fix(git-tools): fail closed on unresolvable explicit --login override (#865)

gitea_resolve_api_for_login silently fell back to the host-default identity
whenever the named login could not be resolved for ANY reason -- including when
the name came from an EXPLICIT --login override. A caller passing a dedicated
per-role credential could thus have its write attributed to the shared default
identity while being told it succeeded as requested.

Thread an "override was explicit" signal into gitea_resolve_api_for_login
(second param, "explicit" when LOGIN_OVERRIDE is non-empty). When the override
is explicit and that login's token cannot be resolved, FAIL CLOSED (return 1,
clear error naming the login, no host-default fallback). The best-effort
host-default fallback now applies ONLY on the no-override default path. Applied
symmetrically to issue-comment.sh and all three pr-review.sh dispatch sites
(approve / request-changes / comment).

Tests: both scripts' write flows now assert credential attribution via a
token->identity seam in the curl stub -- (a) resolvable --login override drives
the entire write/read-back chain under THAT login's token, nothing under the
default; (b) unresolvable --login override fails closed (nonzero, no success
line, no write, no default-identity request); (c) no-override default path still
succeeds under the host-default best-effort credential.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packages/mosaic/framework/tools/git/test-issue-comment-readback.sh

@@ -27,7 +27,14 @@
 #   5. fails closed when the created record is not authored by the acting
 #      identity;
 #   6. enumerates the created id in the issue's FULLY PAGINATED comment list,
-#      finding it even when it lands beyond page 1.
+#      finding it even when it lands beyond page 1;
+#   7. with a RESOLVABLE --login override, performs the write, the /user identity
+#      lookup, and the read-back ALL under THAT login's token/identity — never
+#      the host default;
+#   8. with an UNRESOLVABLE --login override, FAILS CLOSED (nonzero, no write, no
+#      success line) instead of silently downgrading to the host default
+#      identity — the token seam maps each bearer token to the identity it
+#      authenticates as, so a misattributed write is caught.
 
 set -euo pipefail
 
@@ -38,6 +45,7 @@ BIN_DIR="$WORK_DIR/bin"
 XDG_DIR="$WORK_DIR/xdg"
 TEA_LOG="$WORK_DIR/tea.log"
 CURL_LOG="$WORK_DIR/curl.log"
+AUTH_LOG="$WORK_DIR/auth.log"
 OUTPUT_FILE="$WORK_DIR/output.log"
 CREDENTIALS_FILE="$WORK_DIR/credentials.json"
 STATE_FILE="$WORK_DIR/comments.json"
@@ -58,6 +66,27 @@ API_ROOT="https://git.mosaicstack.dev/api/v1"
 BODY='durable "note" -- marker'
 ACTING_LOGIN="primary-reviewer"
 FOREIGN_LOGIN="other-writer"
+# A dedicated per-role --login override identity, with its own token stored in
+# tea's config (exactly the author-not-equal-reviewer hardening path).
+OVERRIDE_LOGIN="delegated-reviewer"
+DEFAULT_TOKEN="test-only-placeholder"
+OVERRIDE_TOKEN="override-token-placeholder"
+
+# tea config: the override login has its own token here (as tea itself stores
+# per-login tokens). The default login name ("mosaicstack") is deliberately NOT
+# present, so the no-override default path resolves via the host credential
+# fallback while an explicit --login must resolve from this file or fail closed.
+mkdir -p "$XDG_DIR/tea"
+OVERRIDE_LOGIN="$OVERRIDE_LOGIN" OVERRIDE_TOKEN="$OVERRIDE_TOKEN" python3 - "$XDG_DIR/tea/config.yml" <<'PY'
+import os
+import sys
+
+with open(sys.argv[1], "w", encoding="utf-8") as handle:
+    handle.write("logins:\n")
+    handle.write(f"  - name: {os.environ['OVERRIDE_LOGIN']}\n")
+    handle.write("    url: https://git.mosaicstack.dev\n")
+    handle.write(f"    token: {os.environ['OVERRIDE_TOKEN']}\n")
+PY
 
 CONFIGURED_GITEA_URL="https://git.mosaicstack.dev" python3 - "$CREDENTIALS_FILE" <<'PY'
 import json
@@ -106,10 +135,14 @@ output_file=""
 method="GET"
 url=""
 data=""
+auth_token=""
 while [[ $# -gt 0 ]]; do
     case "$1" in
         -o) output_file="$2"; shift 2 ;;
-        -w|-H) shift 2 ;;
+        -H)
+            [[ "$2" == Authorization:* ]] && auth_token="${2##* }"
+            shift 2 ;;
+        -w) shift 2 ;;
         -X) method="$2"; shift 2 ;;
         -d|--data) data="$2"; shift 2 ;;
         -s|-S|-sS) shift ;;
@@ -123,6 +156,17 @@ query="${url#*\?}"
 [[ "$query" == "$url" ]] && query=""
 printf '%s %s\n' "$method" "$url" >> "$ISSUE_COMMENT_CURL_LOG"
 
+# Map the presented bearer token to the identity it authenticates as — the same
+# derivation Gitea's own /user does. The wrapper's write, /user lookup, and
+# read-back must all carry the SAME token, so the acting identity recorded here
+# reveals which credential actually performed the request.
+acting_identity=""
+case "$auth_token" in
+    "$ISSUE_COMMENT_DEFAULT_TOKEN") acting_identity="$ISSUE_COMMENT_ACTING_LOGIN" ;;
+    "$ISSUE_COMMENT_OVERRIDE_TOKEN") acting_identity="$ISSUE_COMMENT_OVERRIDE_LOGIN" ;;
+esac
+printf '%s %s %s\n' "$method" "$path" "${acting_identity:-<unauthenticated>}" >> "$ISSUE_COMMENT_AUTH_LOG"
+
 write_response() {
     local status="$1" body="$2"
     [[ -n "$output_file" ]] || exit 96
@@ -131,14 +175,15 @@ write_response() {
 }
 
 if [[ "$method" == "GET" && "$path" == "$ISSUE_COMMENT_API_ROOT/user" ]]; then
-    write_response 200 "$(ISSUE_COMMENT_LOGIN="$ISSUE_COMMENT_ACTING_LOGIN" python3 - <<'PY'
+    [[ -n "$acting_identity" ]] || { write_response 401 '{"message":"unauthenticated"}'; exit 0; }
+    write_response 200 "$(ISSUE_COMMENT_LOGIN="$acting_identity" python3 - <<'PY'
 import json
 import os
 print(json.dumps({"login": os.environ["ISSUE_COMMENT_LOGIN"]}))
 PY
 )"
 elif [[ "$method" == "POST" && "$path" == "$ISSUE_COMMENT_API_BASE/issues/7/comments" ]]; then
-    result=$(ISSUE_COMMENT_DATA="$data" python3 - <<'PY'
+    result=$(ISSUE_COMMENT_ACTING_LOGIN="${acting_identity:-$ISSUE_COMMENT_ACTING_LOGIN}" ISSUE_COMMENT_DATA="$data" python3 - <<'PY'
 import json
 import os
 
@@ -261,8 +306,10 @@ PY
 
 run_comment() {
     local mode="$1"
+    shift
     : > "$TEA_LOG"
     : > "$CURL_LOG"
+    : > "$AUTH_LOG"
     : > "$OUTPUT_FILE"
     seed_state "$mode"
     (
@@ -272,14 +319,18 @@ run_comment() {
         MOSAIC_CREDENTIALS_FILE="$CREDENTIALS_FILE" \
         ISSUE_COMMENT_TEA_LOG="$TEA_LOG" \
         ISSUE_COMMENT_CURL_LOG="$CURL_LOG" \
+        ISSUE_COMMENT_AUTH_LOG="$AUTH_LOG" \
         ISSUE_COMMENT_STATE="$STATE_FILE" \
         ISSUE_COMMENT_TEST_MODE="$mode" \
         ISSUE_COMMENT_ACTING_LOGIN="$ACTING_LOGIN" \
         ISSUE_COMMENT_FOREIGN_LOGIN="$FOREIGN_LOGIN" \
+        ISSUE_COMMENT_OVERRIDE_LOGIN="$OVERRIDE_LOGIN" \
+        ISSUE_COMMENT_DEFAULT_TOKEN="$DEFAULT_TOKEN" \
+        ISSUE_COMMENT_OVERRIDE_TOKEN="$OVERRIDE_TOKEN" \
         ISSUE_COMMENT_REPO_SLUG="$REPO_SLUG" \
         ISSUE_COMMENT_API_BASE="$API_BASE" \
         ISSUE_COMMENT_API_ROOT="$API_ROOT" \
-        "$SCRIPT_DIR/issue-comment.sh" -i "$ISSUE_NUMBER" -c "$BODY"
+        "$SCRIPT_DIR/issue-comment.sh" -i "$ISSUE_NUMBER" -c "$BODY" "$@"
     ) > "$OUTPUT_FILE" 2>&1
 }
 
@@ -299,6 +350,10 @@ grep -q "^GET $API_BASE/issues/comments/51$" "$CURL_LOG"
 grep -q "^GET $API_ROOT/user$" "$CURL_LOG"
 # Enumeration paginated beyond page 1 to find the created comment.
 grep -q "^GET $API_BASE/issues/7/comments?limit=[0-9]*&page=2$" "$CURL_LOG"
+# Default path (no --login): the host credential fallback resolves, and the
+# write is performed AND self-verified under the host-default acting identity.
+grep -q "^POST $API_BASE/issues/7/comments $ACTING_LOGIN$" "$AUTH_LOG"
+grep -q "^GET $API_BASE/issues/comments/51 $ACTING_LOGIN$" "$AUTH_LOG"
 
 # Case 2: a no-op write with a concurrent SAME-IDENTITY, same-body comment
 # already present must FAIL CLOSED — the closed concurrency window.
@@ -328,4 +383,41 @@ if grep -q 'Added and verified comment' "$OUTPUT_FILE"; then
     exit 1
 fi
 
+# Case 4: a RESOLVABLE --login override — the write, the /user identity lookup,
+# and the read-back must ALL be performed under THAT login's token/identity, not
+# the host default. The override login has id 1 (empty seed).
+run_comment override-success --login "$OVERRIDE_LOGIN"
+grep -q 'Added and verified comment on Gitea issue #7 (comment ID 1)' "$OUTPUT_FILE"
+grep -q "^GET $API_ROOT/user $OVERRIDE_LOGIN$" "$AUTH_LOG"
+grep -q "^POST $API_BASE/issues/7/comments $OVERRIDE_LOGIN$" "$AUTH_LOG"
+grep -q "^GET $API_BASE/issues/comments/1 $OVERRIDE_LOGIN$" "$AUTH_LOG"
+# The host-default identity must NOT have performed ANY request in this run.
+if grep -q " $ACTING_LOGIN\$" "$AUTH_LOG"; then
+    echo "FAIL: an explicit --login override request was performed under the host default identity" >&2
+    cat "$AUTH_LOG" >&2
+    exit 1
+fi
+
+# Case 5: an UNRESOLVABLE --login override (name absent from tea config) must
+# FAIL CLOSED — no silent downgrade to the host default identity: nonzero exit,
+# no success line, and NO write performed.
+if run_comment override-unresolvable --login "nonexistent-typo-login"; then
+    echo "FAIL: unresolvable --login override did not fail closed" >&2
+    cat "$OUTPUT_FILE" >&2
+    exit 1
+fi
+if grep -q 'Added and verified comment' "$OUTPUT_FILE"; then
+    echo "FAIL: unresolvable --login override reported success" >&2
+    exit 1
+fi
+if grep -q "^POST $API_BASE/issues/7/comments" "$CURL_LOG"; then
+    echo "FAIL: unresolvable --login override still performed a write" >&2
+    exit 1
+fi
+# And it must not have silently fallen back to the host default identity.
+if grep -q " $ACTING_LOGIN\$" "$AUTH_LOG"; then
+    echo "FAIL: unresolvable --login override fell back to the host default identity" >&2
+    exit 1
+fi
+
 echo "issue-comment.sh REST create + exact-id read-back regression passed"