Repository navigation
Stop a scoped connection key from widening through the Executor app - #78
Merged
Merged
Conversation
A connection key's Executor app self-call uses the caller's full managed key. The calling connection was taken only from caller, which a build that does not declare callerIdentity never receives, so create and mint ran with that full key for org admins too. The connection now travels beside caller, and the app worker is named by it so a warm worker from another connection cannot serve the call. Co-authored-by: shuv <shuv1337@users.noreply.github.com>
A scoped key's Executor app could call tools.call with the managed key. That API request ignored the calling connection, so the nested invocation was unbound and create, mint, and out-of-scope app calls succeeded. The organization API now narrows to that connection and stamps it on the caller. Facet workers get the same connection on their outbound. Co-authored-by: shuv <shuv1337@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hole
#77 refuses an Executor app self-call that widens past the calling connection, but only when
x-executor-caller-connectionis present. A scoped connection key's one-hopmcpConnections.createwas covered. A nestedtools.callwas not: the Executor app posts to/apps/:app/tools/callwith the managed key and the header, and that handler ignored the header. The nested invocation ran asfullAuthoritywith no connection, so create, mint, and a call to an app outside the connection succeeded for an org admin.Fix
The organization API, for a request that carries the host-attached connection, narrows tool authority to that connection and stamps the connection on the caller. A nested app invocation therefore stays bound, and
tools.callto an out-of-scope app is refused before it runs. A nestedOrganizationForbiddenstays HTTP 403. Facet workers receive the same connection on their outbound. A managed credential that would replace a different connection is refused. Workflow bodies still do not carry the connection; that is noted on the workflow caller.A connection that grants every tool of its apps can still create a narrower connection and mint inside it. Browser sessions, full API grants, and unmanaged API keys are unchanged when they do not send the header. A connection key used directly on the API remains
ConnectionKeyRefused.Verify
bun run e2e:self-host --test-name "connection key cannot widen"With the API bind in place: pass.
nestedWiden,nestedMint, anddirectMeshareOrganizationForbidden/ 403, as an org admin.With that bind removed (the header is ignored): fail.
nestedWidenreturnsok: trueand creates the wider connection.After deploy, as the org admin, with an Executor-only connection key at that connection's MCP URL, run
tools.callformcpConnections.createwith an extra app,mcpConnections.mintKeyon a connection outside the scope, andtools.callof an out-of-scope app. All three must be 403. Revoke the probe connection so its keys are deleted.