mirror of
https://gh-proxy.org/https://github.com/klinsmaya/multica.git
synced 2026-11-09 01:46:46 +08:00
Bohan JiangandCatCatUncle
3ac53a68a6
Autopilot write endpoints judged the request's authenticated user, which under
a mat_ task token is the RUNTIME OWNER. Any member could therefore @ an agent
running on someone else's machine and spend that machine owner's autopilot
rights — pause a rule, re-point a webhook, rotate a token, or grant themselves
a collaborator row.
Every write on this surface now resolves the human it acts FOR (a member acts
for themselves, an agent for its run's originator), through one seam, and
stamps that same human into created_by / published_by / granted_by and the
rule versions. The gate and the row can no longer name two different people.
Two bypasses of that gate are closed with it:
- The webhook credential was broadcast to the whole workspace on
autopilot:updated, handing every member the token GetAutopilot had just
redacted for them. All five trigger fan-outs now carry a redacted copy; the
HTTP caller still gets the live value.
- Agent identity itself was forgeable: Auth stripped only X-Actor-Source, so a
member could replay an observable (agent_id, task_id) pair — both returned by
GET /api/issues/{id}/task-runs — and be resolved as that agent. Auth and
DaemonAuth now strip both headers, leaving the mat_ branch as the only writer
of agent identity.
That last part is MUL-3428, reported and fixed by @CatCatUncle in #4313; it is
carried here because this change cannot be correct on top of a forgeable actor.
Behavior tightening, no migration: the only path it breaks is a member changing
an autopilot they hold no grant on. A run with no originator can no longer
write here.
Co-authored-by: CatCatUncle <[email protected]>