@remnic/core 9.6.0 → 9.6.2

package/src/access-http.test.ts

@@ -2585,3 +2585,132 @@ test("HTTP chat/message gates the NEW session's namespace — scoped token canno
     await rm(dir, { recursive: true, force: true });
   }
 });
+
+// ---------------------------------------------------------------------------
+// PR #1852: token-rotation race — authorized entry must be reused for provenance
+// ---------------------------------------------------------------------------
+
+test("PR #1852: token rotation between authorization and write does not stamp the wrong connector", async () => {
+  // Race: the dynamic-token authorization resolves an entry (connector A),
+  // then the provenance resolver re-reads the token store. If the store
+  // rotated between the two reads, the OLD code stamped connector B. The
+  // fix caches the matched entry per-request so the provenance comes from
+  // the SAME entry that authorized.
+  let getterCalls = 0;
+  const entriesGetter = () => {
+    getterCalls++;
+    // First call (authorization): token -> "chatgpt".
+    // Subsequent call (provenance in the OLD code): token -> "codex-cli".
+    // With the fix the getter is called only once; the second call never
+    // happens and the cached "chatgpt" entry is reused.
+    if (getterCalls <= 1) {
+      return [{ token: "race_token", connector: "chatgpt" }];
+    }
+    return [{ token: "race_token", connector: "codex-cli" }];
+  };
+
+  let capturedSourceConnector: string | undefined;
+  const service = {
+    memoryStore: (req: { sourceConnector?: string }) => {
+      capturedSourceConnector = req.sourceConnector;
+      return Promise.resolve({
+        schemaVersion: 1,
+        operation: "memory_store",
+        namespace: "default",
+        dryRun: false,
+        accepted: true,
+        queued: false,
+        status: "stored",
+      });
+    },
+  } as unknown as EngramAccessService;
+
+  const server = new EngramAccessHttpServer({
+    service,
+    port: 0,
+    authTokenEntriesGetter: entriesGetter,
+    adminConsoleEnabled: false,
+  });
+  const status = await server.start();
+  try {
+    const res = await fetch(`http://127.0.0.1:${status.port}/engram/v1/memories`, {
+      method: "POST",
+      headers: {
+        authorization: "Bearer race_token",
+        "content-type": "application/json",
+      },
+      body: JSON.stringify({
+        content: "race-test memory",
+        schemaVersion: 1,
+        idempotencyKey: "race-key-1852",
+      }),
+    });
+    assert.equal(res.status, 201, "memory_store must succeed with a valid entry token");
+
+    // The provenance must come from the entry that AUTHORIZED the request
+    // ("chatgpt"), not from the rotated store ("codex-cli").
+    assert.equal(
+      capturedSourceConnector,
+      "chatgpt",
+      "sourceConnector must be from the authorized entry, not the rotated store",
+    );
+    // The getter must have been called only once — the matched entry is
+    // cached per-request.
+    assert.equal(getterCalls, 1, "authTokenEntriesGetter must be called once (cached per-request)");
+  } finally {
+    await server.stop();
+  }
+});
+
+test("PR #1852: static operator token has no connector provenance under rotation", async () => {
+  // An operator-supplied static token must never acquire connector provenance,
+  // even when an entries getter is also configured and the static token
+  // appears there under a different connector. This guards the short-circuit
+  // in resolveMatchedEntry: static tokens return { token } (no connector).
+  let capturedSourceConnector: string | undefined;
+  const service = {
+    memoryStore: (req: { sourceConnector?: string }) => {
+      capturedSourceConnector = req.sourceConnector;
+      return Promise.resolve({
+        schemaVersion: 1,
+        operation: "memory_store",
+        namespace: "default",
+        dryRun: false,
+        accepted: true,
+        queued: false,
+        status: "stored",
+      });
+    },
+  } as unknown as EngramAccessService;
+
+  const server = new EngramAccessHttpServer({
+    service,
+    port: 0,
+    authToken: "operator-static",
+    authTokenEntriesGetter: () => [{ token: "operator-static", connector: "chatgpt" }],
+    adminConsoleEnabled: false,
+  });
+  const status = await server.start();
+  try {
+    const res = await fetch(`http://127.0.0.1:${status.port}/engram/v1/memories`, {
+      method: "POST",
+      headers: {
+        authorization: "Bearer operator-static",
+        "content-type": "application/json",
+      },
+      body: JSON.stringify({
+        content: "operator-token memory",
+        schemaVersion: 1,
+        idempotencyKey: "static-key-1852",
+      }),
+    });
+    assert.equal(res.status, 201);
+    assert.equal(
+      capturedSourceConnector,
+      undefined,
+      "static operator token must carry no connector provenance",
+    );
+  } finally {
+    await server.stop();
+  }
+});

package/src/access-http.ts

@@ -1566,6 +1566,9 @@ export class EngramAccessHttpServer {
           // Forward cwd/projectTag for auto git-context resolution (issue #569).
           cwd: body.cwd,
           projectTag: body.projectTag,
+          // Phase 1 provenance: server-resolved connector identity from the
+          // bearer token (REST path, mirroring the MCP tools/call dispatch).
+          sourceConnector: this.resolveConnector(req),
         },
         // Enforce the write-quota INSIDE the service's idempotency lock
         // (beforeExecute, only on a real miss). A retried observe that hits the
@@ -1663,6 +1666,9 @@ export class EngramAccessHttpServer {
         service: this.service,
         authenticatedPrincipal: this.resolveRequestPrincipal(req),
         hooks: { enforceWriteQuota: () => this.ensureWriteRateLimitAvailable() },
+        // Phase 1 provenance: server-resolved connector identity from the
+        // bearer token (REST path, mirroring the MCP tools/call dispatch).
+        sourceConnector: this.resolveConnector(req),
       })) as { result: EngramAccessWriteResponse };
       const response = output.result;
       if (this.shouldCountWriteRateLimit(response as { dryRun?: boolean; idempotencyReplay?: boolean })) {
@@ -1693,6 +1699,7 @@ export class EngramAccessHttpServer {
       const output = (await op.run(this.gatedBodyNamespace(req, body), {
         service: this.service,
         authenticatedPrincipal: this.resolveRequestPrincipal(req),
+        sourceConnector: this.resolveConnector(req),
       })) as { result: unknown };
       if (isWriteSubcommand) {
         this.recordWriteRateLimitHit();
@@ -1717,6 +1724,7 @@ export class EngramAccessHttpServer {
       const output = (await op.run(this.gatedBodyNamespace(req, body), {
         service: this.service,
         authenticatedPrincipal: this.resolveRequestPrincipal(req),
+        sourceConnector: this.resolveConnector(req),
       })) as { result: unknown };
       if (isWriteSubcommand) {
         this.recordWriteRateLimitHit();
@@ -1824,6 +1832,9 @@ export class EngramAccessHttpServer {
         sourceReason: body.sourceReason,
         cwd: body.cwd,
         projectTag: body.projectTag,
+        // Phase 1 provenance: server-resolved connector identity from the
+        // bearer token (REST path, mirroring the MCP tools/call dispatch).
+        sourceConnector: this.resolveConnector(req),
       };
       // Quota enforcement is solely authoritative inside suggestionSubmit
       // (enforceWriteQuota), atomic with the real miss and never on a replay; no
@@ -3106,6 +3117,7 @@ export class EngramAccessHttpServer {
       enforceWriteQuota: observeSelfEnforcesQuota
         ? () => this.ensureWriteRateLimitAvailable()
         : undefined,
+      sourceConnector: this.resolveConnector(req),
     });
 
     if (isMcpWrite && response !== null) {
@@ -3446,13 +3458,44 @@ export class EngramAccessHttpServer {
   }
 
   /**
-   * Resolve the presenting token's entry for an authorized request, or null.
-   * Captures the matched entry — including its capabilities record — so the
-   * op/namespace capability enforcement (issue #1837) uses the SAME entry
-   * that validated. Static operator tokens (`authToken`/`authTokens`) and
-   * the string-token getter carry no capabilities ⇒ unrestricted.
+   * Per-request cache of the matched token entry (the entry whose token
+   * matched the bearer credential, BEFORE any path-policy check). Pinning
+   * the entry to the first read means authorization, capability
+   * enforcement, and connector provenance all observe the SAME token-store
+   * snapshot — a rotation between the auth check and the write handler can
+   * no longer stamp the wrong connector (PR #1852 race).
    */
-  private resolveAuthorizedEntry(
+  private matchedEntryCache = new WeakMap<
+    IncomingMessage,
+    { token: string; connector?: string; capabilities?: TokenCapabilities } | null
+  >();
+
+  /**
+   * Resolve the matched token entry for this request, caching the result so
+   * every downstream consumer (authorization, capability enforcement,
+   * connector provenance) sees the same snapshot entry (PR #1852).
+   */
+  private resolveMatchedEntry(
+    req: IncomingMessage,
+    pathname?: string,
+  ): { token: string; connector?: string; capabilities?: TokenCapabilities } | null {
+    if (this.matchedEntryCache.has(req)) {
+      return this.matchedEntryCache.get(req) ?? null;
+    }
+    const entry = this.computeMatchedEntry(req, pathname);
+    this.matchedEntryCache.set(req, entry);
+    return entry;
+  }
+
+  /**
+   * Find the entry whose token matches the request's bearer credential.
+   * Static operator tokens (`authToken`/`authTokens`) and the string-token
+   * getter carry no capabilities ⇒ unrestricted. Dynamic entry-based tokens
+   * capture connector identity and capabilities. A corrupt or unreadable
+   * token store returns null rather than propagating an error — provenance
+   * must never block an already-authenticated request.
+   */
+  private computeMatchedEntry(
     req: IncomingMessage,
     pathname?: string,
   ): { token: string; connector?: string; capabilities?: TokenCapabilities } | null {
@@ -3513,13 +3556,13 @@ export class EngramAccessHttpServer {
     // identity it scopes (mint/revoke coherence). Capabilities ride on the
     // same entry so enforcement can never lag the token that validated.
     if (this.authTokenEntriesGetter) {
-      for (const entry of this.authTokenEntriesGetter()) {
-        if (!this.timingSafeStringEqual(token, entry.token)) continue;
-        const matched = { token: entry.token, connector: entry.connector, capabilities: entry.capabilities };
-        if (!this.tokenPathPolicy) return matched;
-        // Fail closed: a policy without a connector identity denies.
-        if (typeof entry.connector !== "string" || entry.connector.length === 0) return null;
-        return this.tokenPathPolicy(entry.connector, pathname) ? matched : null;
+      try {
+        for (const entry of this.authTokenEntriesGetter()) {
+          if (!this.timingSafeStringEqual(token, entry.token)) continue;
+          return { token: entry.token, connector: entry.connector, capabilities: entry.capabilities };
+        }
+      } catch {
+        // Corrupt or unreadable tokens.json — no match.
       }
       return null;
     }
@@ -3533,25 +3576,40 @@ export class EngramAccessHttpServer {
     return null;
   }
 
-  /** Cache for per-request capability resolution (avoids re-resolving). */
-  private capabilityCache = new WeakMap<IncomingMessage, TokenCapabilities | null>();
+  /**
+   * Resolve the presenting token's entry for an authorized request, or null.
+   * Applies the path-policy gate (if configured) on top of the per-request
+   * cached matched entry so the identity that is authorized is the same one
+   * whose connector later stamps frontmatter. Static operator tokens and the
+   * string-token getter carry no capabilities ⇒ unrestricted.
+   */
+  private resolveAuthorizedEntry(
+    req: IncomingMessage,
+    pathname?: string,
+  ): { token: string; connector?: string; capabilities?: TokenCapabilities } | null {
+    const matched = this.resolveMatchedEntry(req, pathname);
+    if (!matched) return null;
+    // Apply the path-policy gate for dynamic entry-based tokens.
+    if ("connector" in matched && this.tokenPathPolicy) {
+      // Fail closed: a policy without a connector identity denies.
+      if (typeof matched.connector !== "string" || matched.connector.length === 0) return null;
+      return this.tokenPathPolicy(matched.connector, pathname) ? matched : null;
+    }
+    return matched;
+  }
 
   /**
    * Resolve the presenting token's capabilities for this request, or
    * undefined when the token is unrestricted (legacy / static operator /
-   * explicit-unrestricted record). Cached per-request. `null` sentinel
-   * distinguishes "resolved as unrestricted" from "not yet resolved".
+   * explicit-unrestricted record). Reads from the per-request cached matched
+   * entry so capabilities come from the same snapshot as authorization and
+   * connector provenance (PR #1852).
    */
   private resolveTokenCapabilities(
     req: IncomingMessage,
     pathname?: string,
   ): TokenCapabilities | undefined {
-    if (this.capabilityCache.has(req)) {
-      return this.capabilityCache.get(req) ?? undefined;
-    }
-    const caps = this.resolveAuthorizedEntry(req, pathname)?.capabilities;
-    this.capabilityCache.set(req, caps ?? null);
-    return caps;
+    return this.resolveMatchedEntry(req, pathname)?.capabilities;
   }
 
   /**
@@ -3578,6 +3636,17 @@ export class EngramAccessHttpServer {
       );
     }
   }
+  /**
+   * Resolve the connector identity for the request's bearer token (Phase 1
+   * provenance). Reuses the per-request cached matched entry so a token
+   * rotation between the auth check and the write handler cannot stamp the
+   * wrong connector (PR #1852 race). Returns `undefined` for operator-
+   * supplied static tokens or when no entry getter is configured — those
+   * writes are operator-initiated.
+   */
+  private resolveConnector(req: IncomingMessage): string | undefined {
+    return this.resolveMatchedEntry(req)?.connector;
+  }
 
   private timingSafeStringEqual(a: string, b: string): boolean {
     const left = this.encodeSecret(a);

package/src/access-mcp.ts

@@ -61,6 +61,12 @@ type McpRequestOptions = {
    * the write-rate-limit window); the standalone MCP server has no quota.
    */
   enforceWriteQuota?: () => void | Promise<void>;
+  /**
+   * Server-resolved connector identity (Phase 1 provenance). Set by the HTTP
+   * auth boundary from the matched token entry's connector; threaded into
+   * the operation context so write handlers stamp it onto frontmatter.
+   */
+  sourceConnector?: string;
 };
 
 type McpTool = {
@@ -2645,7 +2651,8 @@ export class EngramMcpServer {
           effectivePrincipal,
           options?.sessionId,
           mcpScope,
-          options?.enforceWriteQuota
+          options?.enforceWriteQuota,
+          options?.sourceConnector
         );
         return {
           jsonrpc: "2.0",
@@ -2853,7 +2860,8 @@ export class EngramMcpServer {
     effectivePrincipal?: string,
     mcpSessionId?: string,
     scope?: { namespace?: string; sessionKey?: string },
-    enforceWriteQuota?: () => void | Promise<void>
+    enforceWriteQuota?: () => void | Promise<void>,
+    sourceConnector?: string,
   ): Promise<unknown> {
     const migrated = MCP_MIGRATED_OPERATIONS[toLegacyToolName(name)];
     if (!migrated) {
@@ -2952,6 +2960,7 @@ export class EngramMcpServer {
       service: this.service,
       authenticatedPrincipal: effectivePrincipal,
       ...(enforceWriteQuota ? { hooks: { enforceWriteQuota } } : {}),
+      ...(sourceConnector ? { sourceConnector } : {}),
     })) as { result: unknown };
     return output.result;
   }