@indigoai-us/hq-cloud 6.14.13 → 6.14.15

package/src/cognito-auth.test.ts

@@ -565,3 +565,143 @@ describe("refresh expiry hardening", () => {
     expect(loadCachedTokens()?.accessToken).toBe("new-access");
   });
 });
+
+// ---------------------------------------------------------------------------
+// Machine mint identity binding under EMAIL-ALIAS pools (regression, 2026-07-20)
+//
+// The prod pool aliases email-format usernames: Cognito's canonical username
+// (`cognito:username` / access `username`) is a generated UUID equal to `sub`,
+// NEVER the email-format username the machine creds carry. The 6.14.13
+// predicate bound the ID token to creds via username equality only, so every
+// valid outpost/agent mint was rejected with "Machine token mint returned
+// tokens that do not match the requested machine identity" — a fleet-wide
+// sync outage on boxes. Claim shapes below mirror a real prod outpost token
+// (email claim ABSENT: the machine app client cannot read `email`, so Cognito
+// omits it from the ID token entirely).
+// ---------------------------------------------------------------------------
+
+describe("machine mint under email-alias pools (username is a UUID)", () => {
+  const MACHINE_CLIENT = "4q3bmth9ad4v3be6booc5td193";
+  const OUTPOST_UID = "out_01KXVRESJMP7TD263P7S0YHPSD";
+  const COGNITO_INTERNAL_SUB = "f4981438-a0a1-704c-542a-dfac148f2380";
+  const CREDS_USERNAME = "out-01kxvresjmp7td263p7s0yhpsd@outposts.hq.computer";
+
+  function writeOutpostCreds(overrides: Record<string, unknown> = {}) {
+    const dir = path.join(tmpHome, ".hq-agent");
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(
+      path.join(dir, "machine-creds.json"),
+      JSON.stringify({
+        username: CREDS_USERNAME,
+        secret: "machine-secret",
+        clientId: MACHINE_CLIENT,
+        region: "us-east-1",
+        entityType: "outpost",
+        entityUid: OUTPOST_UID,
+        ...overrides,
+      }),
+    );
+  }
+
+  function mintResponse(accessClaims: Record<string, unknown>, idClaims: Record<string, unknown>) {
+    return vi.fn(async () =>
+      new Response(
+        JSON.stringify({
+          AuthenticationResult: {
+            AccessToken: makeAccessToken(accessClaims),
+            IdToken: makeAccessToken(idClaims),
+            ExpiresIn: 3600,
+          },
+        }),
+        { status: 200, headers: { "Content-Type": "application/json" } },
+      ),
+    );
+  }
+
+  it("accepts a valid outpost mint whose cognito:username is the internal UUID (alias pool)", async () => {
+    const { getValidAccessToken } = await importModule();
+    writeOutpostCreds();
+    const fetchMock = mintResponse(
+      {
+        token_use: "access",
+        client_id: MACHINE_CLIENT,
+        // Alias pool: access username is the internal UUID, not the email-format name.
+        username: COGNITO_INTERNAL_SUB,
+        sub: COGNITO_INTERNAL_SUB,
+      },
+      {
+        token_use: "id",
+        aud: MACHINE_CLIENT,
+        "cognito:username": COGNITO_INTERNAL_SUB,
+        sub: COGNITO_INTERNAL_SUB,
+        // email claim intentionally ABSENT (client cannot read `email`).
+        "custom:entityType": "outpost",
+        "custom:entityUid": OUTPOST_UID,
+        "custom:delegatedSub": "24785418-c071-7077-b7e9-0b1b583cfba1",
+        "custom:delegatedEmail": "hassaan@getindigo.ai",
+      },
+    );
+    vi.stubGlobal("fetch", fetchMock);
+
+    await expect(
+      getValidAccessToken(baseConfig, { interactive: false }),
+    ).resolves.toBeTypeOf("string");
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+  });
+
+  it("still rejects a mint whose entityUid does not match the requested creds", async () => {
+    const { getValidAccessToken } = await importModule();
+    writeOutpostCreds();
+    const fetchMock = mintResponse(
+      {
+        token_use: "access",
+        client_id: MACHINE_CLIENT,
+        username: COGNITO_INTERNAL_SUB,
+        sub: COGNITO_INTERNAL_SUB,
+      },
+      {
+        token_use: "id",
+        aud: MACHINE_CLIENT,
+        "cognito:username": COGNITO_INTERNAL_SUB,
+        sub: COGNITO_INTERNAL_SUB,
+        "custom:entityType": "outpost",
+        // A DIFFERENT machine's uid — identity binding must refuse it.
+        "custom:entityUid": "out_01KX0000000000000000000000",
+        "custom:delegatedSub": "24785418-c071-7077-b7e9-0b1b583cfba1",
+        "custom:delegatedEmail": "hassaan@getindigo.ai",
+      },
+    );
+    vi.stubGlobal("fetch", fetchMock);
+
+    await expect(
+      getValidAccessToken(baseConfig, { interactive: false }),
+    ).rejects.toThrow(/do not match the requested machine identity/);
+  });
+
+  it("still rejects legacy creds (no entityUid) when the username binding fails", async () => {
+    const { getValidAccessToken } = await importModule();
+    // Legacy agent creds: no entityType/entityUid persisted.
+    writeOutpostCreds({ entityType: undefined, entityUid: undefined, username: "agt-legacy@agents.getindigo.ai" });
+    const fetchMock = mintResponse(
+      {
+        token_use: "access",
+        client_id: MACHINE_CLIENT,
+        username: "someone-else",
+        sub: "someone-else",
+      },
+      {
+        token_use: "id",
+        aud: MACHINE_CLIENT,
+        "cognito:username": "someone-else",
+        sub: "someone-else",
+        "custom:entityType": "agent",
+        "custom:entityUid": "agt_01JZ9999999999999999999999",
+      },
+    );
+    vi.stubGlobal("fetch", fetchMock);
+
+    await expect(
+      getValidAccessToken(baseConfig, { interactive: false }),
+    ).rejects.toThrow(/do not match the requested machine identity/);
+  });
+});

package/src/cognito-auth.ts

@@ -399,8 +399,23 @@ function machineTokenPairMatchesIdentity(
   const entityMatchesCreds =
     entityType === expectedEntityType &&
     (creds.entityUid === undefined || entityUid === creds.entityUid);
+  // Bind the ID token to the REQUESTED credentials. Username equality only
+  // holds in pools without email aliasing; the prod pool aliases email-format
+  // usernames, so Cognito's canonical username (`cognito:username`, access
+  // `username`, `sub`) is a generated UUID that NEVER equals the email-format
+  // creds.username — and the machine app client cannot read `email`, so no
+  // email claim rides the ID token either. For creds that persist their
+  // entityUid (every ADR-0009 outpost and modern agent), the unique
+  // custom:entityUid claim IS the identity binding: exactly one Cognito user
+  // carries that attribute value, stamped server-side at provisioning.
+  // Regression: 6.14.13 shipped username-only binding and rejected every
+  // valid machine mint in the alias pool ("Machine token mint returned tokens
+  // that do not match the requested machine identity"), logging out the
+  // outpost fleet. Legacy creds without entityUid keep the username binding.
   const idTokenMatchesCreds =
-    idUsername === creds.username || idSub === creds.username;
+    idUsername === creds.username ||
+    idSub === creds.username ||
+    (creds.entityUid !== undefined && entityUid === creds.entityUid);
   const subjectBindings: boolean[] = [];
   if (accessUsername !== null && idUsername !== null) {
     subjectBindings.push(accessUsername === idUsername);