toga-ai 1.0.1007 → 1.0.1008

package/knowledge/sessions/2026-10-13-TRUE-82718-mhammontree.md

@@ -0,0 +1,61 @@
+---
+type: session
+slug: TRUE-82718
+title: Desk KB document red box — s3fs mount uses deleted IAM key
+author: mhammontree
+repos: [togadesk, toga]
+framework: "1.0"
+client: true
+status: active
+created: 2026-10-13
+updated: 2026-10-13
+---
+
+# Session: TRUE-82718
+**Date:** 2026-10-13
+**Project/Repo:** togadesk (1.0)
+**Task:** Investigate the TOGa Desk red box when opening Knowledge Base documents (`template/pages/documents/viewdocument.php` line 9: `file_get_contents(/var/app/asifiles/knowledgebase-prod/general/1741): failed to open stream: No such file or directory`). Investigation only; the fix is handed to Srija.
+
+---
+
+## What WORKED
+- **Proved the file is not missing.** Mark found `asifiles/knowledgebase-prod/general/1741` in S3. So the data is fine; the server cannot read it.
+- **Found how Desk reads KB files.** `/var/app/asifiles` is an s3fs mount of bucket `asifiles` on each EB server (`.ebextensions/006_mount-s3fs.config` → `ebs/create-s3fs-credentials-file.php` writes `/etc/passwd-s3fs`, then `ebs/mount-s3fs-folders.php` builds the mount command into the EB deploy hook `appdeploy/enact/04_s3fs.sh`).
+- **Root cause (confirmed by Mark in IAM).** `ebs/create-s3fs-credentials-file.php` hardcodes IAM key `AKIAJAGE…` (full id in the file). In IAM (Mark's view) only users `jhammontree` and `ses-smtp-user.20240731-170420` exist. Neither owns that key, so it was removed in the TRUE-82705 key cleanup (2026-10-12). The s3fs mount cannot log in, so every file under `/var/app/asifiles` (KB docs, ticket uploads, depot repair files) reads as "No such file".
+- **Second dead key.** `ebs/check_s3fs.php` (cron every 3 min, ends a server whose mount dropped) and `ebs/register_instance_to_shared_application_load_balancer.php` hardcode the deleted key `AKIAIPDI…` (the TRUE-82705 key). So the auto-repair also fails.
+- **Reviewed Srija's toga fix, commit `79336c1f01b5d632d146bc23f6debc93009b3cec`** (on toga `_production`, `_demo`, `TRUE-82714`): adds `-o iam_role=auto` to `ebs/mount-s3fs-folders.php`, and changes `ebs/create-s3fs-credentials-file.php` to drop the key and delete any old `/etc/passwd-s3fs`. toga's pre-change copies of both files are identical to togadesk's today (`diff --strip-trailing-cr` = same). So it applies to togadesk as-is.
+- **Reviewed Srija's composer commit `63c5ed07f76fc1962d035bf83d7751fb773c4fd6`** (toga, TRUE-82714): adds `aws/aws-sdk-php ^3.328` (locks 3.337.3). **togadesk does NOT need it.** togadesk's `composer.json` has had `aws/aws-sdk-php ^3.337` since `f7611893` (TRUE-57575, 2025-02-14), and `composer.lock` pins 3.337.3. Deploy runs `composer install` (`.ebextensions/015_install_composer.config`), and `_/app/framework.php:17-18` loads `vendor/autoload.php`.
+
+## What did NOT work — DO NOT RETRY THESE
+- Nothing failed. Do not look for a missing S3 object or a stale DB row: the file exists in S3, and the cause is the mount login.
+
+## Not tried yet (candidates for next session)
+- Check that the TOGa Desk EB environment uses the same EC2 instance profile as toga, and that the role has access to `asifiles` (`s3:ListBucket` on the bucket; `GetObject`/`PutObject`/`DeleteObject`/`PutObjectAcl` on objects — ACL because the mount uses `default_acl=public-read`). If Desk's servers are in a different account than 502614707982, a bucket policy is also needed.
+- Confirm toga uploads work after Srija's deploy. That proves `iam_role=auto` works with s3fs 1.84 on this old Amazon Linux 1 platform.
+- On a Desk prod server after deploy: `ls /var/app/asifiles/knowledgebase-prod/general/1741`.
+- togaview has the same dead keys in all four `ebs/` files and needs the same fix (separate ticket).
+
+## Current file state
+| File | Status | Notes |
+|------|--------|-------|
+| (none) | unchanged | No code changed this session. togadesk is on branch `TRUE-82718` (created by Mark), clean. |
+
+## Decisions made
+- **Srija does the togadesk fix** (Mark, 2026-10-13). She has it ready. This session made no code change.
+- **Scope of the togadesk fix**, as agreed in review:
+  1. Srija's s3fs change from toga `79336c1` (`mount-s3fs-folders.php` + `create-s3fs-credentials-file.php`).
+  2. `ebs/check_s3fs.php`: replace the deleted key with the `WorkloadsRuntime` assume-role pattern (see `tools/ebs/check_s3fs.php`). toga has no copy of this file, so Srija's commit does not cover it.
+  3. `ebs/register_instance_to_shared_application_load_balancer.php`: copy toga's fix `21b142d` (TRUE-82705).
+  4. `template/pages/documents/viewdocument.php`: cast `$_GET['id']` to int before the file path and the SQL. Today `?id=../../../current/config.prod.ini` can read any server file, and the SQL is not escaped. Also show "document not available" instead of the red box.
+- **Composer change not needed for togadesk** (AWS SDK already present, same version).
+- **Rejected:** deleting `create-s3fs-credentials-file.php` (Srija's version keeps it and removes `/etc/passwd-s3fs`, so `006_mount-s3fs.config` keeps working). Rejected: making a new long-lived IAM key (TRUE-82705 removed all keys on purpose).
+- **Order:** the role must have `asifiles` access before the togadesk deploy, or the mount still fails.
+
+## Blockers
+- none for this session. The fix is with Srija.
+
+## Exact next step
+> Ask Srija for her togadesk commit SHA, then review it against the 4-item scope in "Decisions made". Check especially items 2 (`check_s3fs.php`) and 4 (`viewdocument.php` int cast), which are not in her toga commit.
+
+---
+_Saved by /session-save on 2026-10-13_

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.1007",
+  "version": "1.0.1008",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",