fix: force customerId scope gating in tools and prompt expansions - #66
Open
dylan-klein wants to merge 2 commits into
Open
fix: force customerId scope gating in tools and prompt expansions#66dylan-klein wants to merge 2 commits into
dylan-klein wants to merge 2 commits into
Conversation
TAG=agy CONV=b3471264-2592-4924-b031-267b4bf62326
- Fail fast and throw a wrapped error if getActiveCustomerId throws an error in callMcpTool and getMcpPrompt, preventing fallback to client-supplied tenant scopes. - Delete user-supplied customerId if no active session customerId is configured. - Add unit tests verifying deletion and error throwing for both tools and prompts. TAG=agy CONV=b3471264-2592-4924-b031-267b4bf62326
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
MOTIVATION
In
service_accountmode, the backend Service Account has broad GCP IAM permissions and can access multiple Workspace domains. Previously, if the administrator manually provided a differentcustomerIdin their chat request, the LLM would propagate that parameter down to the tool calls, allowing the admin to query unauthorized tenants. We need to enforce a hard boundary so the agent can only operate within the tenant selected on the UI login screen.MAIN CHANGES
callMcpToolandgetMcpPromptinsrc/lib/mcp-client.tsto unconditionally force-overwrite thecustomerIdargument with the active customer ID retrieved from the signed session cookie.customerIdthrows an error (e.g. cookie decryption fails or JWT is tampered), the client now throws a wrapped exception and aborts execution immediately instead of silently swallowing the error and allowing the request to proceed.customerIdconfigured, we explicitly delete the client-providedcustomerIdargument to block unauthenticated scope overrides.mcp-client.test.tsto cover parameter overwriting, argument stripping, and fail-fast behavior.DESIGN DECISIONS
mcp-client.ts) rather than in individual tool definitions or route handlers. This provides a centralized bottleneck that protects all current and future tools/prompts from scope bypasses.TAG=agy
CONV=b3471264-2592-4924-b031-267b4bf62326