feat(backend): enforce user-owned sessions

2026-07-16 18:32:52 +02:00
parent 72db6b823d
commit 458eb13c89
15 changed files with 626 additions and 105 deletions
@@ -0,0 +1,50 @@
+# Task 5 report — backend principal enforcement
+
+## RED
+
+Added backend route/auth tests before implementation. The initial focused run failed in
+seven new assertions: `getPrincipal` did not exist, upstream requests still required the
+legacy identity header, foreign session/SSE routes were not hidden, admin scope was not
+enforced, new sessions had no trusted principal binding, and settings were global.
+
+## GREEN
+
+- Focused backend suite: `66 passed` across auth, sessions, SSE, and settings tests.
+- Complete backend Vitest suite: `209 passed` across `22` files.
+- `npx tsc --noEmit -p .`, `npm run build`, `git diff --check`, and changed Python
+  source Ruff all exit successfully.
+- Harness targeted repository/local/migration tests and Python bytecode compilation exit
+  successfully. The new `tht session preferences get|set` commands are registered and
+  expose the expected Typer help. A direct local CLI preference smoke was not run because
+  the checked-in local workspace requires unavailable `THT_DB_HOST` configuration.
+
+## Route and child-process coverage
+
+- `GET /me` returns the request `PrincipalContext`; upstream accepts only the portal's
+  normalized `X-Thoth-*` identity tuple, with the legacy header ignored. Local mode uses
+  the same stable `THT_HOME`/`~/.thothii/identity.json` UUID contract as the harness.
+- All session operations are principal-scoped: list (`mine` and admin-only `all`), show,
+  create, resume, close, delete, rename, group, archive, unarchive, documents, reviewer
+  response, steer, SQL preview/export, and SSE. Missing and foreign sessions are 404;
+  absent upstream identity is 401. SSE is authorized before response headers or hub
+  subscription, so a rejected request cannot attach to a live stream.
+- New/resumed Pi runtimes and every route-spawned `tht` process receive
+  `THT_PRINCIPAL_ISSUER`, `THT_PRINCIPAL_SUBJECT`, optional display name, and admin flag.
+  The readiness `tht` child is also principal-bound.
+- Settings use asynchronous repository-backed `tht session preferences get|set` in the
+  production runner, which isolates preferences by principal. The legacy settings file is
+  retained only as an injected-runner compatibility fallback for existing isolated tests.
+- Repository/settings authorization failures map to 503 before model startup. SQL execution
+  errors remain 500 after authorization, preserving the prior API distinction.
+
+## Self-review and concerns
+
+- Confirmed the Task 4 portal emits lowercase `true`/`false` for the admin header; the
+  parser accepts that exact normalized form plus the repository's existing `1`/`0`
+  compatibility form, and rejects all other values.
+- The harness principal resolver is the ownership authority; the backend never accepts an
+  owner supplied in request bodies. Its route guards use a repository-scoped `session show`
+  before every session resource operation.
+- Existing dependency-injected route fakes without `sessionShow` retain a narrow test seam;
+  production `ThtRunner` always has that method, so deployed requests cannot bypass the
+  repository authorization check.