@sixb/core 0.1.12 → 0.1.13

package/src/sandboxes/sandbox.ts

@@ -16,7 +16,10 @@ export type SandboxStatus = "running" | "stopped" | "failed"
  * default set at factory.create(...).
  */
 export interface RunCommandOptions {
-  /** Overrides the sandbox-level workingDirectory for this call. */
+  /**
+   * Working directory for this call. Defaults to the sandbox's workingDirectory;
+   * relative paths resolve against it, while absolute paths override it.
+   */
   readonly cwd?: string
   /** Merged on top of sandbox-level env. Per-call wins on collision. */
   readonly env?: Readonly<Record<string, string>>

package/src/shared/params/types.ts

@@ -6,6 +6,7 @@ import type {
   SchemaOrRef,
   ValueType,
 } from "../../ontology"
+import type { RegisteredValueTypes } from "../../ontology/registered"
 import type { QuantitativeTypeId } from "../../ontology/units"
 
 type Simplify<T> = { [K in keyof T]: T[K] } & {}
@@ -57,14 +58,14 @@ type InferStructuredParamValue<
 
 type InferParamSchemaValue<
   TSchema extends SchemaOrRef,
-  TValueTypes extends readonly ValueType[] = [],
+  TValueTypes extends readonly ValueType[] = RegisteredValueTypes,
 > = TSchema extends keyof ParamPrimitiveSchemaValues
   ? ParamPrimitiveSchemaValues[TSchema]
   : InferStructuredParamValue<TSchema, TValueTypes>
 
 type InferParamValue<
   TParam extends ParamConfig,
-  TValueTypes extends readonly ValueType[] = [],
+  TValueTypes extends readonly ValueType[] = RegisteredValueTypes,
 > = TParam["nullable"] extends true
   ? InferParamSchemaValue<TParam["schema"], TValueTypes> | null
   : InferParamSchemaValue<TParam["schema"], TValueTypes>
@@ -72,7 +73,7 @@ type InferParamValue<
 /** Infer the validated runtime input represented by a parameter config. */
 export type InferParams<
   TParams extends ParamsConfig,
-  TValueTypes extends readonly ValueType[] = [],
+  TValueTypes extends readonly ValueType[] = RegisteredValueTypes,
 > = string extends keyof TParams
   ? Record<string, unknown>
   : Simplify<

package/src/shared/params/user-refs.ts

@@ -0,0 +1,48 @@
+import type { SchemaOrRef, ValueType } from "../../ontology"
+import { isObjectRefSchema } from "../../ontology/refs"
+import { collectUserRefIds, userReferenceProblem } from "../../ontology/user-ref"
+import type { AuthStorage } from "../../storage/auth/types"
+
+/**
+ * Reject params that reference a user who does not exist or is not active.
+ *
+ * Callers run it only when a new run is created: replaying an existing run keeps the params it was
+ * accepted with, even if a referenced user was suspended since.
+ */
+export async function assertParamUsersActive(input: {
+  readonly auth: AuthStorage | undefined
+  readonly projectId: string
+  readonly schemas: Readonly<Record<string, SchemaOrRef>>
+  readonly values: Readonly<Record<string, unknown>>
+  readonly valueTypesById: ReadonlyMap<string, ValueType>
+  /** Names one param in error messages, for example `Action param 'task.assign.assignee'`. */
+  readonly describe: (paramId: string) => string
+  readonly invalid: (message: string) => Error
+}): Promise<void> {
+  const references: { readonly paramId: string; readonly id: string }[] = []
+  for (const [paramId, schema] of Object.entries(input.schemas)) {
+    if (isObjectRefSchema(schema)) continue
+    const ids = collectUserRefIds(schema, input.values[paramId], input.valueTypesById, new Set())
+    for (const id of ids) references.push({ paramId, id })
+  }
+  if (references.length === 0) return
+
+  const users = input.auth?.users
+  const statuses = new Map(
+    await Promise.all(
+      [...new Set(references.map((reference) => reference.id))].map(
+        async (id) =>
+          [
+            id,
+            users
+              ? ((await users.getById({ projectId: input.projectId, id }))?.status ?? null)
+              : "unverifiable",
+          ] as const
+      )
+    )
+  )
+  for (const { paramId, id } of references) {
+    const problem = userReferenceProblem(input.describe(paramId), id, statuses.get(id) ?? null)
+    if (problem) throw input.invalid(problem)
+  }
+}

package/src/shares/compiler.ts

@@ -1,7 +1,8 @@
 import type { ActionDefinitionCatalog } from "../actions"
 import type { LinkPathSelection, LinkPathSelectionMode, ObjectRef } from "../ontology"
+import { isPrimitiveSchema, primitiveTraits } from "../ontology/primitives"
 import type { OntologyDefinitionCatalog } from "../ontology/registry"
-import type { ObjectLink, ObjectType } from "../ontology/types"
+import type { ObjectLink, ObjectType, PrimitiveSchema } from "../ontology/types"
 import type {
   ObjectReadLinkDefinitionSelection,
   ObjectReadLinkSelection,
@@ -88,17 +89,6 @@ export function compileShareAccessPlan(input: CompileShareAccessPlanInput): Shar
   return snapshotShareAccessPlan({ grants })
 }
 
-const SHAREABLE_PRIMITIVE_SCHEMAS = new Set([
-  "string",
-  "integer",
-  "double",
-  "decimal",
-  "boolean",
-  "date",
-  "timestamp",
-  "uuid",
-])
-
 /**
  * V1 deliberately excludes references from shared Action params. A delegated caller cannot yet be
  * authorized to resolve arbitrary object or blob references supplied at invocation time.
@@ -112,9 +102,9 @@ function assertShareableActionParams(input: {
   const seenSchemas = new WeakSet<object>()
   const resolvingValueTypes = new Set<string>()
 
-  const reject = (path: string, kind: "objectRef" | "fileRef"): never => {
+  const reject = (path: string, kind: "objectRef" | PrimitiveSchema): never => {
     throw invalid(
-      `Share '${input.shareId}' Action '${input.actionId}' parameter '${path}' uses ${kind}. Shared Action parameters cannot contain objectRef or fileRef in V1.`
+      `Share '${input.shareId}' Action '${input.actionId}' parameter '${path}' uses ${kind}. Shared Action parameters cannot contain objectRef, fileRef, or userRef in V1.`
     )
   }
 
@@ -126,8 +116,8 @@ function assertShareableActionParams(input: {
 
   const walk = (schema: unknown, path: string): void => {
     if (typeof schema === "string") {
-      if (schema === "fileRef") reject(path, "fileRef")
-      if (!SHAREABLE_PRIMITIVE_SCHEMAS.has(schema)) malformed(path)
+      if (!isPrimitiveSchema(schema)) malformed(path)
+      else if (primitiveTraits(schema)?.shareableParam !== true) reject(path, schema)
       return
     }
     if (!isRecord(schema)) throw malformed(path)

package/src/storage/action-runs/types.ts

@@ -27,6 +27,7 @@ export const ACTION_RUN_FAILURE_CODES = [
   "runtime.cancelled",
   "queue.enqueue_failed",
   "action.phase_failed",
+  "action.read_conflict",
 ] as const satisfies readonly [SixbErrorCode, ...SixbErrorCode[]]
 
 export type ActionRunFailureCode = (typeof ACTION_RUN_FAILURE_CODES)[number]

package/src/storage/auth/in-memory/access-tokens.ts

@@ -38,8 +38,11 @@ export class InMemoryAuthAccessTokenStore implements AuthAccessTokenStore {
     const rows = [...this.state.accessTokens.values()]
       .filter((token) => token.projectId === input.projectId)
       .filter((token) => input.kind === undefined || token.kind === input.kind)
-      .filter((token) => input.subjectType === undefined || token.subjectType === input.subjectType)
-      .filter((token) => input.subjectId === undefined || token.subjectId === input.subjectId)
+      .filter(
+        (token) =>
+          input.subject === undefined ||
+          (token.subject.type === input.subject.type && token.subject.id === input.subject.id)
+      )
       .filter((token) => input.includeRevoked || !token.revokedAt)
       .sort((a, b) => compareByCreatedAt(a, b, order))
     const page = rows.slice(offset, input.limit === undefined ? undefined : offset + input.limit)

package/src/storage/auth/in-memory/auth-storage.ts

@@ -30,7 +30,6 @@ import {
   cloneRecord,
   consumeMagicLinkRecord,
   consumeOidcAttemptRecord,
-  createAccessTokenRecord,
   createAuthStorageState,
   createSessionRecord,
   deviceAuthorizationKey,
@@ -138,24 +137,22 @@ export class InMemoryAuthStorage implements AuthStorage {
       )
     }
     if (
-      input.accessToken.projectId !== input.projectId ||
-      input.accessToken.subjectType !== "user" ||
-      input.accessToken.subjectId !== authorization.approvedUserId ||
-      input.accessToken.createdBySessionId !== authorization.approvedSessionId
+      input.session.projectId !== input.projectId ||
+      input.session.userId !== authorization.approvedUserId
     ) {
       throw new AuthStorageError(
         "invalid_device_authorization",
-        "[Sixb] Device access token is invalid."
+        "[Sixb] Device session is invalid."
       )
     }
-    const accessToken = createAccessTokenRecord(this.state, input.accessToken)
+    const session = createSessionRecord(this.state, input.session)
     const consumed = {
       ...authorization,
       status: "consumed" as const,
       consumedAt: new Date(input.completedAt),
     }
     this.state.deviceAuthorizations.set(key, cloneRecord(consumed))
-    return { authorization: cloneRecord(consumed), accessToken: cloneRecord(accessToken) }
+    return { authorization: cloneRecord(consumed), session: cloneRecord(session) }
   }
 
   async completeMagicLinkSignIn(

package/src/storage/auth/in-memory/device-authorizations.ts

@@ -45,8 +45,6 @@ export class InMemoryAuthDeviceAuthorizationStore implements AuthDeviceAuthoriza
       deviceCodeHash: assertNonEmpty(input.deviceCodeHash, "Device code hash"),
       userCode: assertNonEmpty(input.userCode, "User code"),
       clientName: assertNonEmpty(input.clientName, "Client name"),
-      tokenName: assertNonEmpty(input.tokenName, "Token name"),
-      tokenExpiresAt: new Date(input.tokenExpiresAt),
       status: "pending",
       createdAt: new Date(input.createdAt),
       expiresAt: new Date(input.expiresAt),

package/src/storage/auth/in-memory/sessions.ts

@@ -1,6 +1,11 @@
 import type { AuthSessionAudience } from "../../../auth/audience"
 import { AuthStorageError } from "../errors"
-import type { AuthSessionStore, CreateAuthSessionInput, SessionRecord } from "../types"
+import type {
+  AuthSessionStore,
+  CreateAuthSessionInput,
+  RotateSessionRefreshTokenResult,
+  SessionRecord,
+} from "../types"
 import type { AuthStorageState } from "./shared"
 import {
   cloneDate,
@@ -73,6 +78,7 @@ export class InMemoryAuthSessionStore implements AuthSessionStore {
     const session = this.state.sessions.get(sessionKey(params.projectId, params.id))
     if (
       !session ||
+      session.bearer ||
       session.audience !== params.audience ||
       session.tokenHash !== params.tokenHash ||
       !isActiveSession(session, params.now)
@@ -83,6 +89,67 @@ export class InMemoryAuthSessionStore implements AuthSessionStore {
     return cloneRecord(session)
   }
 
+  async findValidByAccessTokenHash(params: {
+    readonly projectId: string
+    readonly id: string
+    readonly tokenHash: string
+    readonly now: Date
+  }): Promise<SessionRecord | null> {
+    const session = this.state.sessions.get(sessionKey(params.projectId, params.id))
+    if (
+      !session?.bearer ||
+      session.tokenHash !== params.tokenHash ||
+      session.bearer.accessExpiresAt <= params.now ||
+      !isActiveSession(session, params.now)
+    ) {
+      return null
+    }
+
+    return cloneRecord(session)
+  }
+
+  async rotateRefreshToken(
+    params: Parameters<AuthSessionStore["rotateRefreshToken"]>[0]
+  ): Promise<RotateSessionRefreshTokenResult> {
+    const key = sessionKey(params.projectId, params.id)
+    const session = this.state.sessions.get(key)
+    if (!session?.bearer || !isActiveSession(session, params.now)) {
+      return { status: "invalid" }
+    }
+
+    const { bearer } = session
+    const replacedRecently =
+      bearer.previousRefreshTokenHash === params.refreshTokenHash &&
+      bearer.refreshedAt !== undefined &&
+      params.now.getTime() - bearer.refreshedAt.getTime() <= params.reuseGraceMs
+    if (bearer.refreshTokenHash !== params.refreshTokenHash && !replacedRecently) {
+      if (bearer.previousRefreshTokenHash !== params.refreshTokenHash) {
+        return { status: "invalid" }
+      }
+      this.state.sessions.set(key, cloneRecord({ ...session, revokedAt: cloneDate(params.now) }))
+      return { status: "reused" }
+    }
+
+    const requestedExpiresAt = session.absoluteExpiresAt
+      ? new Date(Math.min(params.next.expiresAt.getTime(), session.absoluteExpiresAt.getTime()))
+      : params.next.expiresAt
+    const next: SessionRecord = {
+      ...session,
+      tokenHash: params.next.tokenHash,
+      expiresAt: new Date(Math.max(session.expiresAt.getTime(), requestedExpiresAt.getTime())),
+      lastSeenAt: cloneDate(params.now),
+      bearer: {
+        clientName: bearer.clientName,
+        accessExpiresAt: cloneDate(params.next.accessExpiresAt),
+        refreshTokenHash: params.next.refreshTokenHash,
+        previousRefreshTokenHash: bearer.refreshTokenHash,
+        refreshedAt: cloneDate(params.now),
+      },
+    }
+    this.state.sessions.set(key, cloneRecord(next))
+    return { status: "rotated", session: cloneRecord(next) }
+  }
+
   async renewIfValid(params: {
     readonly projectId: string
     readonly id: string
@@ -95,6 +162,7 @@ export class InMemoryAuthSessionStore implements AuthSessionStore {
     const session = this.state.sessions.get(key)
     if (
       !session ||
+      session.bearer ||
       session.audience !== params.audience ||
       session.tokenHash !== params.tokenHash ||
       !isActiveSession(session, params.now)

package/src/storage/auth/in-memory/shared.ts

@@ -320,6 +320,13 @@ export function createSessionRecord(
     absoluteExpiresAt: input.absoluteExpiresAt ? cloneDate(input.absoluteExpiresAt) : undefined,
     userAgent: input.userAgent,
     ipAddress: input.ipAddress,
+    bearer: input.bearer
+      ? {
+          clientName: assertNonEmpty(input.bearer.clientName, "Session client name"),
+          accessExpiresAt: cloneDate(input.bearer.accessExpiresAt),
+          refreshTokenHash: assertNonEmpty(input.bearer.refreshTokenHash, "Refresh token hash"),
+        }
+      : undefined,
   }
 
   state.sessions.set(sessionKey(projectId, id), cloneRecord(session))
@@ -398,11 +405,11 @@ export function createAccessTokenRecord(
   const id = assertNonEmpty(input.id, "Access token id")
   const projectId = assertNonEmpty(input.projectId, "Project id")
   const name = assertNonEmpty(input.name, "Access token name")
-  const subjectId = assertNonEmpty(input.subjectId, "Access token subject id")
+  const subjectId = assertNonEmpty(input.subject.id, "Access token subject id")
   const tokenHash = assertNonEmpty(input.tokenHash, "Access token hash")
 
-  assertAccessTokenSubject(input.kind, input.subjectType)
-  assertAccessTokenSubjectExists(state, projectId, input.subjectType, subjectId)
+  assertAccessTokenSubject(input.kind, input.subject.type)
+  assertAccessTokenSubjectExists(state, projectId, input.subject.type, subjectId)
 
   const key = accessTokenKey(projectId, id)
   if (state.accessTokens.has(key)) {
@@ -417,8 +424,7 @@ export function createAccessTokenRecord(
     projectId,
     name,
     kind: input.kind,
-    subjectType: input.subjectType,
-    subjectId,
+    subject: { type: input.subject.type, id: subjectId },
     tokenHash,
     groupIds: normalizeOptionalGroupIds(input.groupIds),
     createdByPrincipal: input.createdByPrincipal,
@@ -484,7 +490,7 @@ export function removeGroupMembershipRecord(
 
 function assertAccessTokenSubject(
   kind: CreateAuthAccessTokenInput["kind"],
-  subjectType: CreateAuthAccessTokenInput["subjectType"]
+  subjectType: CreateAuthAccessTokenInput["subject"]["type"]
 ): void {
   if (
     (kind === "personal" && subjectType === "user") ||
@@ -502,7 +508,7 @@ function assertAccessTokenSubject(
 function assertAccessTokenSubjectExists(
   state: AuthStorageState,
   projectId: string,
-  subjectType: CreateAuthAccessTokenInput["subjectType"],
+  subjectType: CreateAuthAccessTokenInput["subject"]["type"],
   subjectId: string
 ): void {
   if (subjectType === "user") {

package/src/storage/auth/index.ts

@@ -3,7 +3,6 @@ export { AuthStorageError } from "./errors"
 export { InMemoryAuthStorage } from "./in-memory"
 export type {
   AccessTokenRecord,
-  AccessTokenSubjectType,
   AuthAccessTokenStore,
   AuthDeviceAuthorizationStore,
   AuthGroupMembershipStore,
@@ -16,6 +15,7 @@ export type {
   AuthStorage,
   AuthUserIdentityStore,
   AuthUserStore,
+  BearerSessionState,
   CompleteAuthSessionInput,
   CompleteDeviceAuthorizationInput,
   CompleteDeviceAuthorizationResult,
@@ -47,6 +47,7 @@ export type {
   MagicLinkRecord,
   OidcAuthorizationAttemptRecord,
   ReconcileAuthServiceAccountGroupMembershipsInput,
+  RotateSessionRefreshTokenResult,
   ServiceAccountGroupMembershipRecord,
   ServiceAccountRecord,
   ServiceAccountStatus,

package/src/storage/auth/types.ts

@@ -1,10 +1,10 @@
 import type { AccessTokenKind, AuthSessionAudience, Principal } from "../../auth"
+import type { AuthorizablePrincipal } from "../../execution/types"
 
 export type UserStatus = "active" | "suspended"
 export type ServiceAccountStatus = "active" | "suspended"
 export type InvitationStatus = "pending" | "accepted" | "revoked"
 export type GroupMembershipSource = "invitation" | "manual" | "agent"
-export type AccessTokenSubjectType = "user" | "serviceAccount"
 export type DeviceAuthorizationStatus = "pending" | "approved" | "denied" | "consumed"
 export const MAX_PENDING_DEVICE_AUTHORIZATIONS = 100
 
@@ -54,6 +54,7 @@ export interface SessionRecord {
   readonly projectId: string
   readonly userId: string
   readonly strategyId: string
+  /** The web app a browser session belongs to. A bearer session belongs to none and ignores it. */
   readonly audience: AuthSessionAudience
   readonly tokenHash: string
   readonly createdAt: Date
@@ -65,15 +66,36 @@ export interface SessionRecord {
   // view. Display only — never used for authorization.
   readonly userAgent?: string
   readonly ipAddress?: string
+  /** Present when a native client holds the session as bearer tokens instead of a cookie. */
+  readonly bearer?: BearerSessionState
 }
 
+/**
+ * A native client's credentials for its session. `tokenHash` on the session is the current access
+ * token's hash; the refresh token rotates on every refresh.
+ */
+export interface BearerSessionState {
+  /** Self-reported client label, such as "sixb CLI on alex-mbp". Display only. */
+  readonly clientName: string
+  readonly accessExpiresAt: Date
+  readonly refreshTokenHash: string
+  /** The refresh token the last rotation replaced, accepted briefly in case its response was lost. */
+  readonly previousRefreshTokenHash?: string
+  readonly refreshedAt?: Date
+}
+
+export type RotateSessionRefreshTokenResult =
+  | { readonly status: "rotated"; readonly session: SessionRecord }
+  /** A replaced refresh token came back after the grace window; the session is now revoked. */
+  | { readonly status: "reused" }
+  | { readonly status: "invalid" }
+
 export interface AccessTokenRecord {
   readonly id: string
   readonly projectId: string
   readonly name: string
   readonly kind: AccessTokenKind
-  readonly subjectType: AccessTokenSubjectType
-  readonly subjectId: string
+  readonly subject: AuthorizablePrincipal
   readonly tokenHash: string
   /**
    * Optional group constraint. Undefined means "inherit every current group";
@@ -148,8 +170,6 @@ export interface DeviceAuthorizationRecord {
   readonly deviceCodeHash: string
   readonly userCode: string
   readonly clientName: string
-  readonly tokenName: string
-  readonly tokenExpiresAt: Date
   readonly status: DeviceAuthorizationStatus
   readonly approvedUserId?: string
   readonly approvedSessionId?: string
@@ -273,6 +293,7 @@ export interface CreateAuthSessionInput {
   readonly absoluteExpiresAt?: Date
   readonly userAgent?: string
   readonly ipAddress?: string
+  readonly bearer?: Pick<BearerSessionState, "clientName" | "accessExpiresAt" | "refreshTokenHash">
 }
 
 export interface CreateAuthAccessTokenInput {
@@ -280,8 +301,7 @@ export interface CreateAuthAccessTokenInput {
   readonly projectId: string
   readonly name: string
   readonly kind: AccessTokenKind
-  readonly subjectType: AccessTokenSubjectType
-  readonly subjectId: string
+  readonly subject: AuthorizablePrincipal
   readonly tokenHash: string
   readonly groupIds?: readonly string[]
   readonly createdByPrincipal?: Principal
@@ -293,8 +313,7 @@ export interface CreateAuthAccessTokenInput {
 export interface ListAuthAccessTokensInput {
   readonly projectId: string
   readonly kind?: AccessTokenKind
-  readonly subjectType?: AccessTokenSubjectType
-  readonly subjectId?: string
+  readonly subject?: AuthorizablePrincipal
   readonly includeRevoked?: boolean
   readonly limit?: number
   readonly offset?: number
@@ -385,8 +404,6 @@ export interface CreateDeviceAuthorizationInput {
   readonly deviceCodeHash: string
   readonly userCode: string
   readonly clientName: string
-  readonly tokenName: string
-  readonly tokenExpiresAt: Date
   readonly createdAt: Date
   readonly expiresAt: Date
 }
@@ -395,13 +412,14 @@ export interface CompleteDeviceAuthorizationInput {
   readonly projectId: string
   readonly id: string
   readonly deviceCodeHash: string
-  readonly accessToken: CreateAuthAccessTokenInput
+  /** The bearer session to start for the approving user. */
+  readonly session: CreateAuthSessionInput & { readonly bearer: BearerSessionState }
   readonly completedAt: Date
 }
 
 export interface CompleteDeviceAuthorizationResult {
   readonly authorization: DeviceAuthorizationRecord
-  readonly accessToken: AccessTokenRecord
+  readonly session: SessionRecord
 }
 
 export interface CompleteMagicLinkSignInInput {
@@ -523,6 +541,7 @@ export interface AuthSessionStore {
     readonly userId: string
     readonly now: Date
   }): Promise<readonly SessionRecord[]>
+  /** A live browser (cookie) session whose secret hashes to `tokenHash`. */
   findValidByTokenHash(params: {
     readonly projectId: string
     readonly id: string
@@ -530,6 +549,31 @@ export interface AuthSessionStore {
     readonly tokenHash: string
     readonly now: Date
   }): Promise<SessionRecord | null>
+  /** A live bearer session whose current, unexpired access token hashes to `tokenHash`. */
+  findValidByAccessTokenHash(params: {
+    readonly projectId: string
+    readonly id: string
+    readonly tokenHash: string
+    readonly now: Date
+  }): Promise<SessionRecord | null>
+  /**
+   * Atomically replace a live bearer session's tokens. The current refresh token rotates; the one
+   * it replaced also rotates within `reuseGraceMs` of that replacement. Presenting it later revokes
+   * the session. `next.expiresAt` extends the idle deadline, never past the absolute one.
+   */
+  rotateRefreshToken(params: {
+    readonly projectId: string
+    readonly id: string
+    readonly refreshTokenHash: string
+    readonly now: Date
+    readonly reuseGraceMs: number
+    readonly next: {
+      readonly tokenHash: string
+      readonly accessExpiresAt: Date
+      readonly refreshTokenHash: string
+      readonly expiresAt: Date
+    }
+  }): Promise<RotateSessionRefreshTokenResult>
   renewIfValid(params: {
     readonly projectId: string
     readonly id: string

package/src/storage/executions/validation.ts

@@ -340,7 +340,7 @@ async function validateCredential(
       `[Sixb] Authority access token '${credential.id}' does not exist in project '${record.projectId}'.`
     )
   }
-  if (token.subjectType !== principal.type || token.subjectId !== principal.id) {
+  if (!principalsEqual(token.subject, principal)) {
     throw new ExecutionStorageError(
       "invalid_credential",
       `[Sixb] Authority access token '${credential.id}' does not belong to principal '${principal.id}'.`