João Salavisa
919a39e49a
* feat(auth): add auth core — identities, sessions, PATs, invites, mode state machine Phase 1 of opt-in authentication + multi-user segregation: - internal/auth: argon2id password hashing (PHC), opaque session/PAT tokens (SHA-256 at rest), login rate limiter, auth-mode state machine (disabled/setup/enabled), setup-wizard promotion of the pre-auth default-user row into the admin account, invites, admin user management with last-admin guard. - internal/auth/store: auth_identities (OIDC-ready), auth_sessions, auth_api_tokens, auth_invites tables (SQLite+Postgres dialects). - internal/auth/authn: request-identity plumbing (gin + plain contexts), RequireAdmin middleware. - users table: display_name/role/status columns via new MigrateLogger wiring; AccountRepository surface (consumer-scoped, keeps existing Repository fakes untouched). - config: AuthConfig.Required/SessionTTLHours/CookieName (KANDEV_AUTH_REQUIRED), FeaturesConfig.Auth; profiles.yaml + runtime flag registry entry for KANDEV_FEATURES_AUTH. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(auth): enforce opt-in auth over HTTP — middleware, auth API, boot payload Phase 2 of opt-in authentication + multi-user segregation: - internal/auth/httpmw: global gin middleware after CORS. Disabled mode injects the synthetic single-user admin identity (behavior unchanged); enabled mode resolves session cookie then PAT bearer, with an explicit allowlist (health, SPA bootstrap reads, credential endpoints, self-authenticating webhooks), deferral for WS/proxy upgrades and office agent JWTs, and SPA shell availability for the login page. - internal/auth/httpapi: full auth surface — setup wizard, login/logout, me, password change, sessions, PATs, invites (mint/preview/accept), auth settings (enable/disable), admin user management. - Boot payload: initialState.auth block always present; unauthenticated visitors on auth-enabled instances get features+auth only (no data). - External MCP: PAT required once auth is enabled (open while disabled). - Admin guards on destructive system routes and runtime-flag overrides. - Startup warning when bound non-loopback with auth disabled (ServerConfig.NonLoopbackBinds fail-closed nudge). - Wiring: auth store in Repositories, auth service in Services, ClaimUnownedWorkspaces backfill on the task repository. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(auth): per-user workspace scoping across HTTP services Phase 3 of opt-in authentication + multi-user segregation: - Task service: workspaces, workflows, repositories, and tasks are scoped to the request identity (owner-only visibility; pre-auth unowned rows stay shared). Denials use *NotFound sentinels - no existence leak. Internal callers and the disabled-mode synthetic identity remain unscoped, preserving behavior exactly when auth is off. - CreateWorkspace stamps the authenticated caller as owner. - Session chokepoint: lifecycle Manager.GetOrEnsureExecution runs a settable session-access check covering shell/files/ports/vscode/LSP. - Secrets: per-user user_id column, scoped CRUD/list, ClaimUnowned wired into the setup-wizard backfills. - Boot payload inherits scoping automatically. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(auth): scope WebSocket gateway to authenticated users Phase 4 of opt-in authentication + multi-user segregation: - Connection auth: /ws, /terminal, /lsp, /vscode, /port-proxy routes are guarded when auth is enabled - session cookie (same-origin upgrade), resolved identity from the HTTP middleware, or ?token=<PAT> for headerless programmatic clients; JSON 401 before any upgrade. - Client identity: every WS client carries its authn.Identity; dispatched RPC actions (workspace.list, task CRUD, ...) run under a context carrying it, so WS RPC gets the same per-user scoping as HTTP. - Subscription checks: task/session subscribe+focus verify workspace visibility via the task service; user topic subscriptions are pinned to the client's own user. - Broadcast routing: new Hub.BroadcastToWorkspace routes workspace-scoped events (task/workflow/repo/office/session-state) to the owner's clients only, with safe fallbacks (unowned/unresolvable -> broadcast) so events never vanish; instance-wide events (executors, environments, agent profiles, system jobs) stay global by design. - Replaced the long-standing discarded-token TODO in HandleConnection. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(auth): add feature spec and backend architecture notes for opt-in auth - docs/specs/auth/spec.md: product behavior (opt-in, setup wizard, per-user workspaces, sessions/PATs, invites, public surface, v1 limits) - apps/backend/AGENTS.md: internal/auth package layout + scoping rules for new service entry points and WS broadcast call sites Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(auth): public documentation for opt-in authentication - New docs/public/authentication.md: enabling, users & invites, PATs, public endpoints, limitations, disabling - run-as-a-service.md: network-security note now points at the real authentication boundary instead of reverse-proxy-only guidance - meta.json: nav entry under Configure Kandev Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(auth): ADR for opt-in authentication architecture Records the load-bearing choices: mode state machine + synthetic identity in disabled mode, opaque DB-backed credentials over JWTs, default-user promotion at setup, service-layer scoping with no-admin-bypass, and the explicit public allowlist. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(web): auth UI — login, setup wizard, invites, users & account settings Adds the frontend half of opt-in authentication: a pre-auth gate in main.tsx that renders the setup wizard or login/invite pages instead of the app shell whenever the boot payload's auth block says so, a new `auth` store slice + feature flag mirroring the backend's StatePayload, credentialed fetch (`credentials: "include"`) with a 401 handler that clears the session and redirects to /login, and a full auth-api.ts client for the /api/v1/auth and /api/v1/users routes. Settings additions: a System > Users page (list/create/disable/promote users, invite-link dialog) and System > Authentication page (enable/ disable with confirm + env-locked banner), gated on the `auth` feature flag and admin role. A new Account sidebar group (Profile & Password, API Tokens) is shown to signed-in users once auth is enabled. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(auth): E2E lifecycle suite + fix workspace event WS leak it caught New dedicated Playwright auth project (backend restarts with KANDEV_AUTH_REQUIRED=true, isolated from the tokenless default suite): setup-mode boot gating, admin setup wizard, login/logout + bad credentials, PATs, admin-surface authorization, anonymous WS rejection, UI login flow, and the acceptance test - two-user segregation across HTTP, boot payload, and WebSocket. The segregation spec immediately caught a real leak: workspace.* event payloads carry their ID as 'id' (the payload IS the workspace DTO), not 'workspace_id', so BroadcastToWorkspace fell back to broadcast-to-all for workspace create/update/delete. Fixed with action-aware extraction plus a unit regression test. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(auth): close cross-user access gaps found in security audit Two independent security audits of the auth branch found several authorization gaps where session/workspace-scoped surfaces were not wired to the new per-user chokepoint. All fixed: - IDOR on reverse-proxy/terminal routes (vscode, port-proxy, terminal): these resolve executions via GetExecutionBySessionID / GetOrEnsureExecutionForEnvironment / EnsurePassthroughExecution, which skipped the session-access check that only GetOrEnsureExecution ran. Added the check inside the env/passthrough resolvers (before the cache short-circuit) and an explicit CheckSessionAccess gate in the two bare-lookup proxy handlers. An authenticated non-owner can no longer reach another user's IDE, forwarded ports, or shell. - Cross-user agent-conversation read: ListMessages / ListMessagesPaginated / SearchMessages now authorize the session. - Cross-user repository-script read/inject: script CRUD now authorizes the parent repository's workspace. - Office HTTP surface: a group middleware enforces workspace ownership on :wsId routes for real users (agent-JWT callers keep their claim scoping). - Login rate-limit bypass: SetTrustedProxies(nil) so a spoofed X-Forwarded-For can't rotate the limiter key on a directly-reachable backend. - Invite double-provisioning race: MarkInviteUsed is now the atomic serialization point (consumed before user creation). - Setup wizard: serialized with a mutex so concurrent first-visitors can't corrupt the promoted admin profile. - Log sanitizer: explicit kandev_pat_ redaction rule. Regression tests added for message/script scoping and the execution-access-before-cache invariant. Auth E2E (incl. two-user segregation) still green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(auth): scope repository active-session-count endpoint GET /api/v1/repositories/:id/active-session-count went through CountActiveSessionsByRepository, which was not identity-scoped - a cross-user info leak of another owner's active session counts. Added the same authorizeRepositoryID gate the script routes use. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(auth): add json tags to auth store models — omit digests, fix token UI The auth store structs (APIToken, Invite, LoginIdentity, Session) had db: tags but no json: tags, so the handlers that serialize them directly sent Go-cased keys (CreatedAt, Name) AND leaked the SHA-256/password digests to clients. Two consequences: - The API-tokens UI showed 'Invalid Date' and an empty name (frontend reads created_at/name). - token_sha256 / password_hash were serialized in list responses. Added json tags with snake_case keys the frontend reads and json:"-" on every credential digest. Regression test asserts digests never serialize and the snake_case timestamp/name keys are present. Also adds the auth-screenshots capture spec (artifacts gitignored). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(web): move auth enable into feature toggles; show current user in sidebar Remove the standalone Authentication settings page and its dedicated settings/get-auth-settings API surface now that enabling auth lives in the Feature Toggles system, and drop env_required now that /auth/me no longer returns it. Add a current-user chip with a logout action to the sidebar footer, shown only in enabled auth mode. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(auth): make features.auth the single on/off control Per review feedback: authentication configuration now lives entirely in the existing Feature Toggles system rather than a separate Authentication settings section. - The auth mode is derived from the features.auth runtime flag (KANDEV_FEATURES_AUTH): off -> disabled, on+no-admin -> setup, on+admin -> enabled. Removed the parallel auth.mode system setting, the SetEnabled service method, GET/PATCH /api/v1/auth/settings, the AuthConfig.Required field, KANDEV_AUTH_REQUIRED, and the auth service's Settings-store dependency and EnvRequired/env_required. - The features.auth registry entry is re-described as the actual enable switch (high-risk, restart-required) and defaults off in every profile (dev was previously true — that only revealed UI before; now it would enforce, so it must be an explicit opt-in). - Setup no longer persists a mode; completing the wizard creates the admin and the mode auto-derives to enabled. - Startup 'exposed without auth' warning + all docs (public guide, run-as-a-service, spec, ADR, AGENTS.md) point at the feature toggle. - E2E: auth specs use KANDEV_FEATURES_AUTH; screenshot spec captures the Feature Toggles page instead of the removed Authentication page; the member-restriction assertion targets an admin invite route. - Tests updated across service/httpmw/httpapi/profiles for the derived mode; full suite green (only pre-existing sandbox-FS failures remain). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(auth): complete cross-user isolation — integrations, automation, plan/walkthrough, session reads A follow-up isolation audit found that per-user scoping had been wired into the task service, secrets, office, and the WS gateway — but several workspace/task/session-scoped surfaces still resolved a caller-supplied ID with no ownership gate. Closed all of them; cross-user access now returns 404 across the board. - Integrations (jira/linear/sentry/slack/azure-devops/gitlab/github/ workflow-sync): a global middleware authorizes the workspace_id (query, or gitlab's /workspaces/:id/ path) on those route groups. Previously a member who knew another user's workspace ID could read/overwrite their integration connection config and watches. - Automation: workspace-authorizer seam gates get/list/create/update/delete/ enable/disable, triggers, run history, and — critically — the webhook secret. Was fully cross-tenant over WS before. - Task plans (PlanService) and walkthroughs (WalkthroughService): task- authorizer seam on every read/write. These bypassed the task service. - Session reads that hit the repo directly — session turns, task context, git snapshots, file reviews — now call AuthorizeSession/TaskAccess. Internal callers (pollers, schedulers, MCP) carry no identity and stay unscoped; disabled mode is unaffected. Regression tests added (plan/walkthrough scoping, automation authorizer matrix, integration path extraction) and the two-user E2E now asserts integration routes are shielded. Docs (spec, ADR, public guide) updated to state what is isolated and that filesystem/agent-credential isolation remains an OS-level limitation. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(web): current-user chip uses border hover, not accent fill The sidebar current-user chip used hover:bg-accent (a purpleish fill). Switch to the border-hover idiom used elsewhere (border border-transparent -> hover:border-border) with the neutral hover:bg-muted/50 the adjacent workspace picker uses, so the hover reads as a subtle outline instead of a colored background. Screenshot spec now captures the chip hover state. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(web): right-align current-user chip in the sidebar footer Push the user chip to the far right of the expanded footer (ml-auto) so it sits opposite the left-aligned icon buttons; collapsed mode keeps the centered vertical stack unchanged. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(auth): reject synthetic identity on management routes and scope office run broadcasts Address code-review findings on the opt-in authentication PR: - P1: while auth is disabled the middleware injects a synthetic admin (RoleAdmin), and RequireAdmin alone let it through — so anyone hitting a not-yet-enabled instance could mint a PAT or plant an admin that survives enablement and hijacks first-run setup. Add authn.RequireRealIdentity and guard the credential/session/user-management routes with it (public bootstrap routes stay reachable). Responds 404 while disabled. - P1: office run events carry task_id but no workspace_id, so they fell back to a global broadcast and leaked across users. Resolve the workspace from the task and route via the new Hub.BroadcastToWorkspaceOrDrop, which fails closed (drops rather than global-broadcasts) when the workspace is unknown and auth is enforced. - nit: type createAuthSlice as a single-arg creator and call it with just set. Also register the authentication docs page and its settings routes in docs/public/coverage.json so the public-docs validator passes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Kandev Agent <agent@kandev.dev> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
13 KiB
13 KiB
Decision Log
Architecture Decision Records (ADRs) for the Kandev project. Each decision captures the context, choice, consequences, and alternatives for significant architectural or design decisions.
Read individual ADRs for full context. Create new ones via /record decision or manually following the template in 0001-file-based-knowledge-system.md.
| ID | Title | Status | Area | Date |
|---|---|---|---|---|
| 0001 | File-based knowledge system | accepted (amended 2026-07-16) | infra | 2026-03-28 |
| 0002 | Host utility agentctl for sessionless ACP flows | accepted | backend | 2026-04-08 |
| 0003 | executors_running as the single source of truth for agent_execution_id | accepted | backend | 2026-05-03 |
| 0004 | Task model unification — shared base, per-strategy meta, shared kernel | proposed | backend, frontend | 2026-05-05 |
| 0005 | Agent model unification — one agents table |
proposed | backend, frontend | 2026-05-06 |
| 0006 | Tier routing vs cheap_agent_profile_id coexistence | superseded | backend | 2026-05-11 |
| 0007 | profiles.yaml — runtime defaults for prod / dev / e2e | accepted | backend, frontend | 2026-05-16 |
| 0008 | DB upgrade safety - meta table, pre-migration backup, migration logging | accepted | backend | 2026-05-16 |
| 0009 | Fail-closed GC semantics for filesystem and container cleanup | accepted | backend | 2026-05-16 |
| 0010 | Worktree copy-files — per-repo, idempotent, host-local | accepted | backend, frontend | 2026-05-19 |
| 0011 | Transient provider errors (529 Overloaded) auto-retry with visible backoff | accepted | backend, frontend | 2026-05-30 |
| 0012 | Service-only UI self-update | accepted | backend, frontend, cli | 2026-05-29 |
| 0013 | Multi-branch task support — N (repo, branch) pairs per task | accepted | backend, frontend | 2026-06-01 |
| 0014 | Per-CLI MCP server injection for passthrough mode | accepted | backend | 2026-05-29 |
| 0015 | Explicit completion signal for auto-advance | proposed | backend, frontend | 2026-06-04 |
| 0016 | Read-only absolute file paths | accepted | backend | 2026-06-14 |
| 0017 | Resource metrics sampling | accepted | backend, frontend, protocol | 2026-06-14 |
| 0018 | Runtime settings overrides | accepted | backend, frontend, cli | 2026-06-14 |
| 0019 | Restart supervisor owns backend restarts | accepted | backend, frontend, cli | 2026-06-14 |
| 0020 | Pi project MCP config injection | accepted | backend | 2026-06-16 |
| 0021 | Go-served SPA with boot state | accepted | backend, frontend, cli | 2026-06-15 |
| 0022 | Embedded Vite assets | accepted | backend, frontend, cli | 2026-06-17 |
| 0023 | Active workspace cookie for boot state | accepted | backend, frontend | 2026-06-18 |
| 0024 | Go-fronted Vite dev mode | accepted | backend, frontend, cli | 2026-06-18 |
| 0025 | Runtime cleanup uses executors_running |
accepted (amended 2026-07-06) | backend | 2026-06-22 |
| 0026 | Tauri desktop shell over native runtime | accepted (amended 2026-07-15) | frontend, backend, cli, infra | 2026-06-23 |
| 0027 | Replayable schema migrations across SQLite and Postgres | accepted | backend | 2026-06-24 |
| 0028 | Backend-owned task-create last-used preferences | accepted (amended by 0041) | backend, frontend | 2026-06-29 |
| 0029 | Release backfill and desktop diagnostics | accepted (amended 2026-07-16) | infra, workflow | 2026-07-01 |
| 0030 | Workspace-scoped integration settings | accepted | backend, frontend | 2026-07-01 |
| 0031 | Office skill reference files | accepted | backend | 2026-07-06 |
| 0032 | Configurable worktree branch names | accepted | backend, frontend | 2026-07-07 |
| 0033 | Durable plan implementation start marker | accepted | backend, frontend | 2026-07-09 |
| 0034 | Agent Client Protocol Codex ACP Bridge | accepted | backend, protocol | 2026-07-10 |
| 0035 | Version AgentReady events by prompt generation | accepted | backend | 2026-07-14 |
| 0036 | Normalize ACP shell output at the adapter boundary | accepted | backend, frontend, protocol | 2026-07-14 |
| 0037 | Resource-aware frontend unit tests | accepted | frontend, infra | 2026-07-14 |
| 0038 | Quick Chat Repository Isolation | accepted | backend, frontend | 2026-07-14 |
| 0039 | Native desktop integration boundary | accepted (amended 2026-07-24) | desktop, frontend, backend, infra | 2026-07-15 |
| 0040 | Separate updater integrity from OS publisher identity | accepted | desktop, infra, workflow | 2026-07-15 |
| 0041 | Backend-owned portable user settings | accepted | backend, frontend | 2026-07-15 |
| 0042 | Project shell output and fetch it on demand | accepted | backend, frontend, protocol | 2026-07-16 |
| 0043 | Plugins read/write kandev data via capability-gated Host gRPC RPCs | accepted | backend, protocol | 2026-07-17 |
| 2026-07-14-typed-utility-chat-sessions | Typed Utility Chats Share the Quick Chat Session Model | accepted | backend, frontend | 2026-07-14 |
| 2026-07-15-office-agent-execution-profile-routing | Separate Office identity from routed execution profiles | proposed | backend, frontend | 2026-07-15 |
| 0044 | ACP agent compatibility dialects | accepted | backend, protocol | 2026-07-16 |
| 0045 | Install-wide storage maintenance uses typed ownership providers and quarantine | accepted (amended 2026-07-22) | backend, frontend, infra | 2026-07-14 |
| 0046 | Settings route save coordinator | accepted | frontend | 2026-07-14 |
| 0047 | Plugins read conversation content via a capability-gated Host RPC | accepted | backend, protocol | 2026-07-21 |
| 0048 | Plugins invoke a settings-selectable utility agent | accepted | backend, frontend, protocol | 2026-07-21 |
| 2026-07-23-opencode-review-evidence-trust | Trusted OpenCode Review Evidence | accepted | workflow, infra | 2026-07-23 |
| 2026-07-23-planner-direct-small-work | Planner Direct Small Work | accepted | workflow | 2026-07-23 |
| 2026-07-23-post-commit-hook-aware-verification | Post-Commit Hook-Aware Verification | accepted | workflow | 2026-07-23 |
| 2026-07-24-operator-owned-agent-launcher-settings | Operator-Owned Agent Launcher Settings | accepted | backend, frontend, protocol | 2026-07-24 |
| 2026-07-18-turn-configuration-snapshots | Attribute runtime configuration to turns | accepted | backend, frontend | 2026-07-18 |
| 2026-07-22-gpg-signed-release-tags | GPG-signed release tags | accepted | infra, workflow | 2026-07-22 |
| 2026-07-19-reject-mcp-actions-on-raw-websocket | Reject MCP Actions on the Raw WebSocket | accepted | backend, protocol | 2026-07-19 |
| 2026-07-19-workspace-symlink-entries | Treat Nested Workspace Symlinks as Entries | accepted | backend, infra | 2026-07-19 |
| 2026-07-20-explicit-local-repository-trust | Explicit Local Repository Trust | accepted | backend, frontend | 2026-07-20 |
| 2026-07-20-provider-neutral-remote-repositories | Provider-neutral remote repositories | accepted | backend, frontend, protocol | 2026-07-20 |
| 2026-07-20-repository-provider-origin-identity | Persist Provider Origin In Repository Identity | accepted | backend, frontend | 2026-07-20 |
| 2026-07-21-portable-status-bar-order | Portable Status Bar Order | accepted | backend, frontend, protocol | 2026-07-21 |
| 2026-07-21-work-item-reference-search | Backend-normalized work-item references | accepted | backend, frontend, protocol | 2026-07-21 |
| 2026-07-24-opt-in-authentication | Opt-in Authentication and Per-User Workspace Scoping | accepted | backend, frontend, protocol, security | 2026-07-24 |
| 2026-07-24-semantic-notification-events | Semantic notification events come from domain occurrences | accepted | backend, frontend, desktop | 2026-07-24 |