fix(git): identity-first principal resolution across write wrappers (#1280)
MOSAIC_GIT_IDENTITY=fargo produced objects attributed to mos-dt-0: every write wrapper resolved its acting principal from tea's login list, which enumerates whatever logins the host happens to hold and knows nothing about which seat is calling. The identity-aware code was present and correct but unreachable on the happy path — it sat on arms that only ran when tea failed. One shared resolver, not twenty patches: resolve_gitea_principal() in detect-platform.sh implements the precedence (explicit --login beats MOSAIC_GIT_IDENTITY / worktree git config mosaic.gitIdentity; the tea login list is the LAST resort), fails loud (nonzero, naming the identity or login and the expected slot path) when the requested principal has no credential, and never prints a token value. gitea_identity_token_slot() is the single source of truth for the slot layout, shared with get_gitea_token, so resolver and token resolution cannot disagree. Call-site conversions (the proving five): pr-review.sh (principal resolved once for every action; the comment action now honors --login), issue-comment.sh, pr-create.sh (identity mode reaches the REST API on the HAPPY path — tea is never consulted, so the login list cannot shadow the identity; --login wins even on the tea-failure fallback arm), issue-create.sh (same), pr-merge.sh (gains --login; --dry-run reports the principal the merge WOULD act as, resolved exactly as the merge resolves it; no cross-principal fallback — an identity-bound 401 is a hard stop). Remaining wrappers are call-site conversions onto the same resolver, measured: write-path issue-assign, issue-close, issue-edit, issue-reopen, milestone-close, milestone-create, pr-close; read-path issue-list, milestone-list, pr-list, pr-view (issue-view mixed). pr-diff, pr-metadata, pr-ci-wait and ci-queue-wait already inherit identity-first resolution via get_gitea_token. Known interaction: on a host with a workstation-GLOBAL mosaic.gitIdentity, this fix activates identity mode for every seat that has not set a local one — correct behavior driven by a wrong configuration (measured: #1282-#1287, six accidental live issues, closed with provenance by fred). Set mosaic.gitIdentity per-worktree, never --global. Tests: test-gitea-principal-resolution.sh (resolver matrix — identity present/absent, --login precedence, env vs git-config, unrecognized-host containment, slot-path-by-path-never-by-value); test-pr-create-identity- first.sh (the load-bearing ordering test: identity arm REACHED on the happy path with tea never invoked, fail-loud BEFORE any write on a missing slot, --login wins, default preserved); test-pr-merge-principal- resolution.sh (dry-run truthfulness, merge credential binding, unknown --login never reaches the provider). All wired into test:framework-shell. Sabotage control: precedence inverted to tea-list-first inside the resolver -> exactly the three new suites redden with the #1280 signatures (identity resolves to the tea-list account; missing slot returns rc=0 with silent fallthrough) while all 11 pre-existing git suites stay green; restored byte-identical (sha256 verified); all 14 green again.
This commit is contained in:
fargo
@@ -76,27 +76,36 @@ fi
|
||||
detect_platform >/dev/null
|
||||
|
||||
# Resolve and cache the Gitea REST endpoint + token for the current remote,
|
||||
# bound to a SPECIFIC login identity ($1). Populates GITEA_API_ROOT (…/api/v1),
|
||||
# GITEA_API_BASE (…/api/v1/repos/<slug>), and GITEA_API_TOKEN.
|
||||
# bound to a SPECIFIC acting principal ($1) selected identity-first (#1280):
|
||||
# an explicit --login wins, else MOSAIC_GIT_IDENTITY / git config
|
||||
# mosaic.gitIdentity binds the per-slot credential, else the tea login list
|
||||
# (last resort). Populates GITEA_API_ROOT (…/api/v1), GITEA_API_BASE
|
||||
# (…/api/v1/repos/<slug>), and GITEA_API_TOKEN.
|
||||
#
|
||||
# The token is resolved for the EFFECTIVE login (the --login override when
|
||||
# given, otherwise the detected default) so that the single credential used for
|
||||
# the write ALSO drives the /user identity read and the read-back — write token
|
||||
# and read-back token are the same identity by construction (this is the
|
||||
# credential-ordering fix: a --login override is no longer written under one
|
||||
# credential and verified under a different default one). Falls back to the
|
||||
# host-scoped credential ONLY when NO --login override was supplied (the
|
||||
# best-effort default path). When $2 is "explicit" the login came from a
|
||||
# caller-supplied --login: that exact login's token MUST resolve, and we FAIL
|
||||
# CLOSED rather than silently downgrading the write to the host default
|
||||
# identity — otherwise a caller relying on a dedicated per-role credential would
|
||||
# be told the write succeeded as requested while it was attributed to the shared
|
||||
# default. Returns non-zero (clear stderr) on any resolution failure.
|
||||
# The token is resolved for the EFFECTIVE principal so that the single
|
||||
# credential used for the write ALSO drives the /user identity read and the
|
||||
# read-back — write token and read-back token are the same identity by
|
||||
# construction (this is the credential-ordering fix: a --login override is no
|
||||
# longer written under one credential and verified under a different default
|
||||
# one). When $2 is "identity" the principal ($1) is a requested git identity:
|
||||
# the token MUST resolve from that identity's per-slot token (get_gitea_token's
|
||||
# identity arm), failing closed rather than borrowing the tea default login —
|
||||
# the tea login list must never shadow a requested identity (#1280). When $2
|
||||
# is "explicit" the principal came from a caller-supplied --login: that exact
|
||||
# login's token MUST resolve, and we FAIL CLOSED rather than silently
|
||||
# downgrading the write to the host default identity. Otherwise the best-effort
|
||||
# default path applies (per-login token, else the host-scoped credential).
|
||||
# Returns non-zero (clear stderr) on any resolution failure.
|
||||
gitea_resolve_api_for_login() {
|
||||
local effective_login="$1" override_explicit="${2:-}" host configured_url repo
|
||||
|
||||
host=$(get_remote_host)
|
||||
if [[ -n "$override_explicit" ]]; then
|
||||
if [[ "$override_explicit" == "identity" ]]; then
|
||||
GITEA_API_TOKEN=$(get_gitea_token "$host") || {
|
||||
echo "Error: could not resolve the per-slot token for requested git identity '$effective_login' on host '$host'; refusing to fall back to the tea login list or shared credentials (comment write/read-back, #1280)." >&2
|
||||
return 1
|
||||
}
|
||||
elif [[ -n "$override_explicit" ]]; then
|
||||
GITEA_API_TOKEN=$(get_gitea_token_for_login "$effective_login" "$host") || {
|
||||
echo "Error: could not resolve a host-matched Gitea token for --login '$effective_login' on host '$host'; refusing to fall back to the host default identity or a cross-host credential (comment write/read-back)" >&2
|
||||
return 1
|
||||
@@ -318,23 +327,31 @@ if [[ "$PLATFORM" == "github" ]]; then
|
||||
gh issue comment "$ISSUE_NUMBER" --body "$COMMENT"
|
||||
echo "Added comment to GitHub issue #$ISSUE_NUMBER"
|
||||
elif [[ "$PLATFORM" == "gitea" ]]; then
|
||||
# Resolve the login this comment should be attributed to: the --login
|
||||
# override when given, otherwise the detected default for this repo's host.
|
||||
# A --login override always wins. Otherwise name this repo host's login only
|
||||
# as a best effort: the login name merely selects a per-login token, and
|
||||
# gitea_resolve_api_for_login falls back to the host credential
|
||||
# (get_gitea_token) when no tea login is named, so the default credential
|
||||
# still resolves even when the host tea has no matching login entry.
|
||||
EFFECTIVE_LOGIN="$LOGIN_OVERRIDE"
|
||||
[[ -n "$EFFECTIVE_LOGIN" ]] || EFFECTIVE_LOGIN=$(get_gitea_login 2>/dev/null || true)
|
||||
# Resolve the acting principal identity-first (#1280): an explicit --login
|
||||
# wins; otherwise MOSAIC_GIT_IDENTITY / git config mosaic.gitIdentity
|
||||
# selects the principal when a per-slot token exists (fail-loud when it
|
||||
# does not); the tea login list is the LAST resort — it knows nothing about
|
||||
# which seat is calling, so resolving from it first wrote under whichever
|
||||
# account tea had configured (the #1280 family).
|
||||
principal_host=$(get_remote_host)
|
||||
if ! principal_resolved="$(resolve_gitea_principal "$LOGIN_OVERRIDE" "$principal_host")"; then
|
||||
# resolve_gitea_principal already printed the fail-loud diagnostic.
|
||||
exit 1
|
||||
fi
|
||||
PRINCIPAL_MODE="$(printf '%s' "$principal_resolved" | cut -f1)"
|
||||
PRINCIPAL_NAME="$(printf '%s' "$principal_resolved" | cut -f2)"
|
||||
|
||||
# Bind the REST endpoint + token to the effective login, then derive the
|
||||
# Bind the REST endpoint + token to the resolved principal, then derive the
|
||||
# acting identity from that SAME credential (GET /user). The write below and
|
||||
# its read-back both use this credential, so the write is verified against
|
||||
# the identity that actually performed it. Passing "explicit" when --login
|
||||
# was supplied forbids the host-default fallback: an unresolvable explicit
|
||||
# override fails closed instead of writing under the default identity.
|
||||
gitea_resolve_api_for_login "$EFFECTIVE_LOGIN" "${LOGIN_OVERRIDE:+explicit}" || exit 1
|
||||
# the identity that actually performed it.
|
||||
if [[ "$PRINCIPAL_MODE" == "identity" ]]; then
|
||||
gitea_resolve_api_for_login "$PRINCIPAL_NAME" identity || exit 1
|
||||
elif [[ "$PRINCIPAL_MODE" == "login" ]]; then
|
||||
gitea_resolve_api_for_login "$PRINCIPAL_NAME" explicit || exit 1
|
||||
else
|
||||
gitea_resolve_api_for_login "$PRINCIPAL_NAME" "" || exit 1
|
||||
fi
|
||||
ACTING_LOGIN=$(gitea_authenticated_login) || exit 1
|
||||
|
||||
comment_id=$(gitea_create_comment_verified "$ISSUE_NUMBER" "$COMMENT" "$ACTING_LOGIN") || {
|
||||
|
||||
Reference in New Issue
Block a user