Scaled-Tech-Consulting/Gitea-Tools

fix(session): pin immutable MCP context; ban cross-host profile substitution (Closes #714) #715

Open

jcwalker3 wants to merge 5 commits from fix/issue-714-session-context-immutability into master

Author	SHA1	Message	Date
sysadmin	dc899d23c8	fix(session): require config-backed mutation authority and workspace-bound targets (#714 ) Close the #714 remediation gap left at `943d402` where env-only mutation profiles, REMOTES Timesheet defaults treated as explicit caller input, and machine-dependent Git remotes produced false greens. - Fail closed when mutations lack a config-backed profile with non-empty allowed_repositories; env ops cannot invent mutation authority. - Preserve omitted-vs-explicit org/repo provenance through the mutation gate; omitted targets bind to the verified workspace repository. - Prefer workspace-aligned Git remotes over historical Timesheet defaults in MCP _resolve and CLI resolve_remote. - Centralize deterministic config-backed mutation fixtures; migrate mutation tests off env-only authority without weakening security assertions. Full suite: 2744 passed, 6 skipped.	2026-07-15 21:13:21 -04:00
sysadminandClaude Opus 4.8	943d40270e	fix(session): bind workspace-verified repository scope at first bind (#714 ) The independent review reproduced a real hole: the production first-bind path never pinned repository/org, so the drift checks it feeds were skipped. Root cause ---------- gitea_whoami, gitea_get_runtime_context, gitea_resolve_task_capability and gitea_activate_profile all seeded the session context without repository or org. First-bind-wins then made the mutation gate's later seed a no-op, and assess_session_context only compares repository/org when the bound fields are non-null. Result, reproduced in production order with the real REMOTES: after whoami: repository=None org=None same-host repo=Other-Tools -> NOT BLOCKED same-host org=Other-Org -> NOT BLOCKED cross-host -> blocked (this part always worked) Binding REMOTES defaults would not fix it: REMOTES['prgs'].repo is 'Timesheet' (a default target, not an authorization scope, see #530), so pinning it fails closed on every legitimate Gitea-Tools mutation. There was no trusted source for repository scope, so this adds one. Design ------ - New optional profile field `allowed_repositories`: canonical owner/repository slugs. An authorization boundary, never the binding itself. Config-only — no env var can widen or forge it. - The session repository is derived from the verified, workspace-aligned git remote, never from caller-supplied org/repo, and validated against that allowlist. The session binds immutably to exactly one canonical slug; org is derived from it. A profile authorizing several repositories still binds to the single verified one. - Every first-bind entry point now pins the same complete context. Activation rejects an unauthorized/unverifiable workspace. Mutations fail closed when repository/org is unverified, and a tool-level org/repo override that disagrees with the binding is rejected before the write. - A mutation request can no longer establish, complete, or replace the binding (it previously seeded from `org or REMOTES[...]`, i.e. caller-controlled). - Enforcement is opt-in per profile: a profile without the field keeps prior behaviour, so existing static-profile namespaces stay functional. First-bind-wins, immutability, the RLock, profile isolation, host/identity validation and the private pytest-only reset are unchanged. gitea_auth.get_profile() built an explicit whitelist dict and silently dropped `allowed_repositories`; the new integration tests caught that the scope was never enforced through the real path. Tests ----- New tests/test_issue_714_production_first_bind.py drives the real entry points in production order rather than constructing _SessionContext directly. Covers complete first bind via each entry point, same-host repo/org drift, Timesheet and other-repo/other-org rejection, unverified and unauthorized workspaces, caller values unable to establish the binding, concurrent init selecting one repository, and the PR #715 author path staying functional. Mutation-verified: disabling trusted derivation, override validation, the scope check, or the get_profile passthrough each fails these tests (9/8/4/5 failures). No security assertion was weakened, removed, skipped, or rewritten. Focused: 26 passed. Issue #714 total: 46 passed. Prior failing modules: 240 passed. Config/profile/remote modules: 130 passed. Full suite: 2739 passed, 6 skipped, 1 pre-existing warning, 161 subtests in 25.80s. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>	2026-07-15 16:50:41 -04:00
sysadminandClaude Opus 4.8	d936da5c87	test(session): cover reverse cross-host denial, concurrent init, repo drift (#714 ) The formal REQUEST_CHANGES review on PR #715 was resolved by the test isolation commit (`29ffe14`); the full suite is green. Auditing the required session-lifecycle coverage surfaced three gaps that the suite did not prove: - Every cross-host test pinned mdcps-reviewer and denied prgs. The reverse direction (a pinned MDCPS profile must never serve a prgs request, nor be swapped for prgs-author) was unproven. - test_parallel_calls_cannot_overwrite_established_binding binds first and then races, so concurrent initialization from an unbound context — N threads racing to first-bind, exactly one winner, no torn context — was unproven. - assess_session_context checks repository and org drift, but no test bound a repository/org and asserted a same-host mismatch fails closed. Adds three tests covering those cases. Each was mutation-verified: disabling the first-bind-wins guard, the cross-host denial, and the repository/org drift checks makes the corresponding test fail. Additive only — no production code changed and no existing security assertion weakened, skipped, or rewritten. Focused: 20 passed. Full suite: 2713 passed, 6 skipped, 1 pre-existing warning, 161 subtests passed in 23.05s. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>	2026-07-15 15:51:52 -04:00
sysadmin	29ffe1407f	fix: isolate immutable session context tests (#714 )	2026-07-15 02:26:27 -04:00
sysadminandGrok	632c568865	fix(session): pin immutable MCP context; ban cross-host profile substitution (Closes #714 ) Capability resolution and mutation gates no longer auto-switch profiles. Session profile/remote/host/identity are bound after pin or first seed, and drift or cross-host resolution fails closed before writes. Co-Authored-By: Grok <[email protected]>	2026-07-14 23:05:41 -04:00