mirror of
https://gh-proxy.org/https://github.com/klinsmaya/multica.git
synced 2026-11-08 09:26:50 +08:00
* fix(daemon): enforce runtime ownership on daemon routes (MUL-8154) /api/daemon/* accepts any workspace member's PAT/JWT, and authorization only checked workspace membership. Any member could claim another member's tasks (receiving the agent's custom_env, MCP config and an owner-scoped task token), write task results/messages, and take a runtime over by re-registering its daemon_id. - Runtime-level check on every runtime/task daemon route, HTTP heartbeat, deregister, batch claim (and so the WS claim RPC) and the WS handshake: user credentials must own the runtime (NULL owner fails closed); daemon tokens must match a non-empty runtime daemon_id. - Register: pre-check that every existing row on the daemon_id belongs to the caller, plus a required_owner_id fence in both upserts (incl. the failed-profile path) so a concurrent registration cannot win the row. Daemon-token registration keeps the existing owner. - Legacy merge: only for user-credential registrations, and only when the caller owns both rows, verified on the FOR UPDATE-locked rows. - Tasks without a runtime are not writable through daemon routes; status stays readable. - GetTaskStatus / WS lease queries carry runtime owner/daemon so the hot paths keep one round trip. Co-authored-by: multica-agent <[email protected]> * test(daemon): authenticate fixtures as the runtime owner (MUL-8154) Most handler tests drove daemon routes with a daemon token whose daemon_id did not match the fixture runtime, relying on the workspace-wide token scope this fix removes. They now authenticate the way real daemons do, with the runtime owner's user credential (newOwnerDaemonRequest). Tests about daemon token scoping keep mdt_ and get fixtures with a matching daemon_id; the ownerless-runtime tests also assert that a user credential is refused. Co-authored-by: multica-agent <[email protected]> * fix(daemon): serialize registration per daemon and keep Qoder WS claims working (MUL-8154) Review of #9423: - P1: the owner pre-check and the per-provider/profile upserts hit different conflict keys, so two members registering different providers of the same daemon could both pass the pre-check and both insert, leaving one daemon with two owners (and a daemon token for either runtime reaching the other's). Registration now runs the pre-check and every runtime write in one transaction under a pg_advisory_xact_lock on (workspace_id, daemon_id), on a single connection so queued registrations cannot starve the holder. Legacy merges, analytics and the register event run after commit; failed-profile records use savepoints so they stay best-effort. - P2: the Qoder revocation check read the Authorization header, which the WS RPC bridge's in-process request does not carry, so valid Qoder WS claims silently returned nothing. DaemonAuth now records the mdt_ token hash in the request context, the WS identity keeps it, the RPC bridge re-attaches it, and the check validates that hash on every call (revocation still applies to an open connection). - Regression tests for cross-provider and provider+profile concurrent registration, and for valid/revoked Qoder credentials over WS RPC. Co-authored-by: multica-agent <[email protected]> * fix(daemon): bind daemon tokens to the runtime owner they were issued for (MUL-8154) Second review of #9423: a daemon_id can be re-registered by another member after its runtimes are deleted, and a daemon token was bound only to (workspace, daemon_id), so the previous owner's Remote MCP token reached the new owner's runtime (heartbeat, claim, owner-scoped task token). - daemon_token.owner_id (migration 588). Remote MCP tokens are bound to the locked runtime owner inside FinalizeTaskClaim; live tokens are backfilled only where their daemon has exactly one owner. - DaemonAuth carries the owner binding (DB and cache; cache key bumped to v2 so pre-upgrade entries are never read), the WS identity keeps it and the RPC bridge replays it. - Daemon-token authorization now also requires token owner == runtime owner. Qoder-managed tokens stay unbound (governed by cloud_agent_connection), and user credentials can no longer register the reserved qoder-managed-* ids. - Tests: the reuse lifecycle over HTTP, a new WS handshake and an already open WS connection; the reserved daemon_id; the concurrency barrier now hooks the registration transaction (TxStarter) so the interleaving is real. Co-authored-by: multica-agent <[email protected]> * fix(daemon): owner-bind daemon-token registration; drop unsafe token backfill (MUL-8154) Third review of #9423: - Migration 588 no longer backfills daemon_token.owner_id from the daemon's current owner: that owner may be a later re-registrant, which re-bound the previous owner's live token to them. Existing non-Qoder tokens stay NULL and are refused (24h Remote MCP credentials, re-issued on the next claim). - owner_id is a plain UUID column, no foreign key / cascade (AGENTS.md). - Register via a non-Qoder daemon token now uses the token's owner for the in-transaction pre-check and the SQL owner fence, and refuses unbound tokens. Qoder keeps its connection-based check; daemon tokens still never trigger legacy merges. - Tests: an old owner's bound token and an unbound legacy token can neither register over nor heartbeat the replacement owner's runtime. Co-authored-by: multica-agent <[email protected]> * fix(daemon): grant the Qoder registration exemption only with a live connection (MUL-8154) Fourth review of #9423: register skipped the token owner binding for any qoder-managed-* daemon token, but checked the Qoder connection only when the body declared a qoder_cloud runtime. A pre-upgrade Remote MCP token under that prefix (no owner, no connection) could register type=claude and rewrite another member's runtime. Register now verifies the token against a live cloud_agent_connection before anything else whenever the token is in the Qoder namespace, regardless of the declared runtimes, and restricts that namespace to the bridge's own shape: a built-in qoder_cloud runtime, no custom profiles, no failed_profiles. Test covers built-in, custom-profile, failed-profiles-only and qoder_cloud bodies with an unconnected token, plus the connected token's allowed and refused shapes. Co-authored-by: multica-agent <[email protected]> --------- Co-authored-by: multica-eve <[email protected]> Co-authored-by: multica-agent <[email protected]>
107 lines
3.6 KiB
Go
107 lines
3.6 KiB
Go
package handler
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"net/http"
|
|
"reflect"
|
|
"testing"
|
|
|
|
"github.com/google/uuid"
|
|
"github.com/jackc/pgx/v5/pgtype"
|
|
"github.com/multica-ai/multica/server/internal/events"
|
|
"github.com/multica-ai/multica/server/internal/middleware"
|
|
"github.com/multica-ai/multica/server/internal/testutil"
|
|
"github.com/multica-ai/multica/server/internal/util"
|
|
db "github.com/multica-ai/multica/server/pkg/db/generated"
|
|
"github.com/multica-ai/multica/server/pkg/protocol"
|
|
)
|
|
|
|
func TestTaskMessageCallIDLiveAndHistory(t *testing.T) {
|
|
if testHandler == nil {
|
|
t.Skip("database not available")
|
|
}
|
|
taskID := seedBatchTask(t, "call-id")
|
|
h := *testHandler
|
|
h.Bus = events.New()
|
|
var live []map[string]any
|
|
h.Bus.Subscribe(protocol.EventTaskMessage, func(e events.Event) {
|
|
if e.TaskID != taskID {
|
|
return
|
|
}
|
|
data, err := json.Marshal(e.Payload)
|
|
if err != nil {
|
|
t.Error(err)
|
|
return
|
|
}
|
|
var row map[string]any
|
|
if err := json.Unmarshal(data, &row); err != nil {
|
|
t.Error(err)
|
|
return
|
|
}
|
|
live = append(live, row)
|
|
})
|
|
testutil.Call(t, h.ReportTaskMessages, batchMessagesRequest(t, taskID, []any{
|
|
map[string]any{"seq": 1, "type": "tool_use", "tool": "Bash", "call_id": "attempt:A"},
|
|
map[string]any{"seq": 2, "type": "tool_use", "tool": "Bash", "call_id": "attempt:B"},
|
|
map[string]any{"seq": 3, "type": "tool_result", "tool": "Bash", "call_id": "attempt:B", "output": "B finished"},
|
|
map[string]any{"seq": 4, "type": "tool_result", "tool": "Bash", "call_id": "attempt:A", "output": "A finished"},
|
|
map[string]any{"seq": 5, "type": "tool_use", "tool": "Read"},
|
|
})).Want(http.StatusOK)
|
|
if len(live) != 5 {
|
|
t.Fatalf("got %d live events, want 5", len(live))
|
|
}
|
|
for i, want := range []string{"attempt:A", "attempt:B", "attempt:B", "attempt:A"} {
|
|
if live[i]["call_id"] != want {
|
|
t.Errorf("live row %d call_id = %v, want %s", i, live[i]["call_id"], want)
|
|
}
|
|
}
|
|
if _, ok := live[4]["call_id"]; ok {
|
|
t.Error("legacy message must omit call_id")
|
|
}
|
|
var legacyNull bool
|
|
dbfx.QueryRow(t, `SELECT call_id IS NULL FROM task_message WHERE task_id=$1 AND seq=5`, taskID).Scan(&legacyNull)
|
|
if !legacyNull {
|
|
t.Error("missing call_id must persist as NULL")
|
|
}
|
|
|
|
// Both readers and incremental reconnects must agree with the live payload.
|
|
for _, reader := range []struct {
|
|
name string
|
|
handler http.HandlerFunc
|
|
}{
|
|
{"daemon", h.ListTaskMessages}, {"user", h.ListTaskMessagesByUser},
|
|
} {
|
|
for _, suffix := range []string{"", "?since=2"} {
|
|
t.Run(reader.name+suffix, func(t *testing.T) {
|
|
req := testutil.JSONRequest(http.MethodGet, "/api/tasks/"+taskID+"/messages"+suffix, nil)
|
|
req = testutil.WithURLParams(req, "taskId", taskID)
|
|
// Both readers authenticate as the fixture runtime's owner.
|
|
req.Header.Set("X-User-ID", testUserID)
|
|
ctx := middleware.SetMemberContext(req.Context(), testWorkspaceID, db.Member{})
|
|
var history []map[string]any
|
|
testutil.Call(t, reader.handler, req.WithContext(ctx)).Want(http.StatusOK).JSON(&history)
|
|
want := live
|
|
if suffix != "" {
|
|
want = live[2:]
|
|
}
|
|
if !reflect.DeepEqual(history, want) {
|
|
t.Fatalf("history differs from live: got %+v want %+v", history, want)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
// The single-row writer is also used outside daemon batch ingestion.
|
|
row, err := h.Queries.CreateTaskMessage(context.Background(), db.CreateTaskMessageParams{
|
|
ID: pgtype.UUID{Bytes: uuid.Must(uuid.NewV7()), Valid: true},
|
|
TaskID: util.MustParseUUID(taskID), Seq: 6, Type: "tool_result",
|
|
CallID: pgtype.Text{String: "single-call", Valid: true},
|
|
})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if row.CallID.String != "single-call" {
|
|
t.Fatalf("single writer lost call_id: %+v", row)
|
|
}
|
|
}
|