mosaicstack/stack
14
0
Fork 1
Code Issues 315 Pull Requests 11 Actions Packages Projects Releases 15 Wiki Activity

tea login resolution fails open: a seat with no login silently acts as another identity #1356

New Issue
Closed
opened 2026-08-21 20:33:59 +00:00 by fred · 2 comments
fred commented 2026-08-21 20:33:59 +00:00
Collaborator
Copy Link
Copy Source

The defect

detect-platform.sh has two credential paths. Only one is identity-aware.

get_gitea_token() (the REST path) resolves an identity from MOSAIC_GIT_IDENTITY
or git config mosaic.gitIdentity, requires a per-slot token at a derived path, and
errors if it is absent. Its own comment says there is no fallback between the seat
and service stores, and it refuses to borrow another slot's token.

get_gitea_login_for_host() (the tea path) has no identity awareness at all. It
returns the first login whose URL matches the host:

login=$(find_tea_login_for_host "$host" || true)

With 43 logins on this host, ~22 match git.mosaicstack.dev. A seat with no login of
its own therefore does not fail — it silently acts as whichever identity happens to be
first in ~/.config/tea/config.yml.

get_gitea_login_for_repo_override() is worse: it falls through to
get_default_tea_login(), which returns the default-marked login, or failing that the
first login of any host.

Why this is worse than an error

Gate 16 depends on author != reviewer. A seat that reviews or merges under a borrowed
identity satisfies the gate mechanically while violating it in fact. Today the failure
happens to be loud, but only by accident: the borrowed default is itself broken. A
working default would make this silent.

Scope

  • Give get_gitea_login_for_host() the same identity ladder the token path has:
    identity -> canonical login <instance>-<seat> -> error if absent. No borrowing.
  • Delete the get_default_tea_login() fallback from
    get_gitea_login_for_repo_override().
  • Leave the identity-unset case alone. That is the operator-at-a-terminal case, and
    the token path does not enforce there either. This finishes the mirror; it does not
    extend it.

Blocker found while scoping

test-gitea-login-resolution.sh is red on any provisioned seat, before any change:

as-is (MOSAIC_GIT_IDENTITY=fred):  rc=1
env -u MOSAIC_GIT_IDENTITY:        rc=0

The suite pins mosaic.gitIdentity empty in git config, but step 0 reads the
environment variable first, and launch-seat.sh exports it for every seat. The
harness comment predicts this failure mode and fixes only the git-config half. The
suite has to be hermetic against the env var too, or it cannot guard this code for any
agent that runs it.

Prerequisite, already done

Every seat token is now projected into tea as <instance>-<seat>
(~/.mosaic/tools/seat-logins/seat-logins.sh; 37 minted, 2 refreshed). Failing closed
before those logins existed would have stopped 22 seats at once.

## The defect `detect-platform.sh` has two credential paths. Only one is identity-aware. `get_gitea_token()` (the REST path) resolves an identity from `MOSAIC_GIT_IDENTITY` or `git config mosaic.gitIdentity`, requires a per-slot token at a derived path, and **errors** if it is absent. Its own comment says there is no fallback between the seat and service stores, and it refuses to borrow another slot's token. `get_gitea_login_for_host()` (the `tea` path) has no identity awareness at all. It returns the **first** login whose URL matches the host: ``` login=$(find_tea_login_for_host "$host" || true) ``` With 43 logins on this host, ~22 match `git.mosaicstack.dev`. A seat with no login of its own therefore does not fail — it silently acts as whichever identity happens to be first in `~/.config/tea/config.yml`. `get_gitea_login_for_repo_override()` is worse: it falls through to `get_default_tea_login()`, which returns the default-marked login, or failing that the first login of *any* host. ## Why this is worse than an error Gate 16 depends on author != reviewer. A seat that reviews or merges under a borrowed identity satisfies the gate mechanically while violating it in fact. Today the failure happens to be loud, but only by accident: the borrowed default is itself broken. A working default would make this silent. ## Scope - Give `get_gitea_login_for_host()` the same identity ladder the token path has: identity -> canonical login `<instance>-<seat>` -> error if absent. No borrowing. - Delete the `get_default_tea_login()` fallback from `get_gitea_login_for_repo_override()`. - Leave the identity-unset case alone. That is the operator-at-a-terminal case, and the token path does not enforce there either. This finishes the mirror; it does not extend it. ## Blocker found while scoping `test-gitea-login-resolution.sh` is red on any provisioned seat, before any change: ``` as-is (MOSAIC_GIT_IDENTITY=fred): rc=1 env -u MOSAIC_GIT_IDENTITY: rc=0 ``` The suite pins `mosaic.gitIdentity` empty in git config, but step 0 reads the **environment variable first**, and `launch-seat.sh` exports it for every seat. The harness comment predicts this failure mode and fixes only the git-config half. The suite has to be hermetic against the env var too, or it cannot guard this code for any agent that runs it. ## Prerequisite, already done Every seat token is now projected into `tea` as `<instance>-<seat>` (`~/.mosaic/tools/seat-logins/seat-logins.sh`; 37 minted, 2 refreshed). Failing closed before those logins existed would have stopped 22 seats at once.
jason.woltje commented 2026-08-21 20:35:31 +00:00
Owner
Copy Link
Copy Source

Initial dev work and testing in the local user dir is fine. However, this tooling MUST end up in the full framework.

Initial dev work and testing in the local user dir is fine. However, this tooling MUST end up in the full framework.
fred commented 2026-08-21 21:26:47 +00:00
Author
Collaborator
Copy Link
Copy Source

PR #1361 open against next, head 0bf56326, base 24462f46. CI pending. Author is fred; needs an independent reviewer before merge (gate 16). The fleet tooling you asked to land in the framework is in this PR as tools/fleet/seat-logins.sh.

Not in this PR, tracked separately: the onboarding scripts (new-seat.sh, launch-seat.sh, mint-seat-credential.sh) live in ~/.mosaic/fleet/bin/ and are not in the framework at all. Your ruling reads as covering them too; confirming before moving them since that is a larger change.

PR #1361 open against `next`, head `0bf56326`, base `24462f46`. CI pending. Author is fred; needs an independent reviewer before merge (gate 16). The fleet tooling you asked to land in the framework is in this PR as `tools/fleet/seat-logins.sh`. Not in this PR, tracked separately: the onboarding scripts (`new-seat.sh`, `launch-seat.sh`, `mint-seat-credential.sh`) live in `~/.mosaic/fleet/bin/` and are not in the framework at all. Your ruling reads as covering them too; confirming before moving them since that is a larger change.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
Defect in framework tooling or delivered code
 fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
code-be-01 (Mosaic fleet seat code-be-01) code-infra-01 (Mosaic fleet seat code-infra-01) fargo fred gate-merge-01 (Mosaic fleet seat gate-merge-01) happy jason.woltje (Jason Woltje) merge-gate ops-01 (Mosaic fleet seat ops-01) ops-02 (Mosaic fleet seat ops-02) ops-03 (Mosaic fleet seat ops-03) ops-ci-01 (Mosaic fleet seat ops-ci-01) ops-deploy-01 (Mosaic fleet seat ops-deploy-01) pepper rev-code-01 rev-code-02 rev-security-01 rev-security-02 rev-security-03 (Mosaic fleet seat rev-security-03) sanity scooby (Scooby) scrappy shaggy tiny velma veronica (Mosaic fleet seat veronica) vision woodpecker
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#1356