@consiliency/agent-board-schema 1.38.0 → 1.41.0

package/fixtures/already-applied.json

@@ -548,6 +548,14 @@
     {
       "id": "20260919000100_agent_board_signed_write_model_key",
       "sha256": "464ae39acbd96330c5ad1c753fa1204ca290baa0d6f82d7d30d0ead4d2944d37"
+    },
+    {
+      "id": "20260920000100_agent_board_realtime_credential_claim",
+      "sha256": "670d6e97ca84ef74ebd10a6ee102c328005a28aa48f8668ba444ce31b714cf02"
+    },
+    {
+      "id": "20260921000100_agent_board_task_event_origin_posture",
+      "sha256": "c515e9cd08b73c118de64125da94735979add5d1128d3ff070ff904af77fef81"
     }
   ]
 }

package/migrations/20260920000100_agent_board_realtime_credential_claim.sql

@@ -0,0 +1,119 @@
+-- #341 — `current_agent_id()`'s credential check never ran. Anywhere.
+--
+-- THE DEFECT, corrected after a correctness seat disproved this header's first version by
+-- measurement. The original text said PostgREST sets the per-claim GUCs and Realtime does not, so
+-- the credential branch was dead only for subscribers. That is FALSE, and the truth is worse.
+--
+-- Measured through a real PostgREST (v14.5) with a signed `authenticated` JWT carrying
+-- `agent_credential_id`, by a probe function called over HTTP:
+--
+--   per_claim_sub       : null
+--   per_claim_cred      : null
+--   whole_json_present  : true
+--   whole_json_has_cred : true
+--
+-- PostgREST REMOVED the legacy `request.jwt.claim.<name>` GUCs (the option went away in v12), and
+-- nothing in this repository sets them either. So the pre-fix body, which read ONLY that source,
+-- resolved the claim to NULL on EVERY transport. NULL takes the permissive branch by design, and
+-- the branch requiring a non-revoked, non-expired credential NEVER EXECUTED — not on Realtime,
+-- and not on the RPC path either.
+--
+-- CONSEQUENCE, stated plainly because the first version of this header understated its own fix:
+-- mid-JWT-lifetime credential revocation stopped nothing, anywhere. This migration does not
+-- "restore" a gate that worked on one path; it ACTIVATES the credential gate for the first time,
+-- on every path. That is a real behaviour change on the live RPC path, not only a subscription fix.
+--
+-- WHY AUTH.UID() SURVIVED THE SAME GAP, which is where the fix comes from. `auth.uid()` already
+-- reads BOTH sources and coalesces:
+--
+--   coalesce(
+--     nullif(current_setting('request.jwt.claim.sub', true), ''),
+--     (nullif(current_setting('request.jwt.claims', true), '')::jsonb ->> 'sub')
+--   )::uuid
+--
+-- The second source is populated on both transports, and carries custom claims. Verified on
+-- Realtime with a throwaway table whose RLS policy keyed ONLY on that GUC (a row wanting the JWT's
+-- value delivered, a row wanting a different value not), and on PostgREST by the probe above.
+--
+-- THE FIX is that same coalesce shape applied to the credential claim. Nothing is loosened:
+-- absence in BOTH sources still takes the permissive branch, which callers that legitimately have
+-- no credential depend on.
+--
+-- NO NEW RAISE PATH — and the first version of this header was wrong about that too. It claimed
+-- the cast to `jsonb` was "a way this function can now raise where it previously could not". The
+-- previous body raised as well: with a per-claim value of `bogus` it raises
+-- `invalid input syntax for type uuid (22P02)`, measured on the pre-fix body. The UUID regex does
+-- NOT guard the cast — the cast is evaluated at SQL-function startup, before any qual filtering,
+-- so a malformed value raises regardless of a conjunct that syntactically precedes it.
+--
+-- Rather than disclose that, this migration REMOVES the raise class: the credential is compared as
+-- TEXT against `ac.id::text`, so a malformed claim of any shape (`""`, `42`, `{"a":1}`, `bogus`)
+-- matches nothing and DENIES CLEANLY instead of erroring. `lower()` because `uuid::text` is
+-- canonical lowercase and the claim may not be. The regex is kept as a cheap pre-filter, and is
+-- now genuinely a filter rather than a guard that never guarded.
+--
+-- WHAT THIS DOES NOT DO. It does not make a Realtime payload trustworthy. Delivery is now gated on
+-- the same credential the RPC path checks, but the event body is still a replication row image and
+-- the subscription can silently miss events (`SUBSCRIBED` is reported before events actually flow —
+-- measured: on a cold Realtime container the first insert after SUBSCRIBED was dropped). Consumers
+-- must treat an event as "something changed, go fetch". That posture is asserted in the client.
+--
+-- CREATE OR REPLACE with the identical signature, so the ACL survives — verified before writing
+-- this: `authenticated` and `service_role` hold EXECUTE, `anon` does not, PUBLIC holds nothing.
+-- Restated anyway, because a recreated SECURITY DEFINER function that does not restate its
+-- privileges is a gate-bypass this repo has already shipped once.
+
+create or replace function agent_board.current_agent_id()
+returns uuid
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  with credential_claim as (
+    -- #341: read BOTH sources. PostgREST sets the per-claim GUC; Realtime sets only the
+    -- whole-JSON one. Reading a single source made the credential branch dead code for every
+    -- Realtime subscriber. Mirrors auth.uid(), which has always coalesced for the same reason.
+    select coalesce(
+             nullif(current_setting('request.jwt.claim.agent_credential_id', true), ''),
+             -- The OUTER nullif is not redundant, and its absence was a transport inconsistency
+             -- caught by a test: the per-claim arm maps '' to absent, so without this the same
+             -- logical claim ("" ) would be ABSENT on one transport and a malformed credential
+             -- that DENIES on the other. Same input, different answer by transport, which is the
+             -- exact bug class #341 is about. Empty means absent on both, matching what omission
+             -- already permits.
+             nullif(nullif(current_setting('request.jwt.claims', true), '')::jsonb ->> 'agent_credential_id', '')
+           ) as credential_id_text
+  )
+  select a.id
+    from agent_board.agents a
+    cross join credential_claim cc
+   where a.auth_user_id = auth.uid()
+     and a.status = 'active'
+     and (
+       cc.credential_id_text is null
+       or (
+         cc.credential_id_text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'
+         and exists (
+           select 1
+             from agent_board.agent_credentials ac
+            -- TEXT comparison, never a cast of the untrusted claim: a malformed value must DENY,
+            -- not raise. `ac.id::text` is canonical lowercase, hence lower() on the claim.
+            where ac.id::text = lower(cc.credential_id_text)
+              and ac.agent_id = a.id
+              and ac.revoked_at is null
+              and (ac.expires_at is null or ac.expires_at > now())
+         )
+       )
+     )
+   limit 1;
+$$;
+
+-- Restated rather than relied upon. `anon` is deliberately NOT granted: it did not hold EXECUTE
+-- before this migration and must not gain it.
+revoke all on function agent_board.current_agent_id() from public;
+grant execute on function agent_board.current_agent_id() to authenticated;
+grant execute on function agent_board.current_agent_id() to service_role;
+
+comment on function agent_board.current_agent_id() is
+  'Resolves auth.uid() to the active agent_board.agents.id and, when an agent_credential_id claim is present in EITHER the per-claim GUC (request.jwt.claim.agent_credential_id) or the whole-JSON GUC (request.jwt.claims), requires it to reference a non-revoked, non-expired credential for that agent. Reading only the per-claim source made the credential branch unreachable on EVERY transport, not just Realtime: PostgREST removed those legacy GUCs at v12 and nothing here sets them, so the claim read NULL and took the permissive branch everywhere. This migration ACTIVATES the credential gate for the first time rather than restoring it (#341). The claim is compared as TEXT against agent_credentials.id::text, so a malformed claim denies cleanly instead of raising 22P02. Absence in BOTH sources still takes the permissive branch, which callers that legitimately have no credential depend on.';