fix(gateway): fence lifecycle authority against durable lease

apps/gateway/src/agent/connector-lease.integration.test.ts

@@ -17,6 +17,7 @@ import {
   CONNECTOR_LEASE_POLICY,
   ConnectorLeaseService,
   type ConnectorLeasePolicy,
+  type ConnectorLeasePolicySubject,
 } from './connector-lease.service.js';
 
 const authorize = vi.fn().mockResolvedValue(true);
@@ -31,6 +32,7 @@ describe('gateway connector lease fencing integration', (): void => {
   let handle: DbHandle;
   let moduleRef: TestingModule;
   let service: ConnectorLeaseService;
+  let repository: ConnectorLeaseRepository;
 
   beforeAll(async (): Promise<void> => {
     vi.useFakeTimers();
@@ -47,6 +49,7 @@ describe('gateway connector lease fencing integration', (): void => {
       ],
     }).compile();
     service = moduleRef.get(ConnectorLeaseService);
+    repository = moduleRef.get(ConnectorLeaseRepository);
   });
 
   afterAll(async (): Promise<void> => {
@@ -229,4 +232,110 @@ describe('gateway connector lease fencing integration', (): void => {
     await expect(service.executeGrant(grant, 'runtime.send', undefined, adapter)).rejects.toThrow();
     expect(adapter.execute).not.toHaveBeenCalled();
   });
+
+  it('rejects submitted lifecycle scopes that differ from durable authority before policy or mutation', async (): Promise<void> => {
+    authorize.mockResolvedValue(true);
+    const heartbeatLease = await service.acquire(
+      {
+        logicalAgentId: 'mos',
+        bindingId: 'operator-chat-heartbeat-scope',
+        connectorId: 'pi-worker-a',
+        scopes: ['runtime.send'],
+        ttlMs: 60_000,
+      },
+      { ...context, correlationId: 'correlation-heartbeat-scope-setup' },
+    );
+    const releaseLease = await service.acquire(
+      {
+        logicalAgentId: 'mos',
+        bindingId: 'operator-chat-release-scope',
+        connectorId: 'pi-worker-a',
+        scopes: ['runtime.send'],
+        ttlMs: 60_000,
+      },
+      { ...context, correlationId: 'correlation-release-scope-setup' },
+    );
+    const forgedHeartbeat = { ...heartbeatLease, scopes: ['tool.execute'] };
+    const forgedRelease = { ...releaseLease, scopes: ['tool.execute'] };
+
+    authorize.mockImplementation(async (subject: ConnectorLeasePolicySubject) => {
+      return subject.requestedScopes.length === 1 && subject.requestedScopes[0] === 'tool.execute';
+    });
+    authorize.mockClear();
+
+    await expect(
+      service.heartbeat(forgedHeartbeat, 30_000, {
+        ...context,
+        correlationId: 'correlation-heartbeat-scope-forgery',
+      }),
+    ).rejects.toThrow('Connector authority policy denied');
+    await expect(
+      service.release(forgedRelease, {
+        ...context,
+        correlationId: 'correlation-release-scope-forgery',
+      }),
+    ).rejects.toThrow('Connector authority policy denied');
+    expect(authorize).not.toHaveBeenCalled();
+
+    const currentHeartbeat = await repository.findCurrent({
+      identity: heartbeatLease.identity,
+      bindingId: heartbeatLease.bindingId,
+    });
+    const currentRelease = await repository.findCurrent({
+      identity: releaseLease.identity,
+      bindingId: releaseLease.bindingId,
+    });
+    expect(currentHeartbeat).toMatchObject({
+      leaseId: heartbeatLease.leaseId,
+      scopes: ['runtime.send'],
+      heartbeatAt: heartbeatLease.heartbeatAt,
+      expiresAt: heartbeatLease.expiresAt,
+    });
+    expect(currentRelease).toMatchObject({
+      leaseId: releaseLease.leaseId,
+      scopes: ['runtime.send'],
+    });
+    expect(currentRelease?.releasedAt).toBeUndefined();
+
+    const forgedAudits = await handle.db
+      .select()
+      .from(connectorLeaseAuditLog)
+      .where(eq(connectorLeaseAuditLog.correlationId, 'correlation-heartbeat-scope-forgery'));
+    expect(forgedAudits).toHaveLength(1);
+    expect(forgedAudits[0]).toMatchObject({
+      bindingId: heartbeatLease.bindingId,
+      connectorId: heartbeatLease.connectorId,
+      event: 'reject',
+      outcome: 'denied',
+      reason: 'policy_denied',
+    });
+    const forgedReleaseAudits = await handle.db
+      .select()
+      .from(connectorLeaseAuditLog)
+      .where(eq(connectorLeaseAuditLog.correlationId, 'correlation-release-scope-forgery'));
+    expect(forgedReleaseAudits).toHaveLength(1);
+    expect(forgedReleaseAudits[0]).toMatchObject({
+      bindingId: releaseLease.bindingId,
+      connectorId: releaseLease.connectorId,
+      event: 'reject',
+      outcome: 'denied',
+      reason: 'policy_denied',
+    });
+
+    authorize.mockImplementation(async (subject: ConnectorLeasePolicySubject) => {
+      return subject.requestedScopes.length === 1 && subject.requestedScopes[0] === 'runtime.send';
+    });
+    await expect(
+      service.heartbeat(heartbeatLease, 30_000, {
+        ...context,
+        correlationId: 'correlation-heartbeat-scope-canonical',
+      }),
+    ).resolves.toMatchObject({ scopes: ['runtime.send'] });
+    await expect(
+      service.release(releaseLease, {
+        ...context,
+        correlationId: 'correlation-release-scope-canonical',
+      }),
+    ).resolves.toBeUndefined();
+  });
 });

apps/gateway/src/agent/connector-lease.service.ts

@@ -111,16 +111,10 @@ export class ConnectorLeaseService {
     context: ConnectorLeaseRequestContext,
   ): Promise<ConnectorLease> {
     const normalizedLease = normalizeConnectorLease(lease);
-    await this.assertTenant(normalizedLease, context);
-    await this.assertPolicy(
-      'lease.heartbeat',
-      normalizedLease,
-      context,
-      normalizedLease.scopes,
-      ttlMs,
-    );
+    const durableLease = await this.durableLifecycleLease(normalizedLease, context);
+    await this.assertPolicy('lease.heartbeat', durableLease, context, durableLease.scopes, ttlMs);
     return this.coordinator.heartbeat({
-      lease: normalizedLease,
+      lease: durableLease,
       ttlMs,
       correlationId: this.correlation(context),
     });
@@ -128,16 +122,10 @@ export class ConnectorLeaseService {
 
   async release(lease: ConnectorLease, context: ConnectorLeaseRequestContext): Promise<void> {
     const normalizedLease = normalizeConnectorLease(lease);
-    await this.assertTenant(normalizedLease, context);
-    await this.assertPolicy(
-      'lease.release',
-      normalizedLease,
-      context,
-      normalizedLease.scopes,
-      null,
-    );
+    const durableLease = await this.durableLifecycleLease(normalizedLease, context);
+    await this.assertPolicy('lease.release', durableLease, context, durableLease.scopes, null);
     await this.coordinator.release({
-      lease: normalizedLease,
+      lease: durableLease,
       correlationId: this.correlation(context),
     });
   }
@@ -220,6 +208,19 @@ export class ConnectorLeaseService {
     }
   }
 
+  private async durableLifecycleLease(
+    submittedLease: ConnectorLease,
+    context: ConnectorLeaseRequestContext,
+  ): Promise<ConnectorLease> {
+    await this.assertTenant(submittedLease, context);
+    const durableLease = await this.coordinator.current(submittedLease);
+    if (!durableLease || !hasSameLifecycleAuthority(submittedLease, durableLease)) {
+      await this.recordPolicyDenial(durableLease ?? submittedLease, context);
+      throw new ForbiddenException('Connector authority policy denied');
+    }
+    return durableLease;
+  }
+
   private async assertPolicy(
     action: ConnectorLeasePolicyAction,
     subject: Pick<ConnectorLease, 'identity' | 'bindingId' | 'connectorId'>,
@@ -264,3 +265,21 @@ export class ConnectorLeaseService {
     return normalizeCorrelationId(context.correlationId);
   }
 }
+
+function hasSameLifecycleAuthority(
+  submittedLease: ConnectorLease,
+  durableLease: ConnectorLease,
+): boolean {
+  return (
+    submittedLease.identity.tenantId === durableLease.identity.tenantId &&
+    submittedLease.identity.logicalAgentId === durableLease.identity.logicalAgentId &&
+    submittedLease.bindingId === durableLease.bindingId &&
+    submittedLease.leaseId === durableLease.leaseId &&
+    submittedLease.connectorId === durableLease.connectorId &&
+    submittedLease.leaseEpoch === durableLease.leaseEpoch &&
+    submittedLease.scopes.length === durableLease.scopes.length &&
+    submittedLease.scopes.every((scope: string, index: number): boolean => {
+      return scope === durableLease.scopes[index];
+    })
+  );
+}