Skip to content

Commit 40aa75d

Browse files
mzxchandracursoragent
mzxchandra
and
cursoragent
committed
fix(auth): close workspace and resource grant admission gaps
A workspace entity grant is admitted only when its invocation matches that grant, and a workspace-owned grant with any extra key matches neither classifier. Co-authored-by: Cursor <cursoragent@cursor.com>
1 parent aed367e commit 40aa75d

35 files changed

Lines changed: 773 additions & 151 deletions

‎apps/sim/lib/auth/delegated-grant-admission.test.ts‎

Lines changed: 167 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,167 @@
1+
/**
2+
* @vitest-environment node
3+
*/
4+
import {
5+
hasResourceOperationGrant,
6+
isWorkspaceDelegation,
7+
parsePrincipal,
8+
principalWorkspaceId,
9+
type ResourceDelegationScope,
10+
serializePrincipal,
11+
workspaceDelegationRestrictions,
12+
} from '@sim/auth/principal'
13+
import { createDelegatedPrincipal } from '@sim/testing/factories/principal.factory'
14+
import { describe, expect, it } from 'vitest'
15+
import { markCopilotWorkspaceInvocation } from '@/lib/core/application/copilot-workspace-invocation'
16+
import { requireResourceDelegation } from '@/lib/core/application/resource-delegation'
17+
import { requireAllowedWorkspacePrincipal } from '@/lib/core/application/workspace-authorization'
18+
import { defineWorkspaceOperation } from '@/lib/core/application/workspace-operation'
19+
import { createWorkspaceFileDelegatedPrincipal } from '@/lib/workspace-files/application/delegated-principal'
20+
21+
const issuedAt = new Date('2026-01-01T00:00:00.000Z')
22+
const expiresAt = new Date('2099-01-01T00:00:00.000Z')
23+
const workspaceOperation = defineWorkspaceOperation({
24+
id: 'test.workspace-grant',
25+
minimumRole: 'read',
26+
workspaceApiKey: 'deny',
27+
principalKinds: ['delegated'],
28+
delegatedServices: ['copilot'],
29+
contentDelivery: 'none',
30+
capability: 'none',
31+
})
32+
const resourcePolicy = {
33+
audience: 'sim:files',
34+
services: ['copilot'],
35+
maxTtlMs: 60_000,
36+
scope: { kind: 'entity', owner: { entityType: 'project', entityId: 'project-1' } },
37+
} as const
38+
39+
function copilotEnvelope(
40+
grant: ResourceDelegationScope,
41+
invocation: { kind: 'chat'; chatId: string } | { kind: 'workspace'; workspaceId: string }
42+
) {
43+
return {
44+
kind: 'delegated' as const,
45+
serviceId: 'copilot' as const,
46+
subjectUserId: 'user-1',
47+
delegationId: 'delegation-1',
48+
audience: 'sim:test',
49+
issuedAt,
50+
expiresAt,
51+
invocation,
52+
grant,
53+
}
54+
}
55+
56+
const workspaceGrant = {
57+
kind: 'entity' as const,
58+
owner: { entityType: 'workspace' as const, entityId: 'workspace-1' },
59+
}
60+
const illegalFileGrant = { ...workspaceGrant, fileId: 'file-1' }
61+
62+
describe('delegated grant admission', () => {
63+
it('rejects a workspace entity grant that also names a top-level file', () => {
64+
const principal = copilotEnvelope(illegalFileGrant, {
65+
kind: 'workspace',
66+
workspaceId: 'workspace-1',
67+
})
68+
expect(isWorkspaceDelegation(principal)).toBe(false)
69+
expect(hasResourceOperationGrant(principal)).toBe(false)
70+
expect(principalWorkspaceId(principal)).toBeUndefined()
71+
expect(() => requireAllowedWorkspacePrincipal(principal, workspaceOperation)).toThrow(
72+
expect.objectContaining({ detailCode: 'PRINCIPAL_KIND_NOT_PERMITTED' })
73+
)
74+
expect(() => requireResourceDelegation(principal, resourcePolicy)).toThrow(
75+
'Resource delegation is no longer valid'
76+
)
77+
expect(() => markCopilotWorkspaceInvocation(principal)).toThrow(/current/)
78+
})
79+
80+
it('rejects a workspace invocation that names a different workspace than the grant', () => {
81+
const principal = {
82+
...createDelegatedPrincipal({ workspaceId: 'workspace-1' }),
83+
invocation: { kind: 'workspace' as const, workspaceId: 'other' },
84+
}
85+
expect(isWorkspaceDelegation(principal)).toBe(false)
86+
expect(principalWorkspaceId(principal)).toBeUndefined()
87+
})
88+
89+
it('rejects a chat invocation whose chat id is absent from restrictions', () => {
90+
const principal = {
91+
...createDelegatedPrincipal({ workspaceId: 'workspace-1', resourceScope: {} }),
92+
invocation: { kind: 'chat' as const, chatId: 'chat-1' },
93+
}
94+
expect(isWorkspaceDelegation(principal)).toBe(false)
95+
expect(workspaceDelegationRestrictions(principal)?.chatId).toBeUndefined()
96+
})
97+
98+
it('accepts a chat invocation that matches restrictions and reads the grant owner', () => {
99+
const principal = {
100+
...createDelegatedPrincipal({
101+
workspaceId: 'workspace-1',
102+
resourceScope: { chatId: 'chat-1' },
103+
}),
104+
invocation: { kind: 'chat' as const, chatId: 'chat-1' },
105+
}
106+
expect(isWorkspaceDelegation(principal)).toBe(true)
107+
expect(principalWorkspaceId(principal)).toBe('workspace-1')
108+
})
109+
110+
it('keeps an empty restriction object from bypassing a required chat id', () => {
111+
const principal = createDelegatedPrincipal({
112+
workspaceId: 'workspace-1',
113+
resourceScope: {},
114+
})
115+
expect(isWorkspaceDelegation(principal)).toBe(true)
116+
expect(workspaceDelegationRestrictions(principal)?.chatId).toBeUndefined()
117+
})
118+
119+
it('keeps a project entity grant on the resource side of the partition', () => {
120+
const principal = copilotEnvelope(
121+
{ kind: 'entity', owner: { entityType: 'project', entityId: 'project-1' } },
122+
{ kind: 'chat', chatId: 'chat-1' }
123+
)
124+
expect(hasResourceOperationGrant(principal)).toBe(true)
125+
expect(isWorkspaceDelegation(principal)).toBe(false)
126+
expect(principalWorkspaceId(principal)).toBeUndefined()
127+
})
128+
129+
it('keeps a copilot workspace-file chat invocation across a snapshot round-trip', () => {
130+
const minted = createWorkspaceFileDelegatedPrincipal({
131+
serviceId: 'copilot',
132+
subjectUserId: 'user-1',
133+
workspaceId: 'workspace-1',
134+
delegationId: 'delegation-1',
135+
fileId: 'file-1',
136+
chatId: 'chat-1',
137+
})
138+
if (minted.serviceId !== 'copilot') throw new Error('Expected a copilot file principal')
139+
expect(minted.invocation).toEqual({ kind: 'chat', chatId: 'chat-1' })
140+
expect(minted.grant.restrictions).toMatchObject({ fileId: 'file-1', chatId: 'chat-1' })
141+
const parsed = parsePrincipal(serializePrincipal(minted))
142+
if (parsed.kind !== 'delegated' || parsed.serviceId === 'executor')
143+
throw new Error('Expected a subject delegation')
144+
expect(parsed.invocation).toEqual({ kind: 'chat', chatId: 'chat-1' })
145+
expect(parsed.grant.restrictions).toMatchObject({ fileId: 'file-1', chatId: 'chat-1' })
146+
})
147+
148+
it('parses a realtime workspace payload as a workspace invocation', () => {
149+
const parsed = parsePrincipal({
150+
version: 1,
151+
principal: {
152+
kind: 'delegated',
153+
serviceId: 'realtime',
154+
subjectUserId: 'user-1',
155+
workspaceId: 'workspace-1',
156+
delegationId: 'delegation-1',
157+
audience: 'sim:test',
158+
issuedAt: issuedAt.toISOString(),
159+
expiresAt: new Date('2026-01-01T00:05:00.000Z').toISOString(),
160+
},
161+
})
162+
if (parsed.kind !== 'delegated' || parsed.serviceId !== 'realtime')
163+
throw new Error('Expected a realtime delegation')
164+
expect(parsed.invocation).toEqual({ kind: 'workspace', workspaceId: 'workspace-1' })
165+
expect(parsed).not.toHaveProperty('connectionId')
166+
})
167+
})

‎apps/sim/lib/auth/principal.test.ts‎

Lines changed: 139 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,9 @@
11
import {
2+
hasResourceOperationGrant,
3+
isWorkspaceDelegation,
24
PrincipalSubjectUserRequiredError,
35
parsePrincipal,
6+
principalWorkspaceId,
47
requirePrincipalSubjectUserId,
58
resolvePrincipalAttribution,
69
resolvePrincipalAuditAttribution,
@@ -211,6 +214,142 @@ describe('principal subject users', () => {
211214
})
212215
})
213216

217+
describe('delegated grant partition', () => {
218+
const issuedAt = new Date('2026-01-01T00:00:00.000Z')
219+
const expiresAt = new Date('2026-01-01T00:05:00.000Z')
220+
const base = {
221+
kind: 'delegated' as const,
222+
serviceId: 'copilot' as const,
223+
subjectUserId: 'user-1',
224+
delegationId: 'delegation-1',
225+
audience: 'sim:files',
226+
issuedAt,
227+
expiresAt,
228+
}
229+
230+
it('rejects a workspace entity grant that also carries a top-level file id', () => {
231+
const illegal = {
232+
...base,
233+
invocation: { kind: 'workspace' as const, workspaceId: 'workspace-1' },
234+
grant: {
235+
kind: 'entity' as const,
236+
owner: { entityType: 'workspace' as const, entityId: 'workspace-1' },
237+
fileId: 'file-1',
238+
},
239+
}
240+
const extraKey = {
241+
...base,
242+
invocation: { kind: 'workspace' as const, workspaceId: 'workspace-1' },
243+
grant: {
244+
kind: 'entity' as const,
245+
owner: { entityType: 'workspace' as const, entityId: 'workspace-1' },
246+
note: 'extra',
247+
},
248+
}
249+
for (const principal of [illegal, extraKey]) {
250+
expect(isWorkspaceDelegation(principal)).toBe(false)
251+
expect(hasResourceOperationGrant(principal)).toBe(false)
252+
expect(principalWorkspaceId(principal)).toBeUndefined()
253+
}
254+
})
255+
256+
it('rejects a workspace invocation that names a different workspace than the grant', () => {
257+
const principal = {
258+
...base,
259+
invocation: { kind: 'workspace' as const, workspaceId: 'other' },
260+
grant: {
261+
kind: 'entity' as const,
262+
owner: { entityType: 'workspace' as const, entityId: 'workspace-1' },
263+
},
264+
}
265+
expect(isWorkspaceDelegation(principal)).toBe(false)
266+
expect(principalWorkspaceId(principal)).toBeUndefined()
267+
})
268+
269+
it('rejects a chat invocation whose chat id is absent from restrictions', () => {
270+
const principal = {
271+
...base,
272+
invocation: { kind: 'chat' as const, chatId: 'chat-1' },
273+
grant: {
274+
kind: 'entity' as const,
275+
owner: { entityType: 'workspace' as const, entityId: 'workspace-1' },
276+
},
277+
}
278+
expect(isWorkspaceDelegation(principal)).toBe(false)
279+
expect(principalWorkspaceId(principal)).toBeUndefined()
280+
})
281+
282+
it('accepts a chat invocation that matches restrictions and reads the grant owner', () => {
283+
const principal = {
284+
...base,
285+
invocation: { kind: 'chat' as const, chatId: 'chat-1' },
286+
grant: {
287+
kind: 'entity' as const,
288+
owner: { entityType: 'workspace' as const, entityId: 'workspace-1' },
289+
restrictions: { chatId: 'chat-1' },
290+
},
291+
}
292+
expect(isWorkspaceDelegation(principal)).toBe(true)
293+
expect(principalWorkspaceId(principal)).toBe('workspace-1')
294+
expect(hasResourceOperationGrant(principal)).toBe(false)
295+
})
296+
297+
it('keeps empty restrictions a workspace delegation when the workspace invocation matches', () => {
298+
const principal = {
299+
...base,
300+
invocation: { kind: 'workspace' as const, workspaceId: 'workspace-1' },
301+
grant: {
302+
kind: 'entity' as const,
303+
owner: { entityType: 'workspace' as const, entityId: 'workspace-1' },
304+
restrictions: {},
305+
},
306+
}
307+
expect(isWorkspaceDelegation(principal)).toBe(true)
308+
expect(principalWorkspaceId(principal)).toBe('workspace-1')
309+
})
310+
311+
it('keeps a project entity grant a resource grant', () => {
312+
const principal = {
313+
...base,
314+
invocation: { kind: 'chat' as const, chatId: 'chat-1' },
315+
grant: {
316+
kind: 'entity' as const,
317+
owner: { entityType: 'project' as const, entityId: 'project-1' },
318+
},
319+
}
320+
expect(hasResourceOperationGrant(principal)).toBe(true)
321+
expect(isWorkspaceDelegation(principal)).toBe(false)
322+
expect(principalWorkspaceId(principal)).toBeUndefined()
323+
})
324+
325+
it('restores a realtime workspace payload as a workspace invocation', () => {
326+
const restored = parsePrincipal({
327+
version: 1,
328+
principal: {
329+
kind: 'delegated',
330+
serviceId: 'realtime',
331+
subjectUserId: 'user-1',
332+
workspaceId: 'workspace-1',
333+
delegationId: 'delegation-1',
334+
audience: 'sim:workflows',
335+
issuedAt: issuedAt.toISOString(),
336+
expiresAt: expiresAt.toISOString(),
337+
},
338+
})
339+
expect(restored).toMatchObject({
340+
serviceId: 'realtime',
341+
invocation: { kind: 'workspace', workspaceId: 'workspace-1' },
342+
grant: {
343+
kind: 'entity',
344+
owner: { entityType: 'workspace', entityId: 'workspace-1' },
345+
},
346+
})
347+
expect(restored).not.toHaveProperty('connectionId')
348+
if (restored.kind === 'delegated')
349+
expect(restored.invocation).not.toHaveProperty('connectionId')
350+
})
351+
})
352+
214353
describe('principal persistence', () => {
215354
it('round trips delegated principals and restores dates', () => {
216355
const principal = {

‎apps/sim/lib/core/application/copilot-workspace-invocation.test.ts‎

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
import { createExecutorPrincipal } from '@sim/testing/factories/principal.factory'
12
import { describe, expect, it } from 'vitest'
23
import {
34
bindCopilotWorkspaceOperation,
@@ -44,9 +45,21 @@ describe('private table workspace invocation', () => {
4445
expect(() =>
4546
markCopilotWorkspaceInvocation({ ...principal(), expiresAt: new Date(0) })
4647
).toThrow(/current/)
47-
expect(() => markCopilotWorkspaceInvocation({ ...principal(), serviceId: 'executor' })).toThrow(
48-
/current/
49-
)
48+
expect(() =>
49+
markCopilotWorkspaceInvocation(
50+
createExecutorPrincipal({ subjectUserId: 'actor', workspaceId: 'workspace' })
51+
)
52+
).toThrow(/current/)
53+
const illegal = {
54+
...principal(),
55+
invocation: { kind: 'workspace' as const, workspaceId: 'workspace' },
56+
grant: {
57+
kind: 'entity' as const,
58+
owner: { entityType: 'workspace' as const, entityId: 'workspace' },
59+
fileId: 'file-1',
60+
},
61+
}
62+
expect(() => markCopilotWorkspaceInvocation(illegal)).toThrow(/current/)
5063
})
5164
})
5265
describe('nested workspace operation binding', () => {

‎apps/sim/lib/core/application/copilot-workspace-invocation.ts‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,9 @@ import { OrchestrationError } from '@/lib/core/orchestration/types'
1010
/** In-process admission evidence, never serialized into a job, token, checkpoint, or wire field. */
1111
const ADMITTED = new WeakSet<WorkspaceDelegatedPrincipal>()
1212

13-
export function markCopilotWorkspaceInvocation(principal: WorkspaceDelegatedPrincipal): void {
13+
export function markCopilotWorkspaceInvocation(principal: Principal): void {
1414
if (
15+
!isWorkspaceDelegation(principal) ||
1516
principal.serviceId !== 'copilot' ||
1617
!principal.subjectUserId ||
1718
!principalWorkspaceId(principal) ||

0 commit comments

Comments
 (0)