From 606e74d11f77808880da39a9753d81e12d33d8c3 Mon Sep 17 00:00:00 2001 From: Jannes Stubbemann Date: Fri, 12 Jun 2026 02:59:32 +0200 Subject: [PATCH] cloud_tenant: company-scoped tenants, never instance-admin (#7525) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Thinking Path > - Paperclip orchestrates AI agents for zero-human companies, and a single server instance can host many companies. > - The auth middleware (`server/src/middleware/auth.ts`) supports a `cloud_tenant` mode where a trusted hosting proxy injects per-request identity headers, designed originally for one-deployment-per-tenant setups. > - In that original setup, granting every cloud tenant the `instance_admin` role was harmless; on a **shared, multi-tenant pool** it means any paying tenant is admin of the whole instance and can reach every other tenant's data. > - A tenant only needs to own its own company — which it already gets via the company membership the same code path upserts — so instance-level admin is never appropriate for `cloud_tenant` actors. > - This PR removes the `instance_admin` grant from the cloud-tenant path and pins `isInstanceAdmin: false` on the resolved actor. > - Greptile review then surfaced a follow-up gap: deployments that ran the pre-hardening build still have stale `instance_admin` rows in `instance_user_roles`, which other lookups (BetterAuth session path, board API keys, and the authorization service's own DB re-check) would still honor. > - The follow-up commit closes that gap by purging stale rows at the cloud-tenant auth boundary and by teaching the authorization service that `cloud_tenant` actors are never instance admins. > - The benefit is that shared-pool hosting becomes structurally safe: tenants are company-scoped owners, never instance admins — including on deployments upgrading from the older behavior. ## Linked Issues - Refs #966 — managed SaaS multi-tenant hosting is the deployment shape this hardening protects. - Refs #5015 — same problem space: instance-admin-scoped credentials are too broad for multi-company instances; tenants need company-scoped access. Neither issue is fully closed by this PR; it removes the instance-admin grant from the `cloud_tenant` trusted-header path specifically. ## What Changed - `server/src/middleware/auth.ts` - Removed the `instanceUserRoles` insert that granted every cloud tenant `instance_admin`; `resolveCloudTenantActor` now returns `isInstanceAdmin: false` (was `true`). - `resolveCloudTenantActor` now **deletes** any stale `instance_admin` row for the authenticated tenant user on every trusted-header request, so grants left behind by pre-hardening deployments are purged at the source (closes the Greptile P2: stale rows could otherwise re-elevate the user via the BetterAuth session path, board API keys, or the authorization service). - The function is `export`ed so it can be unit-tested directly. - `server/src/services/authorization.ts` - `authorizationService` previously re-checked `instanceUserRoles` from the DB regardless of the actor flag, which would have elevated even hardened `cloud_tenant` actors while a stale row lingered. Actors with `source === "cloud_tenant"` are now never elevated to instance admin; other board actors keep the existing lookup. - `server/src/services/authorization.ts` + `server/src/middleware/auth.ts` (follow-up commit `dc57a71c7`) - CI on the merge ref surfaced that elevation removal alone strands real cloud tenant users: board actors only ever reached `issue:read` / `issue:mutate` through instance-admin elevation (`permissionForAction` maps both to no grant key). `decide()` now grants `cloud_tenant` actors with an **active membership in the resource company** the same read surface as a same-company agent (`agent:read`, `company_scope:read`, `issue:read`, `project:read`) plus `issue:mutate` for non-viewer members — cross-company access stays denied (new `allow_company_member` reason). - `resolveCloudTenantActor` seeds the standard role-default permission grants (`ensureHumanRoleDefaultGrants`) so granted actions (e.g. `tasks:assign`, `agents:create` for owners) work without elevation. - Master-side route tests that stubbed cloud tenant actors with `isInstanceAdmin: true` now seed a real membership and assert under the hardened contract (`issue-identifier-routes`, `multilingual-issues-routes`, `issue-comment-redaction`). - Tests - `server/src/middleware/cloud-tenant-actor.test.ts` (new): cloud tenant is never instance-admin, is scoped to exactly the one company from its stack, still upserts user/company/membership, purges stale `instance_admin` rows, returns null without the server token, and maps non-owner stack roles without elevating. - `server/src/__tests__/auth-session-route.test.ts`: end-to-end middleware regression — a user with a stale `instance_admin` row stops being elevated via the session path once they authenticate through the cloud-tenant path (with a control assertion showing the pre-purge elevation). - `server/src/__tests__/authorization-service.test.ts` (embedded Postgres): a `cloud_tenant` actor with a stale `instance_admin` row in the real DB cannot cross company boundaries, while a `session` actor with the same row still resolves `allow_instance_admin`. ## Verification Run from the repo root after `pnpm install --frozen-lockfile`: ```bash cd server npx vitest run src/middleware/cloud-tenant-actor.test.ts src/__tests__/auth-session-route.test.ts # 9 tests passed npx vitest run src/__tests__/authorization-service.test.ts # 16 tests passed (embedded Postgres) pnpm typecheck # clean ``` Also ran the broader auth-related suites locally (`auth-routes`, `authz-company-access`, `better-auth`, `adapter-routes-authz`, `express5-auth-wildcard`): 8 files, 58 tests, all passing. ## Risks - **This touches authentication and authorization paths directly.** Mistakes here are security bugs in both directions; review accordingly. - **Behavioral change for existing `cloud_tenant` deployments:** tenants that previously (incorrectly) had instance-admin lose it — including the ability to see/manage other companies on the instance. This is the intended hardening, but any single-tenant deployment that relied on the cloud-tenant identity for instance administration must provision a separate admin identity. - **The purge is destructive by design:** if an operator's instance-admin identity is *also* provisioned through the cloud-tenant headers (same user id), its `instance_admin` row will be deleted on the next trusted-header request. Operators should hold admin through a non-cloud-tenant identity. - **Residual gap (documented, not fixed here):** a deployment that ran the old cloud_tenant build and then *disabled* cloud-tenant mode keeps stale rows until the affected user re-authenticates through the cloud path. A data migration was considered and deliberately avoided: there is no reliable SQL predicate for "cloud-tenant-provisioned user" (no source column), so a migration risks deleting legitimate admins. - No schema or migration changes; no UI changes. ## Model Used - Claude Fable 5 (claude-fable-5, 1M context), extended thinking + tool use, via Claude Code — this revision; original PR authored in an earlier Claude Code session. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above (none duplicate this; related issues Refs #966 / #5015 are linked in the issue section) - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] If this change affects the UI, I have included before/after screenshots (no UI changes) - [x] I have updated relevant documentation to reflect my changes (no existing docs reference `cloud_tenant` mode) - [x] I have considered and documented any risks above - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Claude Opus 4.8 (1M context) --- .../src/__tests__/auth-session-route.test.ts | 84 +++++++++++++- .../__tests__/authorization-service.test.ts | 42 +++++++ .../__tests__/issue-comment-redaction.test.ts | 14 ++- .../__tests__/issue-identifier-routes.test.ts | 25 ++++- .../multilingual-issues-routes.test.ts | 14 ++- server/src/middleware/auth.ts | 31 ++++-- .../src/middleware/cloud-tenant-actor.test.ts | 105 ++++++++++++++++++ server/src/services/authorization.ts | 38 ++++++- 8 files changed, 335 insertions(+), 18 deletions(-) create mode 100644 server/src/middleware/cloud-tenant-actor.test.ts diff --git a/server/src/__tests__/auth-session-route.test.ts b/server/src/__tests__/auth-session-route.test.ts index 65f6cbd3..549ebd71 100644 --- a/server/src/__tests__/auth-session-route.test.ts +++ b/server/src/__tests__/auth-session-route.test.ts @@ -1,6 +1,7 @@ import express from "express"; import request from "supertest"; import { afterEach, describe, expect, it, vi } from "vitest"; +import { instanceUserRoles } from "@paperclipai/db"; import { actorMiddleware } from "../middleware/auth.js"; function createSelectChain(rows: unknown[]) { @@ -92,6 +93,7 @@ describe("actorMiddleware authenticated session profile", () => { }; return chain; }), + delete: vi.fn(() => ({ where: () => Promise.resolve(undefined) })), select: vi.fn(), } as any; const app = express(); @@ -122,10 +124,12 @@ describe("actorMiddleware authenticated session profile", () => { userName: "Stack Owner", userEmail: "owner@example.com", source: "cloud_tenant", - isInstanceAdmin: true, + isInstanceAdmin: false, memberships: [expect.objectContaining({ membershipRole: "owner", status: "active" })], }); expect(res.body.companyIds[0]).toMatch(/^[0-9a-f-]{36}$/); + // authUsers, companies, companyMemberships, and the role-default + // principalPermissionGrants seeded in place of instance-admin elevation. expect(inserts).toHaveLength(4); expect(inserts[0]?.values).toMatchObject({ id: "global-user-1", @@ -133,4 +137,82 @@ describe("actorMiddleware authenticated session profile", () => { emailVerified: true, }); }); + + it("purges a stale instance_admin row so the session path stops elevating the cloud-tenant user", async () => { + process.env.PAPERCLIP_CLOUD_TENANT_SERVER_TOKEN = "tenant-token"; + // Simulates a deployment that previously ran the pre-hardening cloud_tenant + // path: instance_user_roles still holds an instance_admin row for the + // tenant user, who can also resolve a BetterAuth session for the same id. + const state = { staleInstanceAdminRow: true }; + const insertChain = { + values() { + return insertChain; + }, + onConflictDoUpdate() { + return insertChain; + }, + onConflictDoNothing() { + return insertChain; + }, + returning() { + return Promise.resolve([{ companyId: "company-1", membershipRole: "owner", status: "active" }]); + }, + then(resolve: (value: unknown) => unknown) { + return Promise.resolve(undefined).then(resolve); + }, + }; + const db = { + select: vi.fn(() => ({ + from: (table: unknown) => ({ + where: () => + Promise.resolve( + table === instanceUserRoles && state.staleInstanceAdminRow ? [{ id: "stale-role-row" }] : [], + ), + }), + })), + insert: vi.fn(() => insertChain), + delete: vi.fn((table: unknown) => ({ + where: () => { + if (table === instanceUserRoles) state.staleInstanceAdminRow = false; + return Promise.resolve(undefined); + }, + })), + } as any; + const app = express(); + app.use( + actorMiddleware(db, { + deploymentMode: "authenticated", + resolveSession: async () => ({ + session: { id: "session-1", userId: "global-user-1" }, + user: { id: "global-user-1", name: "Stack Owner", email: "owner@example.com" }, + }), + }), + ); + app.get("/actor", (req, res) => { + res.json(req.actor); + }); + + // Control: while the stale row exists, the session path still elevates. + const before = await request(app).get("/actor"); + expect(before.body).toMatchObject({ source: "session", isInstanceAdmin: true }); + + // One trusted-header authentication purges the stale grant. + const cloud = await request(app) + .get("/actor") + .set("x-paperclip-cloud-tenant-token", "tenant-token") + .set("x-paperclip-cloud-user-id", "global-user-1") + .set("x-paperclip-cloud-user-email", "owner@example.com") + .set("x-paperclip-cloud-stack-id", "stack-alpha") + .set("x-paperclip-cloud-stack-role", "owner"); + expect(cloud.body).toMatchObject({ source: "cloud_tenant", isInstanceAdmin: false }); + expect(state.staleInstanceAdminRow).toBe(false); + + // The same user no longer gets instance admin via the session path. + const after = await request(app).get("/actor"); + expect(after.body).toMatchObject({ + source: "session", + userId: "global-user-1", + isInstanceAdmin: false, + }); + }); }); diff --git a/server/src/__tests__/authorization-service.test.ts b/server/src/__tests__/authorization-service.test.ts index 1d156105..426ab9c8 100644 --- a/server/src/__tests__/authorization-service.test.ts +++ b/server/src/__tests__/authorization-service.test.ts @@ -681,6 +681,48 @@ describeEmbeddedPostgres("authorization service", () => { }); }); + it("never elevates cloud_tenant actors through stale instance_admin rows", async () => { + const tenantCompany = await createCompany(db, "CloudTenantStale"); + const otherCompany = await createCompany(db, "CloudTenantOther"); + const userId = `user-${randomUUID()}`; + const targetAgent = await createAgent(db, otherCompany.id, { role: "engineer" }); + await db.insert(companyMemberships).values({ + companyId: tenantCompany.id, + principalType: "user", + principalId: userId, + status: "active", + membershipRole: "owner", + }); + // Stale grant left behind by a pre-hardening cloud_tenant deployment. + await db.insert(instanceUserRoles).values({ userId, role: "instance_admin" }); + + const decision = await authorizationService(db).decide({ + actor: { + type: "board", + userId, + companyIds: [tenantCompany.id], + isInstanceAdmin: false, + source: "cloud_tenant", + }, + action: "tasks:assign", + resource: { type: "issue", companyId: otherCompany.id, assigneeAgentId: targetAgent.id }, + scope: { assigneeAgentId: targetAgent.id }, + }); + + expect(decision.allowed).toBe(false); + expect(decision.reason).not.toBe("allow_instance_admin"); + + // Control: the instanceUserRoles lookup still elevates non-cloud_tenant + // board actors, so the carve-out is scoped to the tenant contract only. + const sessionDecision = await authorizationService(db).decide({ + actor: { type: "board", userId, companyIds: [tenantCompany.id], source: "session" }, + action: "tasks:assign", + resource: { type: "issue", companyId: otherCompany.id, assigneeAgentId: targetAgent.id }, + scope: { assigneeAgentId: targetAgent.id }, + }); + expect(sessionDecision).toMatchObject({ allowed: true, reason: "allow_instance_admin" }); + }); + it("denies simple-mode assignment to a target agent from another company", async () => { const sourceCompany = await createCompany(db, "AssignmentSource"); const targetCompany = await createCompany(db, "AssignmentTarget"); diff --git a/server/src/__tests__/issue-comment-redaction.test.ts b/server/src/__tests__/issue-comment-redaction.test.ts index 45e08d18..d5339205 100644 --- a/server/src/__tests__/issue-comment-redaction.test.ts +++ b/server/src/__tests__/issue-comment-redaction.test.ts @@ -5,6 +5,7 @@ import { sql } from "drizzle-orm"; import { afterAll, afterEach, beforeAll, describe, expect, it, vi } from "vitest"; import { companies, + companyMemberships, createDb, issueComments, issueReferenceMentions, @@ -46,6 +47,7 @@ describeEmbeddedPostgres("deleted issue comment redaction", () => { await db.delete(issueReferenceMentions); await db.delete(issueComments); await db.delete(issues); + await db.delete(companyMemberships); await db.delete(companies); }); @@ -70,6 +72,14 @@ describeEmbeddedPostgres("deleted issue comment redaction", () => { status: "todo", priority: "medium", }); + await db.insert(companyMemberships).values({ + companyId, + principalType: "user", + principalId: "board-user-1", + status: "active", + membershipRole: "owner", + updatedAt: new Date(), + }); return { companyId, issueId }; } @@ -83,7 +93,9 @@ describeEmbeddedPostgres("deleted issue comment redaction", () => { companyIds: [companyId], memberships: [{ companyId, membershipRole: "owner", status: "active" }], source: "cloud_tenant", - isInstanceAdmin: true, + // cloud_tenant actors are never instance admins — reads flow through + // the active company membership seeded in seedIssue(). + isInstanceAdmin: false, }; next(); }); diff --git a/server/src/__tests__/issue-identifier-routes.test.ts b/server/src/__tests__/issue-identifier-routes.test.ts index 1a204db5..2ad2e467 100644 --- a/server/src/__tests__/issue-identifier-routes.test.ts +++ b/server/src/__tests__/issue-identifier-routes.test.ts @@ -3,13 +3,14 @@ import express from "express"; import request from "supertest"; import { afterAll, beforeAll, describe, expect, it } from "vitest"; import { eq } from "drizzle-orm"; -import { companies, createDb, issues } from "@paperclipai/db"; +import { companies, companyMemberships, createDb, issues } from "@paperclipai/db"; import { getEmbeddedPostgresTestSupport, startEmbeddedPostgresTestDatabase, } from "./helpers/embedded-postgres.js"; import { errorHandler } from "../middleware/index.js"; import { issueRoutes } from "../routes/issues.js"; +import { ensureHumanRoleDefaultGrants } from "../services/principal-access-compatibility.js"; const embeddedPostgresSupport = await getEmbeddedPostgresTestSupport(); const describeEmbeddedPostgres = embeddedPostgresSupport.supported ? describe : describe.skip; @@ -43,7 +44,9 @@ describeEmbeddedPostgres("issue identifier routes", () => { companyIds: [companyId], memberships: [{ companyId, membershipRole: "owner", status: "active" }], source: "cloud_tenant", - isInstanceAdmin: true, + // cloud_tenant actors are never instance admins — access flows through + // company-scoped membership grants, seeded per test company below. + isInstanceAdmin: false, }; next(); }); @@ -52,6 +55,23 @@ describeEmbeddedPostgres("issue identifier routes", () => { return app; } + async function seedCloudTenantMember(companyId: string) { + await db.insert(companyMemberships).values({ + companyId, + principalType: "user", + principalId: "cloud-user-1", + status: "active", + membershipRole: "owner", + updatedAt: new Date(), + }); + await ensureHumanRoleDefaultGrants(db, { + companyId, + principalId: "cloud-user-1", + membershipRole: "owner", + grantedByUserId: null, + }); + } + it("resolves alphanumeric Cloud tenant issue identifiers for detail reads and updates", async () => { const companyId = randomUUID(); const issueId = randomUUID(); @@ -62,6 +82,7 @@ describeEmbeddedPostgres("issue identifier routes", () => { issuePrefix: "PC1A2", requireBoardApprovalForNewAgents: false, }); + await seedCloudTenantMember(companyId); await db.insert(issues).values({ id: issueId, companyId, diff --git a/server/src/__tests__/multilingual-issues-routes.test.ts b/server/src/__tests__/multilingual-issues-routes.test.ts index da9f0aa3..4b0eac47 100644 --- a/server/src/__tests__/multilingual-issues-routes.test.ts +++ b/server/src/__tests__/multilingual-issues-routes.test.ts @@ -2,7 +2,7 @@ import { randomUUID } from "node:crypto"; import express from "express"; import request from "supertest"; import { afterAll, beforeAll, describe, expect, it, vi } from "vitest"; -import { companies, createDb } from "@paperclipai/db"; +import { companies, companyMemberships, createDb } from "@paperclipai/db"; import { getEmbeddedPostgresTestSupport, startEmbeddedPostgresTestDatabase, @@ -62,6 +62,14 @@ describeEmbeddedPostgres("multilingual issue routes", () => { issuePrefix: "LNG", requireBoardApprovalForNewAgents: false, }); + await db.insert(companyMemberships).values({ + companyId, + principalType: "user", + principalId: "cloud-user-1", + status: "active", + membershipRole: "owner", + updatedAt: new Date(), + }); }, 20_000); afterAll(async () => { @@ -92,7 +100,9 @@ describeEmbeddedPostgres("multilingual issue routes", () => { companyIds: [companyId], memberships: [{ companyId, membershipRole: "owner", status: "active" }], source: "cloud_tenant", - isInstanceAdmin: true, + // cloud_tenant actors are never instance admins — reads flow through + // the active company membership seeded in beforeAll. + isInstanceAdmin: false, }; next(); }); diff --git a/server/src/middleware/auth.ts b/server/src/middleware/auth.ts index ad0b4289..c0cbf954 100644 --- a/server/src/middleware/auth.ts +++ b/server/src/middleware/auth.ts @@ -8,6 +8,7 @@ import type { DeploymentMode } from "@paperclipai/shared"; import type { BetterAuthSessionResult } from "../auth/better-auth.js"; import { logger } from "./logger.js"; import { boardAuthService } from "../services/board-auth.js"; +import { ensureHumanRoleDefaultGrants } from "../services/principal-access-compatibility.js"; function hashToken(token: string) { return createHash("sha256").update(token).digest("hex"); @@ -199,7 +200,7 @@ export function actorMiddleware(db: Db, opts: ActorMiddlewareOptions): RequestHa }; } -async function resolveCloudTenantActor(db: Db, req: Request): Promise { +export async function resolveCloudTenantActor(db: Db, req: Request): Promise { const expectedToken = process.env.PAPERCLIP_CLOUD_TENANT_SERVER_TOKEN?.trim(); if (!expectedToken) return null; @@ -237,16 +238,14 @@ async function resolveCloudTenantActor(db: Db, req: Request): Promise = {}; + chain.values = () => chain; + chain.onConflictDoUpdate = () => chain; + chain.onConflictDoNothing = () => chain; + chain.where = () => chain; + chain.returning = async () => [membershipRow]; + chain.then = (resolve: (v: unknown) => unknown) => Promise.resolve(undefined).then(resolve); + const db = { + insert: (table: unknown) => { + insertedTables.push(table); + return chain; + }, + delete: (table: unknown) => { + deletedTables.push(table); + return chain; + }, + } as unknown as Db; + return { db, insertedTables, deletedTables }; +} + +function fakeReq(headers: Record): Request { + const lower: Record = {}; + for (const [k, v] of Object.entries(headers)) lower[k.toLowerCase()] = v; + return { header: (name: string) => lower[name.toLowerCase()] } as unknown as Request; +} + +const VALID_HEADERS = { + "x-paperclip-cloud-tenant-token": "test-server-token", + "x-paperclip-cloud-user-id": "user-123", + "x-paperclip-cloud-user-email": "Owner@Example.com", + "x-paperclip-cloud-stack-id": "stack-abc", + "x-paperclip-cloud-stack-role": "owner", +}; + +describe("resolveCloudTenantActor (shared-pool hardening)", () => { + beforeEach(() => { + process.env.PAPERCLIP_CLOUD_TENANT_SERVER_TOKEN = "test-server-token"; + }); + afterEach(() => { + delete process.env.PAPERCLIP_CLOUD_TENANT_SERVER_TOKEN; + }); + + it("never grants instance admin", async () => { + const { db, insertedTables } = createFakeDb(); + const actor = await resolveCloudTenantActor(db, fakeReq(VALID_HEADERS)); + expect(actor).not.toBeNull(); + expect(actor!.isInstanceAdmin).toBe(false); + expect(insertedTables).not.toContain(instanceUserRoles); + }); + + it("is scoped to exactly the one company from its stack", async () => { + const { db } = createFakeDb(); + const actor = await resolveCloudTenantActor(db, fakeReq(VALID_HEADERS)); + expect(actor!.companyIds).toHaveLength(1); + expect(actor!.memberships).toHaveLength(1); + expect(actor?.memberships?.[0]?.companyId).toBe(actor?.companyIds?.[0]); + expect(actor?.memberships?.[0]?.membershipRole).toBe("owner"); + expect(actor!.source).toBe("cloud_tenant"); + }); + + it("purges stale instance_admin rows left by pre-hardening deployments", async () => { + const { db, deletedTables } = createFakeDb(); + const actor = await resolveCloudTenantActor(db, fakeReq(VALID_HEADERS)); + expect(actor).not.toBeNull(); + expect(deletedTables).toContain(instanceUserRoles); + }); + + it("still upserts the user, company, and membership", async () => { + const { db, insertedTables } = createFakeDb(); + await resolveCloudTenantActor(db, fakeReq(VALID_HEADERS)); + expect(insertedTables).toContain(authUsers); + expect(insertedTables).toContain(companies); + expect(insertedTables).toContain(companyMemberships); + }); + + it("returns null when the server token is unset", async () => { + delete process.env.PAPERCLIP_CLOUD_TENANT_SERVER_TOKEN; + const { db } = createFakeDb(); + const actor = await resolveCloudTenantActor(db, fakeReq(VALID_HEADERS)); + expect(actor).toBeNull(); + }); + + it("maps a non-owner stack role through to the membership without elevating", async () => { + const { db } = createFakeDb({ companyId: "company-y", membershipRole: "member", status: "active" }); + const actor = await resolveCloudTenantActor( + db, + fakeReq({ ...VALID_HEADERS, "x-paperclip-cloud-stack-role": "member" }), + ); + expect(actor!.isInstanceAdmin).toBe(false); + expect(actor?.memberships?.[0]?.membershipRole).toBe("member"); + }); +}); diff --git a/server/src/services/authorization.ts b/server/src/services/authorization.ts index df7af2a5..50aff187 100644 --- a/server/src/services/authorization.ts +++ b/server/src/services/authorization.ts @@ -78,6 +78,7 @@ export type AuthorizationDecision = { | "allow_legacy_agent_creator" | "allow_self" | "allow_company_agent" + | "allow_company_member" | "allow_simple_company_member" | "allow_manager_chain" | "deny_unauthenticated" @@ -922,13 +923,48 @@ export function authorizationService(db: Db) { explanation: "Allowed because the actor is the local implicit board.", }); } - if (input.actor.isInstanceAdmin || await isInstanceAdmin(input.actor.userId)) { + // cloud_tenant actors are company-scoped by contract and must never be + // elevated — not even via stale instance_admin rows left behind by + // deployments that ran the pre-hardening cloud_tenant path. + if ( + input.actor.source !== "cloud_tenant" && + (input.actor.isInstanceAdmin || await isInstanceAdmin(input.actor.userId)) + ) { return allow({ action: input.action, reason: "allow_instance_admin", explanation: "Allowed because the actor is an instance admin.", }); } + // What instance-admin elevation used to give cloud tenant users is + // replaced by company-scoped visibility: an active membership in the + // resource company grants the same read surface a same-company agent + // gets, and non-viewer members may mutate issues inside their company. + // Cross-company access stays denied. + if (input.actor.source === "cloud_tenant" && input.actor.userId) { + const membership = await getActiveMembership(companyId, "user", input.actor.userId); + if (membership) { + if ( + input.action === "agent:read" || + input.action === "company_scope:read" || + input.action === "issue:read" || + input.action === "project:read" + ) { + return allow({ + action: input.action, + reason: "allow_company_member", + explanation: "Allowed by active cloud tenant company membership.", + }); + } + if (input.action === "issue:mutate" && membership.membershipRole !== "viewer") { + return allow({ + action: input.action, + reason: "allow_company_member", + explanation: "Allowed by active cloud tenant company membership.", + }); + } + } + } if (!input.actor.userId) { return deny({ action: input.action,