email, fresh.Auth.Tokens.RefreshToken); err != nil || frozen { + t.Fatalf("fresh replacement remained blocked: frozen=%v err=%v", frozen, err) + } + if unresolved, err := CountUnresolvedRefreshAttempts(store.Dir); err != nil || unresolved != 0 { + t.Fatalf("unresolved attempts = %d, err=%v", unresolved, err) + } +} + +func TestRefreshStoredDurabilityFailureFreezesVisibleRotatedCredential(t *testing.T) { + store := CodexStore{Dir: t.TempDir()} + stale := storedOAuthAccount("founders@example.com", "old", time.Now().Add(-time.Hour)) + if err := store.SaveStored(stale); err != nil { + t.Fatal(err) + } + var calls atomic.Int32 + client := &http.Client{Transport: codexRoundTripFunc(func(*http.Request) (*http.Response, error) { + calls.Add(1) + return refreshResponse("new", "founders@example.com", time.Now().Add(time.Hour)), nil + })} + restore := SetRefreshFaultHooksForTest(RefreshFaultHooks{ + BeforeCredentialDurable: func(string) error { return errors.New("fixture parent fsync failure") }, + }) + _, _, err := store.RefreshStoredIfExpired(context.Background(), client, stale) + restore() + if err == nil || !strings.Contains(err.Error(), "fixture parent fsync failure") { + t.Fatalf("durability error = %v", err) + } + latest, ok, err := store.FindStored(stale.Email) + if err != nil || !ok { + t.Fatalf("visible rotated credential missing: ok=%v err=%v", ok, err) + } + if _, _, err := store.RefreshStoredIfExpired(context.Background(), client, latest); err == nil { + t.Fatal("visible but unproven credential bypassed unresolved marker") + } else { + var blocked *RefreshBlockedError + if !errors.As(err, &blocked) { + t.Fatalf("retry error = %T %v, want RefreshBlockedError", err, err) + } + } + if calls.Load() != 1 { + t.Fatalf("provider calls = %d, want 1", calls.Load()) + } + if unresolved, err := CountUnresolvedRefreshAttempts(store.Dir); err != nil || unresolved != 1 { + t.Fatalf("unresolved attempts = %d, err=%v", unresolved, err) + } +} + +func TestRefreshStoredIgnoresAllWaiterCancellationAfterSend(t *testing.T) { + store := CodexStore{Dir: t.TempDir()} + stale := storedOAuthAccount("founders@example.com", "old", time.Now().Add(-time.Hour)) + if err := store.SaveStored(stale); err != nil { + t.Fatal(err) + } + requestStarted := make(chan struct{}) + releaseResponse := make(chan struct{}) + var calls atomic.Int32 + client := &http.Client{Transport: codexRoundTripFunc(func(request *http.Request) (*http.Response, error) { + calls.Add(1) + close(requestStarted) + <-releaseResponse + if request.Context().Err() != nil { + return nil, request.Context().Err() + } + return refreshResponse("new", "founders@example.com", time.Now().Add(time.Hour)), nil + })} + callerCtx, cancelCaller := context.WithCancel(context.Background()) + result := make(chan error, 1) + go func() { + _, _, err := store.RefreshStoredIfExpired(callerCtx, client, stale) + result <- err + }() + <-requestStarted + cancelCaller() + close(releaseResponse) + if err := <-result; err != nil { + t.Fatalf("authority transaction inherited waiter cancellation: %v", err) + } + if calls.Load() != 1 { + t.Fatalf("provider calls = %d, want 1", calls.Load()) + } + stored, ok, err := store.FindStored(stale.Email) + if err != nil || !ok || stored.Auth.Tokens.RefreshToken != "new-refresh" { + t.Fatalf("durable rotated credential missing: ok=%v err=%v", ok, err) } } diff --git a/internal/accounts/refresh_attempt.go b/internal/accounts/refresh_attempt.go new file mode 100644 index 0000000..e4b59ca --- /dev/null +++ b/internal/accounts/refresh_attempt.go @@ -0,0 +1,461 @@ +package accounts + +import ( + "context" + "crypto/rand" + "crypto/sha256" + "encoding/hex" + "encoding/json" + "errors" + "fmt" + "os" + "path/filepath" + "strings" + "time" +) + +const ( + refreshAttemptState = "prepared" + refreshTimeout = 30 * time.Second + preflightBytes = 64 << 10 +) + +// RefreshAttempt is deliberately metadata-only durable recovery evidence. It +// must never contain an OAuth body, Authorization value, or token bytes. +type RefreshAttempt struct { + AttemptID string `json:"attempt_id"` + AccountFingerprint string `json:"account_fingerprint"` + CredentialGeneration uint64 `json:"credential_generation"` + RefreshFingerprintBefore string `json:"refresh_fingerprint_before"` + State string `json:"state"` +} + +type refreshGeneration struct { + CredentialGeneration uint64 `json:"credential_generation"` + RefreshFingerprint string `json:"refresh_fingerprint"` +} + +// RefreshBlockedError means an earlier provider send may have consumed the +// current rotating refresh token. Only a newly installed credential may clear it. +type RefreshBlockedError struct { + AccountFingerprint string +} + +func (e *RefreshBlockedError) Error() string { + return "credential refresh is blocked; fresh login required" +} + +// RefreshHandle identifies one prepared transaction without retaining tokens. +type RefreshHandle struct { + root string + markerPath string + metaPath string + attempt RefreshAttempt + afterFP string +} + +// RefreshFaultHooks are fixture-only crash and persistence seams. Production +// leaves them nil. Hooks run at named durable boundaries and must not inspect tokens. +type RefreshFaultHooks struct { + BeforeMarkerDurable func() error + AfterMarkerDurable func() error + BeforeCredentialCommit func() error + BeforeCredentialDurable func(string) error + AfterCredentialDurable func() error + BeforeMarkerRemoval func() error +} + +var refreshFaultHooks RefreshFaultHooks +var authorityRefreshContext = func() (context.Context, context.CancelFunc) { + return context.WithTimeout(context.Background(), refreshTimeout) +} + +// SetAuthorityRefreshContextForTest replaces the production deadline with an +// injected fixture clock/context and returns a restore function. +func SetAuthorityRefreshContextForTest(factory func() (context.Context, context.CancelFunc)) func() { + old := authorityRefreshContext + authorityRefreshContext = factory + return func() { authorityRefreshContext = old } +} + +// SetRefreshFaultHooksForTest installs bounded fixture hooks and returns a restore function. +func SetRefreshFaultHooksForTest(h RefreshFaultHooks) func() { + old := refreshFaultHooks + refreshFaultHooks = h + return func() { refreshFaultHooks = old } +} + +func boundedFingerprint(value string) string { + sum := sha256.Sum256([]byte(value)) + return hex.EncodeToString(sum[:16]) +} + +func randomAttemptID() (string, error) { + var value [16]byte + if _, err := rand.Read(value[:]); err != nil { + return "", err + } + return hex.EncodeToString(value[:]), nil +} + +func attemptPaths(root, account string) (string, string, string) { + fp := boundedFingerprint(strings.TrimSpace(account)) + dir := filepath.Join(root, ".refresh-attempts") + return dir, filepath.Join(dir, fp+".json"), filepath.Join(dir, fp+".generation.json") +} + +// PreflightCredential verifies both the existing credential and its parent can +// be durably written before a rotating provider request may begin. +func PreflightCredential(path string) error { + if strings.TrimSpace(path) == "" { + return errors.New("credential path is required") + } + file, err := os.OpenFile(path, os.O_WRONLY, 0) + if err != nil { + return fmt.Errorf("credential is not writable: %w", err) + } + if err := file.Close(); err != nil { + return err + } + return preflightDurableWrite(filepath.Dir(path)) +} + +// VerifyCredentialDurable proves that both the rotated credential bytes and +// the directory entry naming them reached durable storage. Unlike upstream's +// best-effort parent sync helpers, every open and fsync error is returned. +func VerifyCredentialDurable(path string) error { + if hook := refreshFaultHooks.BeforeCredentialDurable; hook != nil { + if err := hook(path); err != nil { + return err + } + } + file, err := os.Open(path) + if err != nil { + return fmt.Errorf("open durable credential: %w", err) + } + if err := file.Sync(); err != nil { + file.Close() + return fmt.Errorf("fsync credential: %w", err) + } + if err := file.Close(); err != nil { + return fmt.Errorf("close durable credential: %w", err) + } + if err := syncDir(filepath.Dir(path)); err != nil { + return fmt.Errorf("fsync credential parent: %w", err) + } + return nil +} + +// PrepareRefresh performs recovery, persistence preflight, and the durable +// pre-send marker write. The caller must already hold its account mutation lock. +func PrepareRefresh(root, account, refreshToken string) (*RefreshHandle, error) { + if strings.TrimSpace(root) == "" || strings.TrimSpace(account) == "" || refreshToken == "" { + return nil, errors.New("refresh preparation requires store, account, and refresh credential") + } + dir, markerPath, metaPath := attemptPaths(root, account) + if err := preflightDurableWrite(dir); err != nil { + return nil, fmt.Errorf("refresh persistence preflight: %w", err) + } + currentFP := boundedFingerprint(refreshToken) + generation, err := readRefreshGeneration(metaPath) + if err != nil { + return nil, err + } + marker, exists, err := readRefreshAttempt(markerPath) + if err != nil { + return nil, err + } + if exists { + if marker.State != refreshAttemptState { + return nil, errors.New("invalid refresh attempt state") + } + // A changed token alone is not durable generation evidence: rename may + // have become visible before its parent fsync failed. Only generation+1, + // written after explicit credential durability, can clear the marker. + if generation.CredentialGeneration <= marker.CredentialGeneration || generation.RefreshFingerprint != currentFP { + return nil, &RefreshBlockedError{AccountFingerprint: marker.AccountFingerprint} + } + if err := removeDurable(markerPath); err != nil { + return nil, err + } + } + if generation.RefreshFingerprint != "" && generation.RefreshFingerprint != currentFP { + generation.CredentialGeneration++ + } + generation.RefreshFingerprint = currentFP + if err := writeJSONDurable(metaPath, generation); err != nil { + return nil, err + } + attemptID, err := randomAttemptID() + if err != nil { + return nil, err + } + attempt := RefreshAttempt{ + AttemptID: attemptID, + AccountFingerprint: boundedFingerprint(account), + CredentialGeneration: generation.CredentialGeneration, + RefreshFingerprintBefore: currentFP, + State: refreshAttemptState, + } + if hook := refreshFaultHooks.BeforeMarkerDurable; hook != nil { + if err := hook(); err != nil { + return nil, err + } + } + if err := writeJSONDurable(markerPath, attempt); err != nil { + return nil, err + } + if hook := refreshFaultHooks.AfterMarkerDurable; hook != nil { + if err := hook(); err != nil { + return nil, err + } + } + return &RefreshHandle{root: root, markerPath: markerPath, metaPath: metaPath, attempt: attempt}, nil +} + +// AuthorityRefreshContext is intentionally detached from a caller that may stop +// waiting once provider send can begin. The timeout bounds authority ownership. +func AuthorityRefreshContext() (context.Context, context.CancelFunc) { + return authorityRefreshContext() +} + +func BeforeCredentialCommit() error { + if hook := refreshFaultHooks.BeforeCredentialCommit; hook != nil { + return hook() + } + return nil +} + +// CompleteRefresh records generation+1 and removes the marker only after the +// caller has durably committed the rotated credential. +func CompleteRefresh(handle *RefreshHandle, newRefreshToken string) error { + if handle == nil || newRefreshToken == "" { + return errors.New("invalid completed refresh") + } + if hook := refreshFaultHooks.AfterCredentialDurable; hook != nil { + if err := hook(); err != nil { + return err + } + } + generation := refreshGeneration{ + CredentialGeneration: handle.attempt.CredentialGeneration + 1, + RefreshFingerprint: boundedFingerprint(newRefreshToken), + } + if err := writeJSONDurable(handle.metaPath, generation); err != nil { + return err + } + if hook := refreshFaultHooks.BeforeMarkerRemoval; hook != nil { + if err := hook(); err != nil { + return err + } + } + return removeDurable(handle.markerPath) +} + +func readRefreshAttempt(path string) (RefreshAttempt, bool, error) { + var value RefreshAttempt + body, err := os.ReadFile(path) + if errors.Is(err, os.ErrNotExist) { + return value, false, nil + } + if err != nil { + return value, false, err + } + if len(body) > 4096 { + return value, false, errors.New("refresh attempt exceeds size limit") + } + if err := json.Unmarshal(body, &value); err != nil { + return value, false, fmt.Errorf("parse refresh attempt: %w", err) + } + return value, true, nil +} + +func readRefreshGeneration(path string) (refreshGeneration, error) { + var value refreshGeneration + body, err := os.ReadFile(path) + if errors.Is(err, os.ErrNotExist) { + return value, nil + } + if err != nil { + return value, err + } + if len(body) > 4096 { + return value, errors.New("refresh generation exceeds size limit") + } + if err := json.Unmarshal(body, &value); err != nil { + return value, fmt.Errorf("parse refresh generation: %w", err) + } + return value, nil +} + +func preflightDurableWrite(dir string) error { + if err := os.MkdirAll(dir, 0o700); err != nil { + return err + } + probe, err := os.CreateTemp(dir, ".preflight-*") + if err != nil { + return err + } + path := probe.Name() + defer os.Remove(path) + if err := probe.Chmod(0o600); err != nil { + probe.Close() + return err + } + block := make([]byte, preflightBytes) + if _, err := probe.Write(block); err != nil { + probe.Close() + return err + } + if err := probe.Sync(); err != nil { + probe.Close() + return err + } + if err := probe.Close(); err != nil { + return err + } + return syncDir(dir) +} + +func writeJSONDurable(path string, value any) error { + body, err := json.Marshal(value) + if err != nil { + return err + } + body = append(body, '\n') + dir := filepath.Dir(path) + if err := os.MkdirAll(dir, 0o700); err != nil { + return err + } + file, err := os.CreateTemp(dir, ".refresh-state-*") + if err != nil { + return err + } + tmp := file.Name() + defer os.Remove(tmp) + if err := file.Chmod(0o600); err != nil { + file.Close() + return err + } + if _, err := file.Write(body); err != nil { + file.Close() + return err + } + if err := file.Sync(); err != nil { + file.Close() + return err + } + if err := file.Close(); err != nil { + return err + } + if err := os.Rename(tmp, path); err != nil { + return err + } + return syncDir(dir) +} + +func removeDurable(path string) error { + if err := os.Remove(path); err != nil && !errors.Is(err, os.ErrNotExist) { + return err + } + return syncDir(filepath.Dir(path)) +} + +func syncDir(path string) error { + dir, err := os.Open(path) + if err != nil { + return err + } + defer dir.Close() + return dir.Sync() +} + +// RecoverRefreshAttempt classifies startup evidence without sending to a +// provider. A current-generation marker remains frozen; a different durable +// credential advances generation before stale evidence is cleared. +func RecoverRefreshAttempt(root, account, refreshToken string) (bool, error) { + _, markerPath, metaPath := attemptPaths(root, account) + marker, exists, err := readRefreshAttempt(markerPath) + if err != nil || !exists { + return false, err + } + if marker.State != refreshAttemptState { + return false, errors.New("invalid refresh attempt state") + } + currentFP := boundedFingerprint(refreshToken) + generation, err := readRefreshGeneration(metaPath) + if err != nil { + return false, err + } + if generation.CredentialGeneration <= marker.CredentialGeneration || generation.RefreshFingerprint != currentFP { + return true, nil + } + if err := removeDurable(markerPath); err != nil { + return false, err + } + return false, nil +} + +// RecordFreshCredential advances local generation and clears an unresolved +// marker after a supported login has durably installed a different chain. The +// caller must hold the same account mutation lock used by refresh. +func RecordFreshCredential(root, account, refreshToken string) error { + if refreshToken == "" { + return errors.New("fresh credential has no refresh token") + } + _, markerPath, metaPath := attemptPaths(root, account) + generation, err := readRefreshGeneration(metaPath) + if err != nil { + return err + } + marker, exists, err := readRefreshAttempt(markerPath) + if err != nil { + return err + } + currentFP := boundedFingerprint(refreshToken) + if exists && marker.RefreshFingerprintBefore == currentFP { + return &RefreshBlockedError{AccountFingerprint: marker.AccountFingerprint} + } + if exists && generation.CredentialGeneration <= marker.CredentialGeneration { + generation.CredentialGeneration = marker.CredentialGeneration + 1 + } else { + generation.CredentialGeneration++ + } + generation.RefreshFingerprint = currentFP + if err := writeJSONDurable(metaPath, generation); err != nil { + return err + } + return removeDurable(markerPath) +} + +// RefreshCredentialGeneration returns non-secret durable generation metadata. +func RefreshCredentialGeneration(root, account string) (uint64, error) { + _, _, metaPath := attemptPaths(root, account) + generation, err := readRefreshGeneration(metaPath) + return generation.CredentialGeneration, err +} + +// RefreshCredentialBlocked reports only whether the exact account has an unresolved refresh marker. +func RefreshCredentialBlocked(root, account string) (bool, error) { + _, markerPath, _ := attemptPaths(root, account) + _, exists, err := readRefreshAttempt(markerPath) + return exists, err +} + +// CountUnresolvedRefreshAttempts returns only a count and never state contents. +func CountUnresolvedRefreshAttempts(root string) (int, error) { + entries, err := os.ReadDir(filepath.Join(root, ".refresh-attempts")) + if errors.Is(err, os.ErrNotExist) { + return 0, nil + } + if err != nil { + return 0, err + } + count := 0 + for _, entry := range entries { + if !entry.IsDir() && strings.HasSuffix(entry.Name(), ".json") && !strings.HasSuffix(entry.Name(), ".generation.json") { + count++ + } + } + return count, nil +} diff --git a/internal/accounts/refresh_attempt_test.go b/internal/accounts/refresh_attempt_test.go new file mode 100644 index 0000000..24079d5 --- /dev/null +++ b/internal/accounts/refresh_attempt_test.go @@ -0,0 +1,280 @@ +package accounts + +import ( + "context" + "encoding/json" + "errors" + "io" + "net/http" + "net/http/httptest" + "os" + "os/exec" + "path/filepath" + "strings" + "testing" + "time" +) + +func TestRefreshAttemptFreezesCurrentGenerationAndRecoversAdvancedGeneration(t *testing.T) { + root := t.TempDir() + handle, err := PrepareRefresh(root, "fixture-account", "fixture-old-refresh") + if err != nil { + t.Fatal(err) + } + if len(handle.attempt.AccountFingerprint) != 32 || len(handle.attempt.RefreshFingerprintBefore) != 32 { + t.Fatalf("fingerprints are not bounded: %#v", handle.attempt) + } + if strings.Contains(handle.attempt.RefreshFingerprintBefore, "fixture") { + t.Fatal("marker exposed fixture credential") + } + if _, err := PrepareRefresh(root, "fixture-account", "fixture-old-refresh"); err == nil { + t.Fatal("current generation with unresolved marker was not frozen") + } else { + var blocked *RefreshBlockedError + if !errors.As(err, &blocked) { + t.Fatalf("error = %T %v, want RefreshBlockedError", err, err) + } + } + + if err := RecordFreshCredential(root, "fixture-account", "fixture-fresh-login"); err != nil { + t.Fatalf("fresh replacement did not advance generation: %v", err) + } + next, err := PrepareRefresh(root, "fixture-account", "fixture-fresh-login") + if err != nil { + t.Fatalf("fresh credential did not recover marker: %v", err) + } + if next.attempt.CredentialGeneration != handle.attempt.CredentialGeneration+1 { + t.Fatalf("generation = %d, want %d", next.attempt.CredentialGeneration, handle.attempt.CredentialGeneration+1) + } +} + +func TestRefreshAttemptCrashBoundariesRemainBlockedUntilDurableAdvance(t *testing.T) { + boundaries := []struct { + name string + hook RefreshFaultHooks + }{ + {"after-marker", RefreshFaultHooks{AfterMarkerDurable: func() error { return errors.New("fixture crash") }}}, + {"before-credential", RefreshFaultHooks{BeforeCredentialCommit: func() error { return errors.New("fixture crash") }}}, + {"after-credential", RefreshFaultHooks{AfterCredentialDurable: func() error { return errors.New("fixture crash") }}}, + {"before-marker-removal", RefreshFaultHooks{BeforeMarkerRemoval: func() error { return errors.New("fixture crash") }}}, + } + for _, test := range boundaries { + t.Run(test.name, func(t *testing.T) { + root := t.TempDir() + restore := SetRefreshFaultHooksForTest(test.hook) + defer restore() + handle, err := PrepareRefresh(root, "fixture-account", "fixture-old") + if test.name == "after-marker" { + if err == nil { + t.Fatal("fault did not fire") + } + } else { + if err != nil { + t.Fatal(err) + } + if test.name == "before-credential" { + err = BeforeCredentialCommit() + } else { + err = CompleteRefresh(handle, "fixture-new") + } + if err == nil { + t.Fatal("fault did not fire") + } + } + restore() + if _, err := PrepareRefresh(root, "fixture-account", "fixture-old"); err == nil { + t.Fatal("crash boundary permitted old-generation retry") + } + }) + } +} + +func TestRefreshAttemptRealProcessDeathAcrossProviderCredentialTransaction(t *testing.T) { + const ( + account = "fixture@example.invalid" + oldRefresh = "synthetic-old-refresh" + ) + if os.Getenv("SUBROUTER_REFRESH_DEATH_HELPER") == "1" { + root := os.Getenv("SUBROUTER_REFRESH_DEATH_ROOT") + boundary := os.Getenv("SUBROUTER_REFRESH_DEATH_BOUNDARY") + codexOAuthTokenURL = os.Getenv("SUBROUTER_REFRESH_DEATH_URL") + exitAt := func(code int) func() error { + return func() error { os.Exit(code); return nil } + } + hooks := RefreshFaultHooks{} + switch boundary { + case "before-marker": + hooks.BeforeMarkerDurable = exitAt(71) + case "after-marker-before-send": + hooks.AfterMarkerDurable = exitAt(72) + case "after-response-before-credential-fsync": + hooks.BeforeCredentialDurable = func(string) error { os.Exit(73); return nil } + case "after-credential-fsync-before-marker-removal": + hooks.BeforeMarkerRemoval = exitAt(74) + } + SetRefreshFaultHooksForTest(hooks) + store := CodexStore{Dir: root} + stale, ok, err := store.FindStored(account) + if err != nil || !ok { + os.Exit(75) + } + _, _, _ = store.RefreshStoredIfExpired(context.Background(), http.DefaultClient, stale) + os.Exit(76) + } + + boundaries := []struct { + name string + wantFrozen bool + wantOldCalls int + wantExitCode int + killAfterRequest bool + }{ + {name: "before-marker", wantFrozen: false, wantOldCalls: 1, wantExitCode: 71}, + {name: "after-marker-before-send", wantFrozen: true, wantOldCalls: 0, wantExitCode: 72}, + {name: "after-send-before-response", wantFrozen: true, wantOldCalls: 1, killAfterRequest: true}, + {name: "after-response-before-credential-fsync", wantFrozen: true, wantOldCalls: 1, wantExitCode: 73}, + {name: "after-credential-fsync-before-marker-removal", wantFrozen: false, wantOldCalls: 1, wantExitCode: 74}, + } + for _, boundary := range boundaries { + t.Run(boundary.name, func(t *testing.T) { + root := t.TempDir() + store := CodexStore{Dir: root} + stale := storedOAuthAccount(account, "synthetic-old", time.Now().Add(-time.Hour)) + stale.Auth.Tokens.RefreshToken = oldRefresh + if err := store.SaveStored(stale); err != nil { + t.Fatal(err) + } + + requests := make(chan string, 4) + releaseResponse := make(chan struct{}) + server := httptest.NewServer(http.HandlerFunc(func(response http.ResponseWriter, request *http.Request) { + var payload struct { + RefreshToken string `json:"refresh_token"` + } + if err := json.NewDecoder(io.LimitReader(request.Body, 64<<10)).Decode(&payload); err != nil { + requests <- "parse-error" + return + } + requests <- payload.RefreshToken + if boundary.killAfterRequest { + <-releaseResponse + } + refreshed := refreshResponse("synthetic-new", account, time.Now().Add(time.Hour)) + defer refreshed.Body.Close() + response.Header().Set("Content-Type", "application/json") + response.WriteHeader(refreshed.StatusCode) + _, _ = io.Copy(response, refreshed.Body) + })) + previousProviderURL := codexOAuthTokenURL + codexOAuthTokenURL = server.URL + defer func() { codexOAuthTokenURL = previousProviderURL }() + + command := exec.Command(os.Args[0], "-test.run=^TestRefreshAttemptRealProcessDeathAcrossProviderCredentialTransaction$") + command.Env = append(os.Environ(), + "SUBROUTER_REFRESH_DEATH_HELPER=1", + "SUBROUTER_REFRESH_DEATH_ROOT="+root, + "SUBROUTER_REFRESH_DEATH_BOUNDARY="+boundary.name, + "SUBROUTER_REFRESH_DEATH_URL="+server.URL, + ) + if boundary.killAfterRequest { + if err := command.Start(); err != nil { + server.Close() + t.Fatal(err) + } + select { + case token := <-requests: + if token != oldRefresh { + t.Fatalf("provider received refresh token %q", token) + } + requests <- token + case <-time.After(5 * time.Second): + _ = command.Process.Kill() + _ = command.Wait() + close(releaseResponse) + server.Close() + t.Fatal("fixture process did not reach provider send") + } + if err := command.Process.Kill(); err != nil { + close(releaseResponse) + server.Close() + t.Fatal(err) + } + _ = command.Wait() + close(releaseResponse) + } else { + runErr := command.Run() + var exitErr *exec.ExitError + if !errors.As(runErr, &exitErr) || exitErr.ExitCode() != boundary.wantExitCode { + server.Close() + t.Fatalf("fixture exit = %v, want code %d", runErr, boundary.wantExitCode) + } + } + + blocked, err := store.RecoverStoredRefreshAttempts() + if err != nil { + server.Close() + t.Fatal(err) + } + if (blocked == 1) != boundary.wantFrozen { + server.Close() + t.Fatalf("restart blocked=%d, want frozen=%v", blocked, boundary.wantFrozen) + } + latest, ok, err := store.FindStored(account) + if err != nil || !ok { + server.Close() + t.Fatalf("restart credential missing: ok=%v err=%v", ok, err) + } + _, _, retryErr := store.RefreshStoredIfExpired(context.Background(), server.Client(), latest) + if boundary.wantFrozen { + var frozen *RefreshBlockedError + if !errors.As(retryErr, &frozen) { + server.Close() + t.Fatalf("restart error = %T %v, want RefreshBlockedError", retryErr, retryErr) + } + } else if retryErr != nil { + server.Close() + t.Fatalf("restart recovery failed: %v", retryErr) + } + server.Close() + + oldCalls := 0 + for { + select { + case token := <-requests: + if token == oldRefresh { + oldCalls++ + } + default: + if oldCalls != boundary.wantOldCalls { + t.Fatalf("old rotating chain provider calls = %d, want %d", oldCalls, boundary.wantOldCalls) + } + return + } + } + }) + } +} + +func TestRefreshAttemptWritesMetadataOnlyAndCountsUnresolved(t *testing.T) { + root := t.TempDir() + if _, err := PrepareRefresh(root, "fixture-account", "synthetic-secret-refresh"); err != nil { + t.Fatal(err) + } + count, err := CountUnresolvedRefreshAttempts(root) + if err != nil || count != 1 { + t.Fatalf("count = %d, err = %v", count, err) + } + entries, err := os.ReadDir(filepath.Join(root, ".refresh-attempts")) + if err != nil { + t.Fatal(err) + } + for _, entry := range entries { + body, err := os.ReadFile(filepath.Join(root, ".refresh-attempts", entry.Name())) + if err != nil { + t.Fatal(err) + } + if strings.Contains(string(body), "synthetic-secret-refresh") || strings.Contains(string(body), "fixture-account") { + t.Fatalf("durable metadata exposed fixture input: %s", body) + } + } +} diff --git a/internal/accounts/store_lease.go b/internal/accounts/store_lease.go new file mode 100644 index 0000000..15dd45c --- /dev/null +++ b/internal/accounts/store_lease.go @@ -0,0 +1,61 @@ +package accounts + +import ( + "errors" + "fmt" + "os" + "path/filepath" + "syscall" +) + +// StoreLease owns a kernel flock for the lifetime of one authority process. +// The lock file is persistent state, not an O_EXCL sentinel, so process death +// releases ownership without unlink races. +type StoreLease struct { + file *os.File +} + +func AcquireStoreLease(stateDir string) (*StoreLease, error) { + if stateDir == "" { + return nil, errors.New("authority mode requires a state directory") + } + if err := os.MkdirAll(stateDir, 0o700); err != nil { + return nil, err + } + path := filepath.Join(stateDir, ".authority-store.lock") + file, err := os.OpenFile(path, os.O_CREATE|os.O_RDWR, 0o600) + if err != nil { + return nil, fmt.Errorf("open authority store lease: %w", err) + } + if err := syscall.Flock(int(file.Fd()), syscall.LOCK_EX|syscall.LOCK_NB); err != nil { + file.Close() + return nil, fmt.Errorf("authority store is already owned: %w", err) + } + return &StoreLease{file: file}, nil +} + +func (lease *StoreLease) Close() error { + if lease == nil || lease.file == nil { + return nil + } + file := lease.file + lease.file = nil + unlockErr := syscall.Flock(int(file.Fd()), syscall.LOCK_UN) + return errors.Join(unlockErr, file.Close()) +} + +// StoreLeaseState reports held when another process owns the lease and +// available when a probe can take and immediately release it. +func StoreLeaseState(stateDir string) (string, error) { + lease, err := AcquireStoreLease(stateDir) + if err != nil { + if errors.Is(err, syscall.EWOULDBLOCK) || errors.Is(err, syscall.EAGAIN) { + return "held", nil + } + return "unknown", err + } + if err := lease.Close(); err != nil { + return "unknown", err + } + return "available", nil +} diff --git a/internal/accounts/store_lease_test.go b/internal/accounts/store_lease_test.go new file mode 100644 index 0000000..7d928fb --- /dev/null +++ b/internal/accounts/store_lease_test.go @@ -0,0 +1,66 @@ +package accounts + +import ( + "os" + "os/exec" + "testing" +) + +func TestStoreLeaseRejectsCompetingProcessAndSurvivesLockFile(t *testing.T) { + stateDir := t.TempDir() + lease, err := AcquireStoreLease(stateDir) + if err != nil { + t.Fatal(err) + } + defer lease.Close() + + command := exec.Command(os.Args[0], "-test.run=TestStoreLeaseHelperProcess") + command.Env = append(os.Environ(), "SUBROUTER_LEASE_HELPER=1", "SUBROUTER_LEASE_STATE="+stateDir) + if err := command.Run(); err == nil { + t.Fatal("competing process acquired authority store") + } + if _, err := os.Stat(stateDir + "/.authority-store.lock"); err != nil { + t.Fatalf("persistent flock file missing: %v", err) + } +} + +func TestStoreLeaseCanBeReacquiredAfterOwnerExit(t *testing.T) { + stateDir := t.TempDir() + lease, err := AcquireStoreLease(stateDir) + if err != nil { + t.Fatal(err) + } + if err := lease.Close(); err != nil { + t.Fatal(err) + } + next, err := AcquireStoreLease(stateDir) + if err != nil { + t.Fatalf("reacquire after close: %v", err) + } + if err := next.Close(); err != nil { + t.Fatal(err) + } +} + +func TestStoreLeaseStateDoesNotCallAcquisitionErrorsHeld(t *testing.T) { + path := t.TempDir() + "/not-a-directory" + if err := os.WriteFile(path, []byte("fixture"), 0o600); err != nil { + t.Fatal(err) + } + state, err := StoreLeaseState(path) + if err == nil || state != "unknown" { + t.Fatalf("state = %q, err = %v; want unknown error", state, err) + } +} + +func TestStoreLeaseHelperProcess(t *testing.T) { + if os.Getenv("SUBROUTER_LEASE_HELPER") != "1" { + return + } + lease, err := AcquireStoreLease(os.Getenv("SUBROUTER_LEASE_STATE")) + if err != nil { + os.Exit(2) + } + lease.Close() + os.Exit(0) +} diff --git a/internal/agents/claude/store.go b/internal/agents/claude/store.go index 11ad965..bc62cc6 100644 --- a/internal/agents/claude/store.go +++ b/internal/agents/claude/store.go @@ -599,7 +599,14 @@ func (s Store) ImportProfileCredential(name string, credential CredentialInfo) ( if err != nil { return err } - if err := writePrivateFileAtomic(filepath.Join(instancePath, ".credentials.json"), body); err != nil { + credentialPath := filepath.Join(instancePath, ".credentials.json") + if err := writePrivateFileAtomic(credentialPath, body); err != nil { + return err + } + if err := accounts.VerifyCredentialDurable(credentialPath); err != nil { + return err + } + if err := accounts.RecordFreshCredential(s.Dir, name, credential.RefreshToken); err != nil { return err } for _, path := range instancePaths { @@ -1102,6 +1109,35 @@ func (s Store) readCredential(ctx context.Context, instancePath string) (*Creden return parseCredentialPayload(body) } +// RecoverRefreshAttempts classifies durable markers before authority readiness +// while holding each profile's cross-process credential lock. +func (s Store) RecoverRefreshAttempts(ctx context.Context) (int, error) { + blocked := 0 + for _, profile := range s.ListProfiles() { + configDir := s.ClaudeConfigDir(profile.Name) + lock, err := lockProfileCredential(ctx, configDir) + if err != nil { + return blocked, err + } + credential, readErr := s.readCredential(ctx, configDir) + if readErr == nil && credential != nil && credential.RefreshToken != "" { + var frozen bool + frozen, readErr = accounts.RecoverRefreshAttempt(s.Dir, profile.Name, credential.RefreshToken) + if frozen { + blocked++ + } + } + closeErr := lock.Close() + if readErr != nil { + return blocked, readErr + } + if closeErr != nil { + return blocked, closeErr + } + } + return blocked, nil +} + func (s Store) RefreshCredentialIfExpired(ctx context.Context, client *http.Client, profile Profile) (accounts.Account, bool, error) { return s.refreshProfileCredential(ctx, client, profile, false) } @@ -1134,6 +1170,16 @@ func (s Store) refreshProfileCredential(ctx context.Context, client *http.Client lock.Close(), ) } + frozen, recoverErr := accounts.RecoverRefreshAttempt(s.Dir, profile.Name, credential.RefreshToken) + if recoverErr != nil { + return accounts.Account{}, false, errors.Join(recoverErr, lock.Close()) + } + if frozen { + return accounts.Account{}, false, errors.Join( + &accounts.RefreshBlockedError{}, + lock.Close(), + ) + } if force && credential.RefreshToken == "" { return accounts.Account{}, false, errors.Join( fmt.Errorf("Claude profile %q has no refresh token", profile.Name), @@ -1158,24 +1204,31 @@ func (s Store) refreshProfileCredential(ctx context.Context, client *http.Client credentialBeforeRefresh := *credential profileBeforeRefresh := profile - if err := lock.Close(); err != nil { - return accounts.Account{}, false, err - } - refreshed, err := RefreshCredential(ctx, client, credentialBeforeRefresh) - if err != nil { - return accounts.Account{}, false, err + credentialPath := filepath.Join(configDir, ".credentials.json") + if _, statErr := os.Stat(credentialPath); statErr == nil { + if err := accounts.PreflightCredential(credentialPath); err != nil { + return accounts.Account{}, false, errors.Join(err, lock.Close()) + } + } else if runtime.GOOS != "darwin" { + return accounts.Account{}, false, errors.Join(statErr, lock.Close()) } - didRefresh = true - - lock, err = lockProfileCredential(ctx, configDir) + handle, err := accounts.PrepareRefresh(s.Dir, profile.Name, credentialBeforeRefresh.RefreshToken) if err != nil { - return accounts.Account{}, false, err + return accounts.Account{}, false, errors.Join(err, lock.Close()) } defer func() { if closeErr := lock.Close(); err == nil { err = closeErr } }() + authorityCtx, cancelAuthority := accounts.AuthorityRefreshContext() + defer cancelAuthority() + refreshed, err := RefreshCredential(authorityCtx, client, credentialBeforeRefresh) + if err != nil { + return accounts.Account{}, false, err + } + didRefresh = true + current, ok = s.FindProfile(profile.Name) if !ok || current.CreatedAt != profileBeforeRefresh.CreatedAt || @@ -1192,7 +1245,16 @@ func (s Store) refreshProfileCredential(ctx context.Context, client *http.Client } if *credential == credentialBeforeRefresh { credential = &refreshed - if err := s.writeCredential(ctx, configDir, *credential); err != nil { + if err := accounts.BeforeCredentialCommit(); err != nil { + return accounts.Account{}, false, err + } + if err := s.writeCredential(authorityCtx, configDir, *credential); err != nil { + return accounts.Account{}, false, err + } + if err := accounts.VerifyCredentialDurable(credentialPath); err != nil { + return accounts.Account{}, false, err + } + if err := accounts.CompleteRefresh(handle, credential.RefreshToken); err != nil { return accounts.Account{}, false, err } } @@ -1255,30 +1317,12 @@ func (s Store) writeCredential(ctx context.Context, instancePath string, credent // credentials so systemd services never depend on a login keychain. func (s Store) UpsertCredentialProfile(name string, credential CredentialInfo) (Profile, error) { name = strings.TrimSpace(name) - if err := ValidateProfileNameAllowEmail(name); err != nil { - return Profile{}, err - } - dir := sanitizeName(name) - if dir == "" { - return Profile{}, errors.New("invalid Claude profile name") - } - instancePath := filepath.Join(s.InstancesDir(), dir) - if err := s.initInstanceDir(instancePath); err != nil { - return Profile{}, err - } - body, err := credentialPayload(credential) - if err != nil { - return Profile{}, err - } - if err := writePrivateFileAtomic(filepath.Join(instancePath, ".credentials.json"), body); err != nil { - return Profile{}, err - } - if err := s.RegisterProfile(name, dir); err != nil { + if err := s.ImportProfileCredential(name, credential); err != nil { return Profile{}, err } profile, ok := s.FindProfile(name) if !ok { - return Profile{}, fmt.Errorf("Claude profile %q was not readable after registration", name) + return Profile{}, fmt.Errorf("Claude profile %q was not readable after replacement", name) } return profile, nil } @@ -1373,9 +1417,8 @@ func RefreshCredential(ctx context.Context, client *http.Client, credential Cred } defer res.Body.Close() if res.StatusCode < 200 || res.StatusCode >= 300 { - var buf bytes.Buffer - _, _ = buf.ReadFrom(res.Body) - return credential, fmt.Errorf("Claude OAuth refresh failed: %s: %s", res.Status, strings.TrimSpace(buf.String())) + _, _ = io.Copy(io.Discard, io.LimitReader(res.Body, 64<<10)) + return credential, fmt.Errorf("Claude OAuth refresh failed (%d)", res.StatusCode) } var refreshed struct { AccessToken string `json:"access_token"` diff --git a/internal/agents/claude/store_test.go b/internal/agents/claude/store_test.go index 4c0a546..eeeaccf 100644 --- a/internal/agents/claude/store_test.go +++ b/internal/agents/claude/store_test.go @@ -14,6 +14,8 @@ import ( "path/filepath" "runtime" "strings" + "sync" + "sync/atomic" "testing" "time" @@ -190,7 +192,7 @@ func TestImportProfileCredentialSerializesRegistryAcrossProcesses(t *testing.T) } } -func TestRefreshCredentialDoesNotOverwriteNewerImportAcrossProcesses(t *testing.T) { +func TestRefreshCredentialHoldsMutationLockThroughProviderIO(t *testing.T) { if os.Getenv("SUBROUTER_CLAUDE_REFRESH_HELPER") == "1" { oauthTokenURL = os.Getenv("SUBROUTER_CLAUDE_REFRESH_URL") store := Store{Dir: os.Getenv("SUBROUTER_CLAUDE_REFRESH_DIR")} @@ -236,7 +238,7 @@ func TestRefreshCredentialDoesNotOverwriteNewerImportAcrossProcesses(t *testing. ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second) defer cancel() - command := exec.CommandContext(ctx, os.Args[0], "-test.run=^TestRefreshCredentialDoesNotOverwriteNewerImportAcrossProcesses$") + command := exec.CommandContext(ctx, os.Args[0], "-test.run=^TestRefreshCredentialHoldsMutationLockThroughProviderIO$") command.Env = append(os.Environ(), "SUBROUTER_CLAUDE_REFRESH_HELPER=1", "SUBROUTER_CLAUDE_REFRESH_DIR="+store.Dir, @@ -263,20 +265,24 @@ func TestRefreshCredentialDoesNotOverwriteNewerImportAcrossProcesses(t *testing. }() select { case err := <-importDone: - if err != nil { - close(releaseRefresh) - _ = command.Wait() - t.Fatal(err) - } - case <-time.After(2 * time.Second): close(releaseRefresh) _ = command.Wait() - t.Fatal("credential import remained blocked by the OAuth round trip") + t.Fatalf("credential import bypassed refresh mutation lock: %v", err) + case <-time.After(100 * time.Millisecond): + // Expected: login/import waits until provider I/O and durable commit finish. } close(releaseRefresh) if err := command.Wait(); err != nil { t.Fatalf("refresh helper failed: %v", err) } + select { + case err := <-importDone: + if err != nil { + t.Fatal(err) + } + case <-ctx.Done(): + t.Fatal("credential import did not resume after refresh committed") + } credential, err := store.ReadCredential(context.Background(), store.ClaudeConfigDir("founders@example.com")) if err != nil { @@ -795,6 +801,207 @@ func TestRefreshCredentialPostsClaudeOAuthRefresh(t *testing.T) { } } +func TestRefreshCredentialClaudeLostMalformedAndTerminalOutcomesNeverRetryGeneration(t *testing.T) { + for _, outcome := range []string{"lost-response", "malformed-success", "terminal"} { + t.Run(outcome, func(t *testing.T) { + store := Store{Dir: t.TempDir()} + name := "fixture@example.invalid" + if err := store.ImportProfileCredential(name, CredentialInfo{ + AccessToken: "synthetic-old-access", RefreshToken: "synthetic-old-refresh", ExpiresAt: time.Now().Add(-time.Hour).UnixMilli(), + }); err != nil { + t.Fatal(err) + } + profile, _ := store.FindProfile(name) + var calls atomic.Int32 + server := httptest.NewServer(http.HandlerFunc(func(response http.ResponseWriter, request *http.Request) { + calls.Add(1) + switch outcome { + case "lost-response": + connection, _, err := response.(http.Hijacker).Hijack() + if err == nil { + _ = connection.Close() + } + case "malformed-success": + response.WriteHeader(http.StatusOK) + _, _ = io.WriteString(response, `{"access_token":`) + case "terminal": + response.WriteHeader(http.StatusUnauthorized) + _, _ = io.WriteString(response, `{"error":"synthetic rejection"}`) + } + })) + defer server.Close() + oldURL := oauthTokenURL + oauthTokenURL = server.URL + defer func() { oauthTokenURL = oldURL }() + if _, _, err := store.RefreshCredentialIfExpired(context.Background(), server.Client(), profile); err == nil { + t.Fatal("first ambiguous/terminal outcome succeeded") + } + if _, _, err := store.RefreshCredentialIfExpired(context.Background(), server.Client(), profile); err == nil { + t.Fatal("old generation retried") + } + if calls.Load() != 1 { + t.Fatalf("provider calls = %d, want 1", calls.Load()) + } + }) + } +} + +func TestRefreshCredentialClaudeSerializesNCallersAndAdvancesOneGeneration(t *testing.T) { + store := Store{Dir: t.TempDir()} + name := "fixture@example.invalid" + if err := store.ImportProfileCredential(name, CredentialInfo{ + AccessToken: "synthetic-old-access", RefreshToken: "synthetic-old-refresh", ExpiresAt: time.Now().Add(-time.Hour).UnixMilli(), + }); err != nil { + t.Fatal(err) + } + profile, ok := store.FindProfile(name) + if !ok { + t.Fatal("fixture profile missing") + } + var calls atomic.Int32 + server := httptest.NewServer(http.HandlerFunc(func(response http.ResponseWriter, _ *http.Request) { + calls.Add(1) + time.Sleep(20 * time.Millisecond) + response.Header().Set("Content-Type", "application/json") + _, _ = io.WriteString(response, `{"access_token":"synthetic-new-access","refresh_token":"synthetic-new-refresh","expires_in":3600}`) + })) + defer server.Close() + oldURL := oauthTokenURL + oauthTokenURL = server.URL + defer func() { oauthTokenURL = oldURL }() + errs := make(chan error, 8) + var wait sync.WaitGroup + for index := 0; index < 8; index++ { + wait.Add(1) + go func() { + defer wait.Done() + _, _, err := store.RefreshCredentialIfExpired(context.Background(), server.Client(), profile) + errs <- err + }() + } + wait.Wait() + close(errs) + for err := range errs { + if err != nil { + t.Fatal(err) + } + } + if calls.Load() != 1 { + t.Fatalf("provider calls = %d, want 1", calls.Load()) + } + if generation, err := accounts.RefreshCredentialGeneration(store.Dir, name); err != nil || generation != 2 { + t.Fatalf("generation = %d, err=%v; want 2", generation, err) + } +} + +func TestRefreshCredentialImportAdvancesGenerationAndClearsBlock(t *testing.T) { + store := Store{Dir: t.TempDir()} + name := "fixture@example.invalid" + old := CredentialInfo{AccessToken: "synthetic-old-access", RefreshToken: "synthetic-old-refresh", ExpiresAt: time.Now().Add(-time.Hour).UnixMilli()} + if err := store.ImportProfileCredential(name, old); err != nil { + t.Fatal(err) + } + if _, err := accounts.PrepareRefresh(store.Dir, name, old.RefreshToken); err != nil { + t.Fatal(err) + } + fresh := CredentialInfo{AccessToken: "synthetic-fresh-access", RefreshToken: "synthetic-fresh-refresh", ExpiresAt: time.Now().Add(time.Hour).UnixMilli()} + if err := store.ImportProfileCredential(name, fresh); err != nil { + t.Fatalf("fresh replacement: %v", err) + } + if frozen, err := accounts.RecoverRefreshAttempt(store.Dir, name, fresh.RefreshToken); err != nil || frozen { + t.Fatalf("fresh replacement remained blocked: frozen=%v err=%v", frozen, err) + } + if unresolved, err := accounts.CountUnresolvedRefreshAttempts(store.Dir); err != nil || unresolved != 0 { + t.Fatalf("unresolved attempts = %d, err=%v", unresolved, err) + } +} + +func TestRefreshCredentialClaudeDurabilityFailureFreezesVisibleRotatedCredential(t *testing.T) { + store := Store{Dir: t.TempDir()} + if err := store.ImportProfileCredential("fixture@example.invalid", CredentialInfo{ + AccessToken: "synthetic-old-access", RefreshToken: "synthetic-old-refresh", + ExpiresAt: time.Now().Add(-time.Hour).UnixMilli(), + }); err != nil { + t.Fatal(err) + } + profile, ok := store.FindProfile("fixture@example.invalid") + if !ok { + t.Fatal("fixture profile missing") + } + var calls atomic.Int32 + server := httptest.NewServer(http.HandlerFunc(func(response http.ResponseWriter, _ *http.Request) { + calls.Add(1) + response.Header().Set("Content-Type", "application/json") + _, _ = io.WriteString(response, `{"access_token":"synthetic-new-access","refresh_token":"synthetic-new-refresh","expires_in":3600}`) + })) + defer server.Close() + oldURL := oauthTokenURL + oauthTokenURL = server.URL + defer func() { oauthTokenURL = oldURL }() + restore := accounts.SetRefreshFaultHooksForTest(accounts.RefreshFaultHooks{ + BeforeCredentialDurable: func(string) error { return errors.New("fixture parent fsync failure") }, + }) + _, _, err := store.RefreshCredentialIfExpired(context.Background(), server.Client(), profile) + restore() + if err == nil || !strings.Contains(err.Error(), "fixture parent fsync failure") { + t.Fatalf("durability error = %v", err) + } + if _, _, err := store.RefreshCredentialIfExpired(context.Background(), server.Client(), profile); err == nil { + t.Fatal("visible but unproven Claude credential bypassed unresolved marker") + } else { + var blocked *accounts.RefreshBlockedError + if !errors.As(err, &blocked) { + t.Fatalf("retry error = %T %v, want RefreshBlockedError", err, err) + } + } + if calls.Load() != 1 { + t.Fatalf("provider calls = %d, want 1", calls.Load()) + } +} + +func TestRefreshCredentialClaudeIgnoresWaiterCancellationAfterSend(t *testing.T) { + store := Store{Dir: t.TempDir()} + if err := store.ImportProfileCredential("fixture@example.invalid", CredentialInfo{ + AccessToken: "synthetic-old-access", RefreshToken: "synthetic-old-refresh", + ExpiresAt: time.Now().Add(-time.Hour).UnixMilli(), + }); err != nil { + t.Fatal(err) + } + profile, ok := store.FindProfile("fixture@example.invalid") + if !ok { + t.Fatal("fixture profile missing") + } + requestStarted := make(chan struct{}) + releaseResponse := make(chan struct{}) + server := httptest.NewServer(http.HandlerFunc(func(response http.ResponseWriter, request *http.Request) { + close(requestStarted) + <-releaseResponse + response.Header().Set("Content-Type", "application/json") + _, _ = io.WriteString(response, `{"access_token":"synthetic-new-access","refresh_token":"synthetic-new-refresh","expires_in":3600}`) + })) + defer server.Close() + oldURL := oauthTokenURL + oauthTokenURL = server.URL + defer func() { oauthTokenURL = oldURL }() + client := server.Client() + callerCtx, cancelCaller := context.WithCancel(context.Background()) + result := make(chan error, 1) + go func() { + _, _, err := store.RefreshCredentialIfExpired(callerCtx, client, profile) + result <- err + }() + <-requestStarted + cancelCaller() + close(releaseResponse) + if err := <-result; err != nil { + t.Fatalf("authority transaction inherited waiter cancellation: %v", err) + } + credential, err := store.ReadCredential(context.Background(), store.ClaudeConfigDir(profile.Name)) + if err != nil || credential == nil || credential.RefreshToken != "synthetic-new-refresh" { + t.Fatalf("durable rotated credential missing: credential=%v err=%v", credential != nil, err) + } +} + func TestForceRefreshCredentialRefreshesFreshProfile(t *testing.T) { originalURL := oauthTokenURL defer func() { oauthTokenURL = originalURL }() diff --git a/internal/authority/routes.go b/internal/authority/routes.go new file mode 100644 index 0000000..89c820a --- /dev/null +++ b/internal/authority/routes.go @@ -0,0 +1,719 @@ +package authority + +import ( + "bytes" + "crypto/rand" + "crypto/sha256" + "crypto/subtle" + "encoding/base64" + "encoding/hex" + "encoding/json" + "errors" + "fmt" + "io" + "os" + "path/filepath" + "regexp" + "strings" + "syscall" + "time" + + "golang.org/x/sys/unix" +) + +const ( + storeSchema = 1 + storeName = "authority-routes.json" + fixtureName = "authority-proof-accounts.json" + lockName = ".authority-routes.lock" + maximumState = 1 << 20 + maximumRoutes = 4096 + maximumGrants = 8192 +) + +var opaqueIDPattern = regexp.MustCompile(`^[A-Za-z0-9_-]{12,96}$`) +var accountSelectorPattern = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9_.@+:-]{0,159}$`) + +type Route struct { + RouteID string `json:"route_id"` + TenantID string `json:"tenant_id"` + Provider string `json:"provider"` + AccountID string `json:"account_id"` + Enabled bool `json:"enabled"` +} + +type Grant struct { + GrantID string `json:"grant_id"` + RouteID string `json:"route_id"` + KeyHash string `json:"key_hash"` + Audience string `json:"audience"` + IssuedAt time.Time `json:"issued_at"` + ExpiresAt time.Time `json:"expires_at"` + RevokedAt *time.Time `json:"revoked_at"` +} + +type state struct { + Schema int `json:"schema"` + Routes []Route `json:"routes"` + Grants []Grant `json:"grants"` +} + +type FixtureAccount struct { + Provider string `json:"provider"` + AccountID string `json:"account_id"` + State string `json:"state"` +} + +type fixtureState struct { + Schema int `json:"schema"` + Accounts []FixtureAccount `json:"accounts"` +} + +type Store struct { + directory *os.File + dirUID uint32 + now func() time.Time +} + +type GrantView struct { + Fingerprint string + Audience string + ExpiresAt time.Time + Revoked bool +} + +type RouteView struct { + Fingerprint string + Provider string + Enabled bool + Grants []GrantView +} + +func Open(stateDir string) (*Store, error) { + if !filepath.IsAbs(stateDir) || filepath.Clean(stateDir) != stateDir { + return nil, errors.New("authority state directory must be an absolute clean path") + } + fd, err := syscall.Open(stateDir, syscall.O_RDONLY|syscall.O_DIRECTORY|syscall.O_NOFOLLOW|syscall.O_CLOEXEC, 0) + if err != nil { + return nil, fmt.Errorf("authority state directory: %w", err) + } + directory := os.NewFile(uintptr(fd), stateDir) + var stat syscall.Stat_t + if err := syscall.Fstat(fd, &stat); err != nil { + directory.Close() + return nil, err + } + if stat.Mode&syscall.S_IFMT != syscall.S_IFDIR || stat.Mode&0777 != 0700 || stat.Uid != uint32(os.Geteuid()) { + directory.Close() + return nil, errors.New("authority state directory ownership or mode is invalid") + } + return &Store{directory: directory, dirUID: stat.Uid, now: time.Now}, nil +} + +func (s *Store) Close() error { return s.directory.Close() } + +func (s *Store) CreateRoute(route Route) error { + if err := validateRoute(route); err != nil { + return err + } + return s.mutate(func(data *state) error { + for _, existing := range data.Routes { + if existing.RouteID == route.RouteID { + return errors.New("route already exists") + } + } + if len(data.Routes) >= maximumRoutes { + return errors.New("route capacity reached") + } + data.Routes = append(data.Routes, route) + return nil + }) +} + +func (s *Store) SetRouteEnabled(routeID string, enabled bool) error { + if !validID(routeID) { + return errors.New("route identifier is invalid") + } + return s.mutate(func(data *state) error { + for index := range data.Routes { + if data.Routes[index].RouteID == routeID { + data.Routes[index].Enabled = enabled + return nil + } + } + return errors.New("route not found") + }) +} + +func (s *Store) RemoveRoute(routeID string) error { + return s.mutate(func(data *state) error { + found := false + routes := data.Routes[:0] + for _, route := range data.Routes { + if route.RouteID == routeID { + found = true + continue + } + routes = append(routes, route) + } + if !found { + return errors.New("route not found") + } + data.Routes = routes + now := s.now().UTC() + for index := range data.Grants { + if data.Grants[index].RouteID == routeID && data.Grants[index].RevokedAt == nil { + data.Grants[index].RevokedAt = &now + } + } + return nil + }) +} + +func (s *Store) CreateGrant(routeID, audience string, expiresAt time.Time, keyHash [32]byte) (Grant, error) { + if !validID(routeID) || !validAudience(audience) { + return Grant{}, errors.New("grant scope is invalid") + } + now := s.now().UTC() + if !expiresAt.After(now) || expiresAt.Sub(now) > 366*24*time.Hour { + return Grant{}, errors.New("grant expiry is invalid") + } + grant := Grant{GrantID: randomID(), RouteID: routeID, KeyHash: hex.EncodeToString(keyHash[:]), Audience: audience, IssuedAt: now, ExpiresAt: expiresAt.UTC()} + err := s.mutate(func(data *state) error { + found := false + for _, route := range data.Routes { + found = found || route.RouteID == routeID + } + if !found { + return errors.New("route not found") + } + if len(data.Grants) >= maximumGrants { + return errors.New("grant capacity reached") + } + for _, existing := range data.Grants { + if existing.GrantID == grant.GrantID || subtle.ConstantTimeCompare([]byte(existing.KeyHash), []byte(grant.KeyHash)) == 1 { + return errors.New("grant identity already exists") + } + } + data.Grants = append(data.Grants, grant) + return nil + }) + return grant, err +} + +func (s *Store) RevokeGrant(grantID string) error { + return s.mutate(func(data *state) error { + for index := range data.Grants { + if data.Grants[index].GrantID == grantID { + if data.Grants[index].RevokedAt == nil { + now := s.now().UTC() + data.Grants[index].RevokedAt = &now + } + return nil + } + } + return errors.New("grant not found") + }) +} + +func (s *Store) RemoveGrant(grantID string) error { + return s.mutate(func(data *state) error { + return removeGrant(data, func(grant Grant) bool { return grant.GrantID == grantID }) + }) +} + +func (s *Store) RemoveGrantsForRoute(routeID string) error { + if !validID(routeID) { + return errors.New("route identifier is invalid") + } + return s.mutate(func(data *state) error { + return removeGrant(data, func(grant Grant) bool { return grant.RouteID == routeID }) + }) +} + +func (s *Store) RemoveGrantByHash(keyHash [32]byte) error { + hash := hex.EncodeToString(keyHash[:]) + return s.mutate(func(data *state) error { + return removeGrant(data, func(grant Grant) bool { + return subtle.ConstantTimeCompare([]byte(grant.KeyHash), []byte(hash)) == 1 + }) + }) +} + +func removeGrant(data *state, matches func(Grant) bool) error { + found := false + grants := data.Grants[:0] + for _, grant := range data.Grants { + if matches(grant) { + found = true + continue + } + grants = append(grants, grant) + } + if !found { + return errors.New("grant not found") + } + data.Grants = grants + return nil +} + +func (s *Store) Authenticate(routeID, key string) (Route, GrantView, error) { + if !validID(routeID) || key == "" || len(key) > 512 { + return Route{}, GrantView{}, errors.New("route authentication failed") + } + data, err := s.read() + if err != nil { + return Route{}, GrantView{}, errors.New("route authentication failed") + } + var route Route + foundRoute := false + for _, candidate := range data.Routes { + if candidate.RouteID == routeID { + route = candidate + foundRoute = true + break + } + } + digest := sha256.Sum256([]byte(key)) + digestHex := hex.EncodeToString(digest[:]) + var matched *Grant + matches := 0 + for index := range data.Grants { + candidate := &data.Grants[index] + if subtle.ConstantTimeCompare([]byte(candidate.KeyHash), []byte(digestHex)) == 1 { + matched = candidate + matches++ + } + } + if !foundRoute || matches != 1 || matched.RouteID != routeID || !route.Enabled || matched.RevokedAt != nil || !matched.ExpiresAt.After(s.now()) { + return Route{}, GrantView{}, errors.New("route authentication failed") + } + return route, grantView(*matched), nil +} + +func (s *Store) View(routeID string) (RouteView, error) { + data, err := s.read() + if err != nil { + return RouteView{}, err + } + for _, route := range data.Routes { + if route.RouteID != routeID { + continue + } + view := RouteView{Fingerprint: Fingerprint(route.RouteID), Provider: route.Provider, Enabled: route.Enabled} + for _, grant := range data.Grants { + if grant.RouteID == routeID { + view.Grants = append(view.Grants, grantView(grant)) + } + } + return view, nil + } + return RouteView{}, errors.New("route not found") +} + +func (s *Store) Counts() (int, int, error) { + data, err := s.read() + if err != nil { + return 0, 0, err + } + return len(data.Routes), len(data.Grants), nil +} + +func (s *Store) AddFixtureAccount(account FixtureAccount) error { + if err := validateFixtureAccount(account); err != nil { + return err + } + return s.mutateFixtures(func(data *fixtureState) error { + for _, existing := range data.Accounts { + if existing.AccountID == account.AccountID && existing.Provider == account.Provider { + return errors.New("fixture account already exists") + } + } + data.Accounts = append(data.Accounts, account) + return nil + }) +} + +func (s *Store) RemoveFixtureAccount(provider, accountID string) error { + return s.mutateFixtures(func(data *fixtureState) error { + found := false + accounts := data.Accounts[:0] + for _, account := range data.Accounts { + if account.Provider == provider && account.AccountID == accountID { + found = true + continue + } + accounts = append(accounts, account) + } + if !found { + return errors.New("fixture account not found") + } + data.Accounts = accounts + return nil + }) +} + +func (s *Store) FixtureAccount(provider, accountID string) (FixtureAccount, bool, error) { + data, err := s.readFixtures() + if err != nil { + return FixtureAccount{}, false, err + } + for _, account := range data.Accounts { + if account.Provider == provider && account.AccountID == accountID { + return account, true, nil + } + } + return FixtureAccount{}, false, nil +} + +func HashKey(key string) [32]byte { return sha256.Sum256([]byte(key)) } + +func NewKey() (string, error) { + body := make([]byte, 32) + if _, err := rand.Read(body); err != nil { + return "", err + } + return base64.RawURLEncoding.EncodeToString(body), nil +} + +func NewID() string { return randomID() } + +func Fingerprint(value string) string { + digest := sha256.Sum256([]byte(value)) + return hex.EncodeToString(digest[:6]) +} + +func grantView(grant Grant) GrantView { + return GrantView{Fingerprint: Fingerprint(grant.GrantID), Audience: grant.Audience, ExpiresAt: grant.ExpiresAt, Revoked: grant.RevokedAt != nil} +} + +func validID(value string) bool { return opaqueIDPattern.MatchString(value) } +func validAccountSelector(value string) bool { + return validID(value) || accountSelectorPattern.MatchString(value) +} +func validProvider(value string) bool { return value == "claude" || value == "codex" } +func validAudience(value string) bool { return value == "workstation" || value == "buildbox-run" } + +func validateRoute(route Route) error { + if !validID(route.RouteID) || !validID(route.TenantID) || !validAccountSelector(route.AccountID) || !validProvider(route.Provider) { + return errors.New("route fields are invalid") + } + return nil +} + +func validateFixtureAccount(account FixtureAccount) error { + if !validProvider(account.Provider) || !validID(account.AccountID) || account.State != "unavailable" { + return errors.New("fixture account is invalid") + } + return nil +} + +func randomID() string { + body := make([]byte, 18) + if _, err := rand.Read(body); err != nil { + panic(err) + } + return base64.RawURLEncoding.EncodeToString(body) +} + +func (s *Store) mutate(change func(*state) error) error { + return s.withLock(syscall.LOCK_EX, func() error { + if err := s.cleanupTemps(); err != nil { + return err + } + data, err := s.readStateFile(storeName) + if err != nil { + return err + } + if err := change(&data); err != nil { + return err + } + if err := validateState(data); err != nil { + return err + } + return s.writeAtomic(storeName, data) + }) +} + +func (s *Store) read() (state, error) { + var result state + err := s.withLock(syscall.LOCK_SH, func() error { + var err error + result, err = s.readStateFile(storeName) + return err + }) + return result, err +} + +func (s *Store) mutateFixtures(change func(*fixtureState) error) error { + return s.withLock(syscall.LOCK_EX, func() error { + if err := s.cleanupTemps(); err != nil { + return err + } + data, err := s.readFixtureFile() + if err != nil { + return err + } + if err := change(&data); err != nil { + return err + } + if err := validateFixtureState(data); err != nil { + return err + } + if len(data.Accounts) == 0 { + if err := unix.Unlinkat(int(s.directory.Fd()), fixtureName, 0); err != nil && err != syscall.ENOENT { + return err + } + return s.directory.Sync() + } + return s.writeAtomic(fixtureName, data) + }) +} + +func (s *Store) readFixtures() (fixtureState, error) { + var result fixtureState + err := s.withLock(syscall.LOCK_SH, func() error { + var err error + result, err = s.readFixtureFile() + return err + }) + return result, err +} + +func (s *Store) withLock(operation int, run func() error) error { + fd, err := unix.Openat(int(s.directory.Fd()), lockName, syscall.O_CREAT|syscall.O_RDWR|syscall.O_NOFOLLOW|syscall.O_CLOEXEC, 0600) + if err != nil { + return err + } + lock := os.NewFile(uintptr(fd), lockName) + defer lock.Close() + if err := validateRegularFD(fd, s.dirUID); err != nil { + return err + } + if err := syscall.Flock(fd, operation); err != nil { + return err + } + defer syscall.Flock(fd, syscall.LOCK_UN) + return run() +} + +func (s *Store) readStateFile(name string) (state, error) { + body, missing, err := s.readFile(name) + if err != nil { + return state{}, err + } + if missing { + return state{Schema: storeSchema, Routes: []Route{}, Grants: []Grant{}}, nil + } + var data state + if err := strictDecode(body, &data); err != nil { + return state{}, errors.New("authority route store is invalid") + } + if err := validateState(data); err != nil { + return state{}, err + } + return data, nil +} + +func (s *Store) readFixtureFile() (fixtureState, error) { + body, missing, err := s.readFile(fixtureName) + if err != nil { + return fixtureState{}, err + } + if missing { + return fixtureState{Schema: storeSchema, Accounts: []FixtureAccount{}}, nil + } + var data fixtureState + if err := strictDecode(body, &data); err != nil { + return fixtureState{}, errors.New("authority proof account store is invalid") + } + if err := validateFixtureState(data); err != nil { + return fixtureState{}, err + } + return data, nil +} + +func (s *Store) readFile(name string) ([]byte, bool, error) { + fd, err := unix.Openat(int(s.directory.Fd()), name, syscall.O_RDONLY|syscall.O_NOFOLLOW|syscall.O_CLOEXEC, 0) + if err == syscall.ENOENT { + return nil, true, nil + } + if err != nil { + return nil, false, err + } + file := os.NewFile(uintptr(fd), name) + defer file.Close() + if err := validateRegularFD(fd, s.dirUID); err != nil { + return nil, false, err + } + body, err := io.ReadAll(io.LimitReader(file, maximumState+1)) + if err != nil { + return nil, false, err + } + if len(body) > maximumState { + return nil, false, errors.New("authority state exceeds size limit") + } + return body, false, nil +} + +func strictDecode(body []byte, destination any) error { + decoder := json.NewDecoder(bytes.NewReader(body)) + decoder.DisallowUnknownFields() + if err := decoder.Decode(destination); err != nil { + return err + } + if err := decoder.Decode(&struct{}{}); err != io.EOF { + return errors.New("trailing authority state") + } + return nil +} + +func validateState(data state) error { + if data.Schema != storeSchema || data.Routes == nil || data.Grants == nil || len(data.Routes) > maximumRoutes || len(data.Grants) > maximumGrants { + return errors.New("authority route store schema or cardinality is invalid") + } + routes := make(map[string]Route, len(data.Routes)) + bindings := make(map[string]string, len(data.Routes)) + for _, route := range data.Routes { + if err := validateRoute(route); err != nil { + return err + } + if _, exists := routes[route.RouteID]; exists { + return errors.New("duplicate route identifier") + } + binding := route.TenantID + "\x00" + route.Provider + "\x00" + route.AccountID + if existing, exists := bindings[binding]; exists && existing != route.RouteID { + return errors.New("duplicate exact account route") + } + routes[route.RouteID] = route + bindings[binding] = route.RouteID + } + grantIDs := make(map[string]struct{}, len(data.Grants)) + hashes := make(map[string]string, len(data.Grants)) + for _, grant := range data.Grants { + if !validID(grant.GrantID) || !validID(grant.RouteID) || !validAudience(grant.Audience) || !validHash(grant.KeyHash) || grant.IssuedAt.IsZero() || grant.ExpiresAt.IsZero() || !grant.ExpiresAt.After(grant.IssuedAt) { + return errors.New("grant fields are invalid") + } + if grant.RevokedAt != nil && grant.RevokedAt.Before(grant.IssuedAt) { + return errors.New("grant revocation is invalid") + } + if _, exists := routes[grant.RouteID]; !exists { + return errors.New("grant references an unknown route") + } + if _, exists := grantIDs[grant.GrantID]; exists { + return errors.New("duplicate grant identifier") + } + if existingRoute, exists := hashes[grant.KeyHash]; exists && existingRoute != "" { + return errors.New("duplicate grant key hash") + } + grantIDs[grant.GrantID] = struct{}{} + hashes[grant.KeyHash] = grant.RouteID + } + return nil +} + +func validateFixtureState(data fixtureState) error { + if data.Schema != storeSchema || data.Accounts == nil || len(data.Accounts) > 8 { + return errors.New("authority proof account store is invalid") + } + seen := map[string]struct{}{} + for _, account := range data.Accounts { + if err := validateFixtureAccount(account); err != nil { + return err + } + key := account.Provider + "\x00" + account.AccountID + if _, exists := seen[key]; exists { + return errors.New("duplicate fixture account") + } + seen[key] = struct{}{} + } + return nil +} + +func validHash(value string) bool { + if len(value) != sha256.Size*2 || value != strings.ToLower(value) { + return false + } + _, err := hex.DecodeString(value) + return err == nil +} + +func validateRegularFD(fd int, owner uint32) error { + var stat syscall.Stat_t + if err := syscall.Fstat(fd, &stat); err != nil { + return err + } + if stat.Mode&syscall.S_IFMT != syscall.S_IFREG || stat.Mode&0777 != 0600 || stat.Uid != owner || stat.Nlink != 1 { + return errors.New("authority state file ownership, type, link count, or mode is invalid") + } + return nil +} + +func (s *Store) writeAtomic(name string, value any) error { + body, err := json.MarshalIndent(value, "", " ") + if err != nil { + return err + } + body = append(body, '\n') + temporary := ".authority-routes." + randomID() + ".tmp" + fd, err := unix.Openat(int(s.directory.Fd()), temporary, syscall.O_CREAT|syscall.O_EXCL|syscall.O_WRONLY|syscall.O_NOFOLLOW|syscall.O_CLOEXEC, 0600) + if err != nil { + return err + } + file := os.NewFile(uintptr(fd), temporary) + committed := false + defer func() { + file.Close() + if !committed { + _ = unix.Unlinkat(int(s.directory.Fd()), temporary, 0) + } + }() + if err := validateRegularFD(fd, s.dirUID); err != nil { + return err + } + if _, err := file.Write(body); err != nil { + return err + } + if err := file.Sync(); err != nil { + return err + } + if err := file.Close(); err != nil { + return err + } + if err := unix.Renameat(int(s.directory.Fd()), temporary, int(s.directory.Fd()), name); err != nil { + return err + } + if err := s.directory.Sync(); err != nil { + return err + } + committed = true + return nil +} + +func (s *Store) cleanupTemps() error { + entries, err := s.directory.Readdirnames(-1) + if err != nil { + return err + } + if _, err := s.directory.Seek(0, 0); err != nil { + return err + } + for _, name := range entries { + if !strings.HasPrefix(name, ".authority-routes.") || !strings.HasSuffix(name, ".tmp") { + continue + } + fd, err := unix.Openat(int(s.directory.Fd()), name, syscall.O_RDONLY|syscall.O_NOFOLLOW|syscall.O_CLOEXEC, 0) + if err != nil { + return err + } + validErr := validateRegularFD(fd, s.dirUID) + syscall.Close(fd) + if validErr != nil { + return validErr + } + if err := unix.Unlinkat(int(s.directory.Fd()), name, 0); err != nil { + return err + } + } + return nil +} diff --git a/internal/authority/routes_test.go b/internal/authority/routes_test.go new file mode 100644 index 0000000..cc6a4e3 --- /dev/null +++ b/internal/authority/routes_test.go @@ -0,0 +1,266 @@ +package authority + +import ( + "os" + "path/filepath" + "strings" + "sync" + "testing" + "time" +) + +func TestRouteAcceptsExactOwnerAccountSelectorButKeepsOpaqueRouteAndTenantIDs(t *testing.T) { + dir := protectedTempDir(t) + store, err := Open(dir) + if err != nil { + t.Fatal(err) + } + defer store.Close() + route := Route{RouteID: NewID(), TenantID: NewID(), Provider: "codex", AccountID: "zync2", Enabled: true} + if err := store.CreateRoute(route); err != nil { + t.Fatalf("owner selector rejected: %v", err) + } + for _, invalid := range []string{"", "bad selector", "../escape", strings.Repeat("x", 161)} { + bad := route + bad.RouteID = NewID() + bad.AccountID = invalid + if err := store.CreateRoute(bad); err == nil { + t.Fatalf("unsafe account selector accepted: %q", invalid) + } + } +} + +func TestRouteGrantScopeExpiryRevocationAndHashing(t *testing.T) { + dir := protectedTempDir(t) + if err := os.Chmod(dir, 0700); err != nil { + t.Fatal(err) + } + store, err := Open(dir) + if err != nil { + t.Fatal(err) + } + now := time.Date(2026, 8, 18, 12, 0, 0, 0, time.UTC) + store.now = func() time.Time { return now } + route := Route{RouteID: NewID(), TenantID: NewID(), Provider: "claude", AccountID: NewID(), Enabled: true} + wrong := Route{RouteID: NewID(), TenantID: route.TenantID, Provider: "claude", AccountID: NewID(), Enabled: true} + if err := store.CreateRoute(route); err != nil { + t.Fatal(err) + } + if err := store.CreateRoute(wrong); err != nil { + t.Fatal(err) + } + key := "synthetic-proof-key" + grant, err := store.CreateGrant(route.RouteID, "workstation", now.Add(time.Minute), HashKey(key)) + if err != nil { + t.Fatal(err) + } + body, err := os.ReadFile(filepath.Join(dir, storeName)) + if err != nil { + t.Fatal(err) + } + if strings.Contains(string(body), key) { + t.Fatal("clear proxy key persisted") + } + if _, _, err := store.Authenticate(route.RouteID, key); err != nil { + t.Fatalf("exact route rejected: %v", err) + } + if _, _, err := store.Authenticate(wrong.RouteID, key); err == nil { + t.Fatal("grant authenticated a different route") + } + store.now = func() time.Time { return now.Add(2 * time.Minute) } + if _, _, err := store.Authenticate(route.RouteID, key); err == nil { + t.Fatal("expired grant authenticated") + } + store.now = func() time.Time { return now } + if err := store.RevokeGrant(grant.GrantID); err != nil { + t.Fatal(err) + } + if _, _, err := store.Authenticate(route.RouteID, key); err == nil { + t.Fatal("revoked grant authenticated") + } +} + +func TestConcurrentMutationsRereadUnderCrossProcessLock(t *testing.T) { + dir := protectedTempDir(t) + if err := os.Chmod(dir, 0700); err != nil { + t.Fatal(err) + } + store, err := Open(dir) + if err != nil { + t.Fatal(err) + } + const count = 12 + var wait sync.WaitGroup + errors := make(chan error, count) + for index := 0; index < count; index++ { + wait.Add(1) + go func() { + defer wait.Done() + errors <- store.CreateRoute(Route{RouteID: NewID(), TenantID: NewID(), Provider: "codex", AccountID: NewID()}) + }() + } + wait.Wait() + close(errors) + for err := range errors { + if err != nil { + t.Fatal(err) + } + } + routes, grants, err := store.Counts() + if err != nil { + t.Fatal(err) + } + if routes != count || grants != 0 { + t.Fatalf("counts = %d, %d", routes, grants) + } + info, err := os.Stat(filepath.Join(dir, storeName)) + if err != nil { + t.Fatal(err) + } + if info.Mode().Perm() != 0600 { + t.Fatalf("store mode = %o", info.Mode().Perm()) + } +} + +func TestStrictStateRejectsUnknownTrailingInvalidAndDuplicateFields(t *testing.T) { + cases := map[string]string{ + "unknown": `{"schema":1,"routes":[],"grants":[],"extra":true}`, + "trailing": `{"schema":1,"routes":[],"grants":[]} {}`, + "provider": `{"schema":1,"routes":[{"route_id":"abcdefghijkl","tenant_id":"mnopqrstuvwx","provider":"other","account_id":"yzABCDEFGHIJ","enabled":true}],"grants":[]}`, + "reference": `{"schema":1,"routes":[],"grants":[{"grant_id":"abcdefghijkl","route_id":"mnopqrstuvwx","key_hash":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","audience":"workstation","issued_at":"2026-08-18T00:00:00Z","expires_at":"2026-08-18T01:00:00Z","revoked_at":null}]}`, + } + for name, body := range cases { + t.Run(name, func(t *testing.T) { + dir := protectedTempDir(t) + if err := os.WriteFile(filepath.Join(dir, storeName), []byte(body), 0600); err != nil { + t.Fatal(err) + } + store, err := Open(dir) + if err != nil { + t.Fatal(err) + } + defer store.Close() + if _, _, err := store.Counts(); err == nil { + t.Fatal("invalid state accepted") + } + }) + } +} + +func TestStateRejectsDuplicateRouteGrantAndHashScopes(t *testing.T) { + dir := protectedTempDir(t) + store, err := Open(dir) + if err != nil { + t.Fatal(err) + } + defer store.Close() + route := Route{RouteID: NewID(), TenantID: NewID(), Provider: "claude", AccountID: NewID(), Enabled: true} + if err := store.CreateRoute(route); err != nil { + t.Fatal(err) + } + hash := HashKey("synthetic-unique-key") + if _, err := store.CreateGrant(route.RouteID, "workstation", time.Now().Add(time.Hour), hash); err != nil { + t.Fatal(err) + } + if _, err := store.CreateGrant(route.RouteID, "workstation", time.Now().Add(time.Hour), hash); err == nil { + t.Fatal("duplicate key hash accepted") + } + duplicateBinding := Route{RouteID: NewID(), TenantID: route.TenantID, Provider: route.Provider, AccountID: route.AccountID} + if err := store.CreateRoute(duplicateBinding); err == nil { + t.Fatal("duplicate exact route binding accepted") + } +} + +func TestPinnedDirFDRejectsSymlinkHardlinkAndMode(t *testing.T) { + t.Run("symlink-state-directory", func(t *testing.T) { + real := t.TempDir() + link := filepath.Join(t.TempDir(), "state") + if err := os.Symlink(real, link); err != nil { + t.Fatal(err) + } + if _, err := Open(link); err == nil { + t.Fatal("symlink state directory accepted") + } + }) + for _, kind := range []string{"mode", "hardlink"} { + t.Run(kind, func(t *testing.T) { + dir := protectedTempDir(t) + store, err := Open(dir) + if err != nil { + t.Fatal(err) + } + if err := store.CreateRoute(Route{RouteID: NewID(), TenantID: NewID(), Provider: "codex", AccountID: NewID()}); err != nil { + t.Fatal(err) + } + path := filepath.Join(dir, storeName) + if kind == "mode" { + if err := os.Chmod(path, 0640); err != nil { + t.Fatal(err) + } + } else if err := os.Link(path, filepath.Join(dir, "linked-state")); err != nil { + t.Fatal(err) + } + if _, _, err := store.Counts(); err == nil { + t.Fatal("unsafe state metadata accepted") + } + }) + } +} + +func TestUniqueTempCleanupIsFailClosedAndCrashSafe(t *testing.T) { + dir := protectedTempDir(t) + store, err := Open(dir) + if err != nil { + t.Fatal(err) + } + defer store.Close() + stale := filepath.Join(dir, ".authority-routes."+NewID()+".tmp") + if err := os.WriteFile(stale, []byte("incomplete"), 0600); err != nil { + t.Fatal(err) + } + if err := store.CreateRoute(Route{RouteID: NewID(), TenantID: NewID(), Provider: "claude", AccountID: NewID()}); err != nil { + t.Fatal(err) + } + if _, err := os.Stat(stale); !os.IsNotExist(err) { + t.Fatal("owned crash-stale temp was not removed") + } + unsafe := filepath.Join(dir, ".authority-routes."+NewID()+".tmp") + if err := os.WriteFile(unsafe, []byte("unsafe"), 0644); err != nil { + t.Fatal(err) + } + if err := store.CreateRoute(Route{RouteID: NewID(), TenantID: NewID(), Provider: "claude", AccountID: NewID()}); err == nil { + t.Fatal("unsafe stale temp was silently removed") + } +} + +func protectedTempDir(t *testing.T) string { + t.Helper() + dir := t.TempDir() + if err := os.Chmod(dir, 0700); err != nil { + t.Fatal(err) + } + return dir +} + +func TestFixtureAccountIsStrictUnavailableAndRemovedWithoutResidue(t *testing.T) { + + dir := protectedTempDir(t) + store, err := Open(dir) + if err != nil { + t.Fatal(err) + } + defer store.Close() + fixture := FixtureAccount{Provider: "claude", AccountID: NewID(), State: "unavailable"} + if err := store.AddFixtureAccount(fixture); err != nil { + t.Fatal(err) + } + if _, found, err := store.FixtureAccount(fixture.Provider, fixture.AccountID); err != nil || !found { + t.Fatalf("fixture lookup found=%v err=%v", found, err) + } + if err := store.RemoveFixtureAccount(fixture.Provider, fixture.AccountID); err != nil { + t.Fatal(err) + } + if _, err := os.Stat(filepath.Join(dir, fixtureName)); !os.IsNotExist(err) { + t.Fatal("empty fixture store remains") + } +} diff --git a/internal/proxy/authority_routes.go b/internal/proxy/authority_routes.go new file mode 100644 index 0000000..c57dd45 --- /dev/null +++ b/internal/proxy/authority_routes.go @@ -0,0 +1,175 @@ +package proxy + +import ( + "encoding/json" + "net/http" + "strings" + "time" + + "github.com/manaflow-ai/subrouter/internal/accounts" + "github.com/manaflow-ai/subrouter/internal/authority" +) + +func (s Server) authorityRouteHandler() http.Handler { + providerProxy := s.proxyHandler() + return http.HandlerFunc(func(response http.ResponseWriter, request *http.Request) { + routeID, providerPath, ok := splitAuthorityRoutePath(request.URL.Path) + if !ok { + authorityRouteNotFound(response) + return + } + if (providerPath == "/_subrouter" || strings.HasPrefix(providerPath, "/_subrouter/")) && providerPath != "/_subrouter/status" { + authorityRouteNotFound(response) + return + } + key, ok := authorityProxyKey(request) + if !ok { + authorityAuthError(response) + return + } + route, grant, err := s.AuthorityRoutes.Authenticate(routeID, key) + if err != nil { + authorityAuthError(response) + return + } + selectorConflict := hasAuthoritySelector(request) + stripAuthorityHeaders(request.Header) + if selectorConflict { + http.Error(response, "account selector conflicts with exact route", http.StatusConflict) + return + } + account, availability, err := s.resolveAuthorityAccount(request, route) + if err != nil { + http.Error(response, "route unavailable", http.StatusServiceUnavailable) + return + } + if providerPath == "/_subrouter/status" { + if request.Method != http.MethodGet && request.Method != http.MethodHead { + http.Error(response, "method not allowed", http.StatusMethodNotAllowed) + return + } + s.writeAuthorityRouteStatus(response, route, grant, availability) + return + } + if account == nil { + http.Error(response, "route unavailable", http.StatusServiceUnavailable) + return + } + request.URL.Path = providerPath + request.URL.RawPath = "" + request = request.WithContext(withAuthorityAccount(request.Context(), *account)) + providerProxy.ServeHTTP(response, request) + }) +} + +func (s Server) resolveAuthorityAccount(request *http.Request, route authority.Route) (*accounts.Account, string, error) { + fixture, fixtureFound, err := s.AuthorityRoutes.FixtureAccount(route.Provider, route.AccountID) + if err != nil { + return nil, "unavailable", err + } + matches := make([]accounts.Account, 0, 2) + for _, account := range s.accountListContext(request.Context()) { + if string(account.Provider) == route.Provider && accountMatches(account, route.AccountID) { + matches = append(matches, account) + } + } + if fixtureFound { + if fixture.State != "unavailable" || len(matches) != 0 { + return nil, "ambiguous", nil + } + return nil, "unavailable", nil + } + if len(matches) > 1 { + return nil, "ambiguous", nil + } + if len(matches) != 1 { + return nil, "unavailable", nil + } + account := matches[0] + if account.Token == "" || (account.AuthMode != accounts.AuthModeOAuth && account.AuthMode != accounts.AuthModeAPIKey) { + return nil, "unavailable", nil + } + return &account, "available", nil +} + +func splitAuthorityRoutePath(path string) (string, string, bool) { + if !strings.HasPrefix(path, "/r/") { + return "", "", false + } + remainder := strings.TrimPrefix(path, "/r/") + separator := strings.IndexByte(remainder, '/') + if separator < 0 { + return "", "", false + } + routeID := remainder[:separator] + providerPath := remainder[separator:] + if routeID == "" || providerPath == "" || strings.Contains(routeID, ".") || strings.Contains(routeID, "%") { + return "", "", false + } + return routeID, providerPath, true +} + +func authorityProxyKey(request *http.Request) (string, bool) { + bearer := "" + authorization := strings.TrimSpace(request.Header.Get("Authorization")) + if authorization != "" { + parts := strings.SplitN(authorization, " ", 2) + if len(parts) != 2 || !strings.EqualFold(parts[0], "Bearer") { + return "", false + } + bearer = strings.TrimSpace(parts[1]) + } + apiKey := strings.TrimSpace(request.Header.Get("X-Api-Key")) + if bearer != "" && apiKey != "" && bearer != apiKey { + return "", false + } + if bearer != "" { + return bearer, true + } + return apiKey, apiKey != "" +} + +func hasAuthoritySelector(request *http.Request) bool { + for _, name := range []string{"X-Subrouter-Account-ID", "ChatGPT-Account-ID", "X-Account-ID"} { + if strings.TrimSpace(request.Header.Get(name)) != "" { + return true + } + } + return false +} + +func stripAuthorityHeaders(headers http.Header) { + for _, name := range []string{ + "Authorization", "X-Api-Key", "X-Subrouter-Account-ID", "ChatGPT-Account-ID", "X-Account-ID", + } { + headers.Del(name) + } +} + +func authorityRouteNotFound(response http.ResponseWriter) { + http.Error(response, "route not found", http.StatusNotFound) +} + +func authorityAuthError(response http.ResponseWriter) { + response.Header().Set("WWW-Authenticate", "Bearer") + http.Error(response, "route authentication failed", http.StatusUnauthorized) +} + +func (s Server) writeAuthorityRouteStatus(response http.ResponseWriter, route authority.Route, grant authority.GrantView, availability string) { + state := "migration-required" + if availability == "available" { + state = "ready" + } else if availability == "ambiguous" { + state = "blocked" + } + response.Header().Set("Content-Type", "application/json") + _ = json.NewEncoder(response).Encode(map[string]any{ + "state": state, + "provider": route.Provider, + "route_fingerprint": authority.Fingerprint(route.RouteID), + "grant_fingerprint": grant.Fingerprint, + "grant_expires_at": grant.ExpiresAt.UTC().Format(time.RFC3339), + "grant_revoked": grant.Revoked, + "account_availability": availability, + }) +} diff --git a/internal/proxy/authority_routes_test.go b/internal/proxy/authority_routes_test.go new file mode 100644 index 0000000..afb7d38 --- /dev/null +++ b/internal/proxy/authority_routes_test.go @@ -0,0 +1,154 @@ +package proxy + +import ( + "encoding/json" + "net/http" + "net/http/httptest" + "os" + "path/filepath" + "strings" + "sync/atomic" + "testing" + "time" + + "github.com/manaflow-ai/subrouter/internal/accounts" + "github.com/manaflow-ai/subrouter/internal/authority" + "github.com/manaflow-ai/subrouter/session" +) + +func TestAuthorityRouteStatusScopeAndSelectorConflict(t *testing.T) { + dir := t.TempDir() + if err := os.Chmod(dir, 0700); err != nil { + t.Fatal(err) + } + store, err := authority.Open(dir) + if err != nil { + t.Fatal(err) + } + route := authority.Route{RouteID: authority.NewID(), TenantID: authority.NewID(), Provider: "claude", AccountID: authority.NewID(), Enabled: true} + wrong := authority.Route{RouteID: authority.NewID(), TenantID: route.TenantID, Provider: "claude", AccountID: authority.NewID(), Enabled: true} + if err := store.CreateRoute(route); err != nil { + t.Fatal(err) + } + if err := store.CreateRoute(wrong); err != nil { + t.Fatal(err) + } + if err := store.AddFixtureAccount(authority.FixtureAccount{Provider: route.Provider, AccountID: route.AccountID, State: "unavailable"}); err != nil { + t.Fatal(err) + } + key := "synthetic-route-key" + grant, err := store.CreateGrant(route.RouteID, "workstation", time.Now().Add(time.Hour), authority.HashKey(key)) + if err != nil { + t.Fatal(err) + } + var providerCalls atomic.Int32 + handler := (Server{AuthorityRoutes: store, Transport: authorityRoundTripFunc(func(*http.Request) (*http.Response, error) { + providerCalls.Add(1) + panic("synthetic unavailable route reached provider transport") + })}).Handler() + + status := authorityRequest(t, handler, route.RouteID, "/_subrouter/status", key, "") + if status.Code != http.StatusOK { + t.Fatalf("status code = %d", status.Code) + } + var payload map[string]any + if err := json.Unmarshal(status.Body.Bytes(), &payload); err != nil { + t.Fatal(err) + } + body := status.Body.String() + for _, forbidden := range []string{route.RouteID, route.TenantID, route.AccountID, key, grant.GrantID, grant.KeyHash} { + if strings.Contains(body, forbidden) { + t.Fatalf("status exposed forbidden material") + } + } + if payload["provider"] != "claude" || payload["state"] != "migration-required" || payload["account_availability"] != "unavailable" || len(payload) != 7 { + t.Fatalf("unexpected status: %v", payload) + } + + conflict := authorityRequest(t, handler, route.RouteID, "/v1/messages", key, "other-account") + if conflict.Code != http.StatusConflict { + t.Fatalf("conflict code = %d", conflict.Code) + } + unavailable := authorityRequest(t, handler, route.RouteID, "/v1/messages", key, "") + if unavailable.Code != http.StatusServiceUnavailable { + t.Fatalf("unavailable code = %d", unavailable.Code) + } + if providerCalls.Load() != 0 { + t.Fatalf("provider transport calls = %d", providerCalls.Load()) + } + wrongScope := authorityRequest(t, handler, wrong.RouteID, "/_subrouter/status", key, "") + if wrongScope.Code != http.StatusUnauthorized { + t.Fatalf("wrong scope code = %d", wrongScope.Code) + } + admin := authorityRequest(t, handler, route.RouteID, "/_subrouter/accounts", key, "") + unauthenticatedAdmin := authorityRequest(t, handler, route.RouteID, "/_subrouter/accounts", "", "") + if admin.Code != http.StatusNotFound || unauthenticatedAdmin.Code != admin.Code || unauthenticatedAdmin.Body.String() != admin.Body.String() { + t.Fatalf("routed control responses differ: authenticated=%d %q unauthenticated=%d %q", admin.Code, admin.Body.String(), unauthenticatedAdmin.Code, unauthenticatedAdmin.Body.String()) + } + if err := store.RevokeGrant(grant.GrantID); err != nil { + t.Fatal(err) + } + revoked := authorityRequest(t, handler, route.RouteID, "/_subrouter/status", key, "") + if revoked.Code != http.StatusUnauthorized { + t.Fatalf("revoked code = %d", revoked.Code) + } +} + +func TestAuthorityAccountIsResolvedExactlyOnceAndBypassesPool(t *testing.T) { + dir := t.TempDir() + if err := os.Chmod(dir, 0700); err != nil { + t.Fatal(err) + } + store, err := authority.Open(dir) + if err != nil { + t.Fatal(err) + } + defer store.Close() + accountID := authority.NewID() + route := authority.Route{RouteID: authority.NewID(), TenantID: authority.NewID(), Provider: "claude", AccountID: accountID, Enabled: true} + request := httptest.NewRequest(http.MethodPost, "/v1/messages", strings.NewReader(`{"model":"synthetic"}`)) + exact := accounts.Account{ID: accountID, Provider: accounts.ProviderClaude, AuthMode: accounts.AuthModeOAuth, Token: "synthetic-token"} + server := Server{AuthorityRoutes: store, Accounts: []accounts.Account{exact}} + resolved, availability, err := server.resolveAuthorityAccount(request, route) + if err != nil || availability != "available" || resolved == nil || resolved.ID != exact.ID || resolved.Token != exact.Token { + t.Fatalf("exact resolution account=%v availability=%q err=%v", resolved, availability, err) + } + sessions, err := session.NewStore(filepath.Join(t.TempDir(), "sessions.json")) + if err != nil { + t.Fatal(err) + } + server.Sessions = sessions + // Scheduler remains nil: selection must return the immutable authority account + // before entering any pooled scheduling path. + selected, _, _, err := server.accountForSessionProviderWithOptions( + accounts.ProviderClaude, "claude", authority.NewID(), + request.WithContext(withAuthorityAccount(request.Context(), *resolved)), accountSelectionOptions{}, + ) + if err != nil || selected.ID != exact.ID || selected.Token != exact.Token { + t.Fatalf("immutable account selection account=%v err=%v", selected, err) + } + + server.Accounts = []accounts.Account{exact, exact} + resolved, availability, err = server.resolveAuthorityAccount(request, route) + if err != nil || resolved != nil || availability != "ambiguous" { + t.Fatalf("duplicate resolution account=%v availability=%q err=%v", resolved, availability, err) + } +} + +type authorityRoundTripFunc func(*http.Request) (*http.Response, error) + +func (fn authorityRoundTripFunc) RoundTrip(request *http.Request) (*http.Response, error) { + return fn(request) +} + +func authorityRequest(t *testing.T, handler http.Handler, routeID, suffix, key, selector string) *httptest.ResponseRecorder { + t.Helper() + request := httptest.NewRequest(http.MethodGet, "/r/"+routeID+suffix, nil) + request.Header.Set("Authorization", "Bearer "+key) + if selector != "" { + request.Header.Set("X-Subrouter-Account-ID", selector) + } + response := httptest.NewRecorder() + handler.ServeHTTP(response, request) + return response +} diff --git a/internal/proxy/proxy.go b/internal/proxy/proxy.go index 80105f4..ea39537 100644 --- a/internal/proxy/proxy.go +++ b/internal/proxy/proxy.go @@ -29,6 +29,7 @@ import ( "github.com/gorilla/websocket" "github.com/manaflow-ai/subrouter/internal/accounts" agentclaude "github.com/manaflow-ai/subrouter/internal/agents/claude" + "github.com/manaflow-ai/subrouter/internal/authority" "github.com/manaflow-ai/subrouter/internal/broker" "github.com/manaflow-ai/subrouter/internal/transcript" "github.com/manaflow-ai/subrouter/selectacct" @@ -94,6 +95,7 @@ type Server struct { // LocalProxyToken protects provider proxy routes in cloud mode. Health and // readiness stay unauthenticated so supervisors can probe the daemon. LocalProxyToken string + AuthorityRoutes *authority.Store MaxBodyBytes int64 Transcripts *transcript.Recorder // CacheFlight collapses identical concurrent requests to read-heavy @@ -1025,6 +1027,9 @@ func (s Server) Handler() http.Handler { mux.HandleFunc("/_subrouter/transcripts/", s.requireAdmin(s.handleTranscriptDetail)) mux.HandleFunc("/_subrouter/bedrock-cost", s.requireAdmin(s.handleBedrockCost)) mux.HandleFunc("/_subrouter/", http.NotFound) + if s.AuthorityRoutes != nil { + mux.Handle("/r/", s.authorityRouteHandler()) + } if s.Bedrock != nil && !s.RequireSessionLease { mux.Handle("/bedrock/", s.bedrockHandler()) } @@ -4097,8 +4102,31 @@ type accountSelectionOptions struct { oauthOnly bool } +type authorityAccountContextKey struct{} + +type authorityAccountSelection struct { + account accounts.Account +} + +func withAuthorityAccount(ctx context.Context, account accounts.Account) context.Context { + return context.WithValue(ctx, authorityAccountContextKey{}, authorityAccountSelection{account: account}) +} + func (s Server) accountForSessionProviderWithOptions(provider accounts.Provider, agentType, sessionID string, r *http.Request, options accountSelectionOptions) (accounts.Account, string, string, error) { userEmail := session.ExtractUserEmail(r) + if selection, ok := r.Context().Value(authorityAccountContextKey{}).(authorityAccountSelection); ok { + account := selection.account + if account.Provider != provider || account.Token == "" || + (options.oauthOnly && account.AuthMode != accounts.AuthModeOAuth) || + (provider == accounts.ProviderCodex && chatGPTBackendPath(r.URL.Path) && account.AuthMode != accounts.AuthModeOAuth) { + return accounts.Account{}, sessionID, userEmail, errors.New("authority route account unavailable") + } + assignment, err := s.Sessions.Put(agentType, sessionID, account.ID, userEmail) + if err != nil { + return accounts.Account{}, sessionID, userEmail, err + } + return account, sessionID, assignment.UserEmail, nil + } forcedAccountID := "" if !options.ignoreForcedAccount { forcedAccountID = session.ExtractAccountID(r)