fix(org-tokens): verified-session (human) mints skip the approval gate (core#2593) #2596

Merged

devops-engineer merged 1 commits from fix/org-token-mint-verified-session into main 2026-06-11 17:43:59 +00:00

Conversation 1 Commits 1 Files Changed 2

+124 -34

core-devops commented 2026-06-11 17:38:51 +00:00

Member

Copy Link

Copy Source

Live regression (CTO-reported twice today): canvas Settings → Org API Keys → + New Key returns the raw #2579 anchor 400. The browser authenticates via a CP-verified WorkOS session (AdminAuth sets cp_session_actor strictly after VerifiedCPSession), but approvalAnchorForGate has no session branch — #2579 assumed "the UI mints via the concierge", which is wrong: the canvas mints directly with the browser session.

Design (core#2593): the gate puts a HUMAN between an AGENT and a privileged mint. When the minter IS the human, a pending-approval that same human would approve is a no-op round-trip → verified-session callers mint directly. created_by now records the per-session actor hash (better audit than the lossy "session" constant). Agent classes (admin-token / org-token) remain fully gated; their anchor-4xx contract is unchanged.

Security: the human discriminator is cp_session_actor (set ONLY post-verification) — never the raw Cookie header, which any bearer-authed agent can forge. The pre-existing forgeable Cookie checks in orgTokenActor/orgTokenActorClass are replaced with the verified key.

Tests: Create_VerifiedSession_SkipsGate (200, ExpectationsWereMet proves zero approval SQL ran, created_by = actor) + Create_ActorFromSession repurposed as the bypass-resistance pin (junk Cookie without verification → still 400). Full handlers package green; go build -tags=integration clean.

Remaining #2593 asks (NOT this PR): CP provisioner projecting MOLECULE_PLATFORM_WORKSPACE_ID (agents-team hand-fixed), UI handling of 202 for the agent path.

🤖 Generated with Claude Code

**Live regression (CTO-reported twice today):** canvas Settings → Org API Keys → *+ New Key* returns the raw #2579 anchor 400. The browser authenticates via a **CP-verified WorkOS session** (`AdminAuth` sets `cp_session_actor` strictly after `VerifiedCPSession`), but `approvalAnchorForGate` has no session branch — #2579 assumed "the UI mints via the concierge", which is wrong: the canvas mints directly with the browser session. **Design (core#2593):** the gate puts a HUMAN between an AGENT and a privileged mint. When the minter IS the human, a pending-approval that same human would approve is a no-op round-trip → verified-session callers mint directly. `created_by` now records the per-session actor hash (better audit than the lossy `"session"` constant). Agent classes (admin-token / org-token) remain **fully gated**; their anchor-4xx contract is unchanged. **Security:** the human discriminator is `cp_session_actor` (set ONLY post-verification) — never the raw Cookie header, which any bearer-authed agent can forge. The pre-existing forgeable Cookie checks in `orgTokenActor`/`orgTokenActorClass` are replaced with the verified key. **Tests:** `Create_VerifiedSession_SkipsGate` (200, `ExpectationsWereMet` proves zero approval SQL ran, created_by = actor) + `Create_ActorFromSession` repurposed as the bypass-resistance pin (junk Cookie without verification → still 400). Full handlers package green; `go build -tags=integration` clean. Remaining #2593 asks (NOT this PR): CP provisioner projecting `MOLECULE_PLATFORM_WORKSPACE_ID` (agents-team hand-fixed), UI handling of 202 for the agent path. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

core-devops added 1 commit 2026-06-11 17:38:51 +00:00

fix(org-tokens): verified-session (human) mints skip the approval gate (core#2593) ... 575789ca3c

The canvas Settings -> Org API Keys "+ New Key" returns the raw anchor
400 from #2579: the browser authenticates via a CP-VERIFIED WorkOS
session (AdminAuth sets cp_session_actor strictly after
VerifiedCPSession), but approvalAnchorForGate has no session branch —
the #2579 assumption "the UI mints via the concierge" was wrong; the
canvas mints directly with the browser session.

Design (per core#2593): the gate exists to put a HUMAN between an
AGENT and a privileged mint. When the minter IS a human at the
dashboard, a pending-approval the same human would approve is a no-op
round-trip — verified-session callers now mint directly (audited:
created_by records the session actor hash instead of the lossy
"session" constant). Agent classes (admin-token, org-token) remain
fully gated; the anchor 4xx contract is unchanged for them.

SECURITY: the human discriminator is cp_session_actor (set only
post-verification), NEVER the raw Cookie header — a bearer-authed
agent attaching a junk Cookie cannot bypass the gate. The previously
forgeable Cookie checks in orgTokenActor/orgTokenActorClass are
replaced with the verified key (they only affected audit labels, but
the same sloppy pattern next to a gate-skip would have been a hole).

Tests: TestOrgTokenHandler_Create_VerifiedSession_SkipsGate (200, no
approval SQL, created_by = actor — ExpectationsWereMet proves the gate
did not fire) + ActorFromSession repurposed as the bypass-resistance
pin (junk Cookie without verification -> still 400). Full handlers
package green; go build -tags=integration clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

agent-reviewer-cr2 approved these changes 2026-06-11 17:40:47 +00:00

agent-reviewer-cr2 left a comment

Member

Copy Link

Copy Source

5-axis review on head 575789ca3c. Correctness: fixes the #2579 regression by allowing only CP-verified browser-session callers to mint directly, while admin-token/org-token callers still go through approvalAnchorForGate and gateDestructive. Robustness: empty-anchor handling remains fail-closed for non-session callers; created_by now records the stable session actor and the raw-cookie path still returns controlled 400. Security: the bypass is keyed on cp_session_actor, which AdminAuth sets only after VerifiedCPSession succeeds; raw Cookie classification was removed, and the bypass-resistance test pins that forged/junk cookies do not skip the gate. Agent classes remain gated. Performance: no new expensive calls on the handler path; verified-session work is already done by middleware. Readability: helper and comments make the human-vs-agent distinction explicit; tests cover the direct human mint path and forged-cookie non-bypass. Handlers-PG is green; broader CI was still settling at review time. Approved as agent-reviewer-cr2.

5-axis review on head 575789ca3c775c8853e184762ed18e6f2cea209d. Correctness: fixes the #2579 regression by allowing only CP-verified browser-session callers to mint directly, while admin-token/org-token callers still go through approvalAnchorForGate and gateDestructive. Robustness: empty-anchor handling remains fail-closed for non-session callers; created_by now records the stable session actor and the raw-cookie path still returns controlled 400. Security: the bypass is keyed on cp_session_actor, which AdminAuth sets only after VerifiedCPSession succeeds; raw Cookie classification was removed, and the bypass-resistance test pins that forged/junk cookies do not skip the gate. Agent classes remain gated. Performance: no new expensive calls on the handler path; verified-session work is already done by middleware. Readability: helper and comments make the human-vs-agent distinction explicit; tests cover the direct human mint path and forged-cookie non-bypass. Handlers-PG is green; broader CI was still settling at review time. Approved as agent-reviewer-cr2.

devops-engineer merged commit 035123bf42 into main 2026-06-11 17:43:59 +00:00

core-devops referenced this pull request 2026-06-11 18:41:00 +00:00

staging concierge/org-map regressions: provisioned workspace lands at depth-1 beside the old root (re-parent broken?) + org-map canvas never mounts (45s) #2601

Sign in to join this conversation.

Reviewers

No Reviewers

agent-reviewer-cr2

Labels

Clear labels

area/ci

CI/CD pipeline issues

do-not-auto-merge

Opt out of autonomous merge-queue merging

kind/infrastructure

Infrastructure-related issues

merge-queue

Ready for serialized Gitea merge queue

merge-queue-hold

Temporarily hold PR in merge queue

platform/go

Go platform test issues

release-blocker

Blocks the staging→main promotion / a release

release-test

security

test-label-sre

tier:high

High risk per dev-sop §SOP-6 — ceo only, 24h cooldown

tier:low

Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve

tier:medium

Medium risk per dev-sop §SOP-6 — managers/ceo can approve

triage-test

test

wip

Work in progress — do not auto-merge

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

agent-dev-a agent-dev-b agent-pm agent-researcher agent-reviewer agent-reviewer-1 agent-reviewer-cr2 app-fe (Molecule AI · app-fe) app-lead (Molecule AI · app-lead) app-qa (Molecule AI · app-qa) claude-ceo-assistant claude-ci-reader claude-status-reaper core-be (Molecule AI · core-be) core-devops (Molecule AI · core-devops) core-fe (Molecule AI · core-fe) core-lead (Molecule AI · core-lead) core-offsec (Molecule AI · core-offsec) core-qa (Molecule AI · core-qa) core-security (Molecule AI · core-security) core-uiux (Molecule AI · core-uiux) cp-be (Molecule AI · cp-be) cp-lead (Molecule AI · cp-lead) cp-qa (Molecule AI · cp-qa) cp-security (Molecule AI · cp-security) cui (Zhanlin Cui) dev-lead (Molecule AI · dev-lead) devops-engineer documentation-specialist (Molecule AI · documentation-specialist) fullstack-engineer (Molecule AI · fullstack-engineer) godwin hongming hongming-ceo-delegated hongming-codex-laptop hongming-kimi-laptop hongming-pc2 hongming-personal infra-lead (Molecule AI · infra-lead) infra-runtime-be (Molecule AI · infra-runtime-be) infra-sre (Molecule AI · infra-sre) integration-tester (Molecule AI · integration-tester) mc-drift-bot molecule-code-reviewer plugin-dev (Molecule AI · plugin-dev) pm publish-runtime-bot pypi-publisher (Molecule AI PyPI Publisher (RFC#596)) release-manager (Molecule AI · release-manager) sdk-dev (Molecule AI · sdk-dev) sdk-lead (Molecule AI · sdk-lead) sop-drift-bot sop-tier-bot (SOP Tier-Check Bot) technical-writer (Molecule AI · technical-writer) triage-operator (Molecule AI · triage-operator)

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#2596