@bongos/core 1.19.415 → 1.19.417

package/modules/platform-identity/routes/sso.js

@@ -259,6 +259,15 @@ module.exports = function ssoRoutes() {
       if (identity.redirect_uri !== redirect_uri) {
         return res.fail('invalid_grant', 400);
       }
+      // THE SIGN-IN WITNESS (ADR 0205, security report 1000027). A redeemed code
+      // means a human with a live hub session authorized THIS client for THIS
+      // github_id — the strongest binding the hub ever holds, and one no request
+      // body can fabricate. Record it here, so the /sso/membership/check-in and
+      // /sso/activity/rollup gates have something a caller cannot write. Inside
+      // the try on purpose: if the witness cannot be stored the sign-in fails
+      // rather than proceeding into a state where the client's own check-in is
+      // the only evidence it ever happened.
+      await pi.recordFederatedSignin({ clientId: client_id, githubId: identity.github_id }, { pool });
       // IDENTITY ONLY — never a rank, credits, or a session token (ADR 0016 / 0141).
       return res.json({
         github_id: Number(identity.github_id),
@@ -342,6 +351,10 @@ module.exports = function ssoRoutes() {
         displayName: id.display_name,
         avatarUrl: id.avatar_url,
       }, { pool });
+      // The CLI leg's sign-in witness (ADR 0205) — the device-flow twin of the
+      // /sso/token stamp. GitHub approved this person and the client was BOUND at
+      // start from the typed origin, so the pairing is the hub's own finding.
+      await pi.recordFederatedSignin({ clientId: out.client_id, githubId: id.github_id }, { pool });
       const assertion = hubKeys.mintHubAssertion({
         clientId: out.client_id, // BOUND at start from the origin — not caller-supplied
         githubId: id.github_id,
@@ -362,11 +375,23 @@ module.exports = function ssoRoutes() {
 
   // POST /sso/membership/check-in — a federated instance reports, on every sign-in,
   // that a builder builds on its project (ADR 0141 §3). Server-to-server, authed by
-  // client_id + client_secret (same constant-time check as /sso/token). Upserts the
-  // account (so a CLI-only builder still appears in My Projects) + the membership
-  // with a COARSE membership_kind. The client_id is taken from the AUTHENTICATED
-  // client — the caller cannot report membership for a project it doesn't hold the
-  // secret for.
+  // client_id + client_secret (same constant-time check as /sso/token). Refreshes an
+  // EXISTING `platform_identity_project_memberships` row's COARSE membership_kind.
+  // The client_id is taken from the AUTHENTICATED client — the caller cannot report
+  // membership for a project it doesn't hold the secret for.
+  //
+  // WHAT THIS CALL MAY NOT DO, AND WHY (ADR 0205, security report 1000027). Client
+  // credentials say WHICH PROJECT is calling; they say nothing about WHO the
+  // github_id in the body is. So this route may neither create a membership nor
+  // rewrite an account's identity: it updates a row the HUB already witnessed a
+  // sign-in for (signin_verified_at, stamped only at /sso/token and
+  // /sso/device/poll), and it creates the account shell only when absent. Before
+  // this, a client holding only its own secret could overwrite anyone's public
+  // github_login + avatar_url AND mint the membership that /sso/activity/rollup's
+  // membership_required precheck (the ADR 0171 D7 anti-impersonation gate) trusts —
+  // so the gate was satisfiable by the very call it was meant to gate. Nothing
+  // legitimate is lost: check-in only ever fires after a hub-authenticated sign-in
+  // (src/bongos/auth-idp.js), which stamps the witness first.
   //
   // THE FIELD IS `membership_kind`; `role` IS ACCEPTED FOR THE WINDOW (task 1003090,
   // ADR 0177 §"the fifth use"). ADR 0174 reserves `role` for the three crafts, and
@@ -399,10 +424,23 @@ module.exports = function ssoRoutes() {
       if (!client || client.status !== 'active' || !pi.clientSecretValid(client, client_secret)) {
         return res.fail('invalid_client', 401);
       }
-      // Upsert the account first so a CLI-only builder is known to the hub, then the
-      // membership — keyed to the AUTHENTICATED client_id, never a caller-named one.
-      await pi.upsertAccount({ githubId: github_id, githubLogin: github_login, displayName: display_name, avatarUrl: avatar_url }, { pool });
-      await pi.upsertMembership({ clientId: client_id, githubId: github_id, membershipKind }, { pool });
+      // Reject a non-numeric github_id before it reaches the bigint column (the
+      // rollup's isNumericGithubId guard, which this route was missing).
+      if (!pi.isNumericGithubId(github_id)) {
+        return res.fail('invalid_github_id', 400);
+      }
+      // The membership FIRST, and update-only: no hub-witnessed sign-in for
+      // (this client, this github_id) means the caller cannot speak for this
+      // person, and nothing at all is written — not the account shell either.
+      const membership = await pi.touchMembership({ clientId: client_id, githubId: github_id, membershipKind }, { pool });
+      if (!membership) {
+        return res.fail('signin_required', 409);
+      }
+      // Then the account shell, so a CLI-only builder is known to the hub —
+      // INSERT-ONLY (ensureAccount), never a re-sync of an existing row's
+      // identity. In the normal sequence the sign-in that stamped the witness
+      // above already created it, so this is a defensive no-op.
+      await pi.ensureAccount({ githubId: github_id, githubLogin: github_login, displayName: display_name, avatarUrl: avatar_url }, { pool });
       res.json({ ok: true });
     } catch (err) {
       log.error('[platform-identity] /sso/membership/check-in', err);
@@ -446,11 +484,17 @@ module.exports = function ssoRoutes() {
       // it), so it does not satisfy the requirement. The instance sequences its
       // check-in BEFORE this rollup (src/bongos/auth.js), so the legit first
       // sign-in always has its membership row by the time this arrives.
+      //
+      // AND THE ROW MUST CARRY THE HUB'S OWN SIGN-IN WITNESS (ADR 0205, security
+      // report 1000027). Row-existence alone was not a gate: check-in minted the
+      // row this precheck reads, so a client could satisfy D7 for any github_id
+      // by first calling the other endpoint. membershipBacksRollup demands
+      // signin_verified_at — a column only /sso/token and /sso/device/poll stamp.
       if (!pi.isNumericGithubId(b.github_id)) {
         return res.fail('invalid_github_id', 400);
       }
       const membership = await pi.getMembership(b.client_id, b.github_id, { pool });
-      if (!membership || membership.membership_kind === 'pending') {
+      if (!pi.membershipBacksRollup(membership)) {
         return res.fail('membership_required', 409);
       }
       await pi.upsertActivity({

package/modules/platform-identity/tests/platform-identity.mjs

@@ -408,19 +408,37 @@ await ta('registerClient auto-catalogues the project (2nd query) when an origin
 
 console.log('\nproject memberships (§3 check-in directory):');
 
-await ta('upsertMembership upserts on (client_id, github_id) with a coarse membership_kind', async () => {
-  const pool = mockPool([{ rows: [{ id: '1', client_id: 'c1', github_id: '42', membership_kind: 'owner' }] }]);
-  await P.upsertMembership({ clientId: 'c1', githubId: 42, membershipKind: 'owner' }, { pool });
+await ta('recordFederatedSignin is the ONE path that creates a membership, and stamps the witness', async () => {
+  const pool = mockPool([{ rows: [{ id: '1', client_id: 'c1', github_id: '42', membership_kind: 'member' }] }]);
+  await P.recordFederatedSignin({ clientId: 'c1', githubId: 42 }, { pool });
   const c = pool.calls[0];
   assert.match(c.text, /INSERT INTO platform_identity_project_memberships/);
   assert.match(c.text, /ON CONFLICT \(client_id, github_id\) DO UPDATE/);
+  assert.match(c.text, /signin_verified_at = now\(\)/);
+  assert.match(c.text, /membership_kind = CASE WHEN platform_identity_project_memberships\.membership_kind = 'pending'/,
+    "signing in accepts a standing invite, and never overwrites a real coarse kind");
+  assert.deepEqual(c.params, ['c1', 42], 'no caller-supplied field reaches this statement');
+});
+
+await ta('touchMembership UPDATEs only, and only a row the hub witnessed a sign-in for', async () => {
+  const pool = mockPool([{ rows: [{ id: '1', client_id: 'c1', github_id: '42', membership_kind: 'owner' }] }]);
+  await P.touchMembership({ clientId: 'c1', githubId: 42, membershipKind: 'owner' }, { pool });
+  const c = pool.calls[0];
+  assert.match(c.text, /UPDATE platform_identity_project_memberships/);
+  assert.doesNotMatch(c.text, /INSERT/, 'a check-in must never create a membership (report 1000027)');
+  assert.match(c.text, /signin_verified_at IS NOT NULL/);
   assert.match(c.text, /last_active = now\(\)/);
   assert.deepEqual(c.params, ['c1', 42, 'owner']);
 });
 
-await ta('upsertMembership clamps an unknown kind to member (never trusts a caller blindly)', async () => {
+await ta('touchMembership returns null when nothing matched (no witness → the route refuses)', async () => {
+  const pool = mockPool([{ rows: [] }]);
+  assert.equal(await P.touchMembership({ clientId: 'c1', githubId: 42 }, { pool }), null);
+});
+
+await ta('touchMembership clamps an unknown kind to member (never trusts a caller blindly)', async () => {
   const pool = mockPool([{ rows: [{}] }]);
-  await P.upsertMembership({ clientId: 'c1', githubId: 42, membershipKind: 'archon' }, { pool });
+  await P.touchMembership({ clientId: 'c1', githubId: 42, membershipKind: 'archon' }, { pool });
   assert.equal(pool.calls[0].params[2], 'member', 'a non-coarse membership_kind is clamped to member');
 });
 
@@ -538,12 +556,13 @@ await ta('upsertActivity keeps a legitimate core rank key', async () => {
 });
 
 await ta('getMembership reads one (client, builder) row — the rollup membership requirement', async () => {
-  const row = { id: '9', client_id: 'c1', github_id: '42', membership_kind: 'member' };
+  const row = { id: '9', client_id: 'c1', github_id: '42', membership_kind: 'member', signin_verified_at: 'T' };
   const pool = mockPool([{ rows: [row] }]);
   const out = await P.getMembership('c1', 42, { pool });
   assert.deepEqual(out, row);
   const c = pool.calls[0];
   assert.match(c.text, /FROM platform_identity_project_memberships/);
+  assert.match(c.text, /signin_verified_at/, 'the rollup gate reads the witness, not just the row');
   assert.deepEqual(c.params, ['c1', 42]);
   const miss = await P.getMembership('c1', 43, { pool });
   assert.equal(miss, null);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.415",
+  "version": "1.19.417",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.415",
+      "version": "1.19.417",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.415",
+  "version": "1.19.417",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -33,7 +33,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.415'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.417'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/hub_recent_ships.mjs

@@ -163,7 +163,10 @@ await t('the route passes recent_ships through and takes the origin from the CLI
       return { rows: [{ client_id: 'c1', secret_hash: pi.sha256hex(SECRET), status: 'active', origin: ORIGIN }] };
     }
     if (/FROM platform_identity_project_memberships/.test(sql)) {
-      return { rows: [{ id: 1, client_id: 'c1', github_id: 42, membership_kind: 'member' }] };
+      // signin_verified_at is what ADR 0205 made the rollup gate read: a
+      // membership row alone was never proof, because the check-in that wrote it
+      // is the caller's own unverified claim. A real sign-in stamps it.
+      return { rows: [{ id: 1, client_id: 'c1', github_id: 42, membership_kind: 'member', signin_verified_at: '2026-08-29T00:00:00.000Z' }] };
     }
     return { rows: [{ id: 1 }] };
   });

package/tests/memory_isolation.mjs

@@ -212,6 +212,10 @@ await t('production code contains no grader-system references', () => {
   assert.ok(!/hacker worker/i.test(rawSrc), 'memory.js route source must not mention grader workers');
 });
 
+// GENERALISED (task 1003343): this check now also exists — for memory.js AND for
+// every other own-scoped surface (/me, builder-settings, platform-identity) — in
+// tests/own_scope_guard.mjs, which runs in the DB-free unit lane. This file is in
+// the INTEGRATION set, so the copy below gates nothing in CI; keep them agreeing.
 await t('the SELF read endpoints never derive the owner from request input', () => {
   assert.ok(!/req\.query\.builder/i.test(codeOnly), 'no owner should come from req.query.builder*');
   assert.ok(!/req\.body\.builder/i.test(codeOnly), 'no owner should come from req.body.builder*');