Omar SobhandClaude Opus 5
2668191e30
`docs/TOOL-CALL-ARCHITECTURE.md` §3 calls deploying the MCP door "config, not code". It is not, and the reason is authentication. `/mcp/skills` authenticates with `AuthService::authenticate`, which returns a full `AuthedUser` carrying the user's role. There is no narrower credential in the system. So pointing a mission container at the door means writing a bearer token into a file inside that container — and mission agents run arbitrary `Bash` with egress and no read gate, which is this platform's own documented security posture. An owner-scoped token there turns "the agent runs commands in a sandbox" into "the agent drives the whole ClawMates API as the owner". Checked before building this rather than assumed: no such credential is in a mission container today. The runtime's config.toml has no `[mcp.servers]` block and no bearer, so the door would have been a NEW exposure, not an existing one. So: `auth_sessions.scope`, defaulting to `full`. `authenticate` now delegates to `authenticate_scoped(token, SCOPE_FULL)`, which means **every existing caller rejects a narrow token** and a route must opt in by naming the scope it accepts. `/mcp/skills` is the only opt-in. Fail closed on purpose. The likely mistake here is adding a scope and forgetting to wire its check; this way that mistake grants nothing rather than granting everything. `mint_scoped` refuses to mint a `full` token — a caller reaching for it wants a narrow credential, and handing back a full one because an argument was wrong is exactly the failure the column exists to prevent, and it would be invisible because the token would work. The test that matters is not that the door accepts the token, it is that nothing else does. Negative-controlled: removing the scope comparison fails `a_scoped_token_is_refused_by_every_unscoped_caller`. `.sqlx` regenerated — `authenticate` is a compile-checked query and CI builds with SQLX_OFFLINE=true. Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_018i9Ten1LU4jUr5d7TAWda9
41 lines
868 B
JSON
41 lines
868 B
JSON
{
|
|
"db_name": "PostgreSQL",
|
|
"query": "SELECT u.id, u.workspace_id, u.role, s.scope\n FROM auth_sessions s\n JOIN users u ON u.id = s.user_id\n WHERE s.token_hash = $1 AND s.expires_at > now()",
|
|
"describe": {
|
|
"columns": [
|
|
{
|
|
"ordinal": 0,
|
|
"name": "id",
|
|
"type_info": "Uuid"
|
|
},
|
|
{
|
|
"ordinal": 1,
|
|
"name": "workspace_id",
|
|
"type_info": "Uuid"
|
|
},
|
|
{
|
|
"ordinal": 2,
|
|
"name": "role",
|
|
"type_info": "Text"
|
|
},
|
|
{
|
|
"ordinal": 3,
|
|
"name": "scope",
|
|
"type_info": "Text"
|
|
}
|
|
],
|
|
"parameters": {
|
|
"Left": [
|
|
"Text"
|
|
]
|
|
},
|
|
"nullable": [
|
|
false,
|
|
false,
|
|
false,
|
|
false
|
|
]
|
|
},
|
|
"hash": "e8f7cb9c34be37fe16c5406e9263159693674dda567b60a1f87c6763ec448951"
|
|
}
|