fix(sec): derive role/user from authenticated token identity, ignore client-controlled role headers (G7 S1)

- aios_gitops_model_api (adapters+app): drop X-AIOS-Role/X-AIOS-User trust;
  role/user resolved from server-side token->identity mapping in TOKEN_FILE.
- task_action_api: ignore body role; role from injected authenticator (default user).
- agent_observability_api: tenant/principal decides scope; client role=owner ignored.

active-runtime/app/agent_observability_api.py

@@ -16,6 +16,28 @@ from .agent_observability_store import AgentObservabilityStore
 store = AgentObservabilityStore()
 dashboard = AgentObservabilityDashboard(store.load())
 
+_ROLE_WHITELIST = {"user", "group_admin", "owner"}
+_authenticator = None  # callable() -> {"user_id":..., "role":...} | None, injected by host
+
+
+def set_authenticator(fn):
+    """Install a server-side authenticator used to derive the querying tenant.
+
+    The callable returns the authenticated principal (dict with "user_id" and
+    a whitelisted "role") or None for anonymous. The client-supplied role and
+    user/group ids are NOT trusted to escalate scope.
+    """
+    global _authenticator
+    _authenticator = fn
+
+
+def _principal():
+    if _authenticator is not None:
+        p = _authenticator()
+        if isinstance(p, dict) and p.get("role") in _ROLE_WHITELIST:
+            return p
+    return None
+
 
 def record_agent_execution(payload: dict[str, Any]):
     record = AgentExecutionRecord(**payload)
@@ -23,11 +45,30 @@ def record_agent_execution(payload: dict[str, Any]):
 
 
 def get_agent_observability(user_id: str | None = None, group_id: str | None = None, role: str = "user"):
-    records = store.query(user_id, group_id, role)
+    # The authenticated principal (tenant) is authoritative; the request params
+    # role/user_id/group_id can never choose owner or another tenant.
+    principal = _principal()
+    pr_user = principal.get("user_id") if principal else None
+    pr_role = principal.get("role", "user") if principal else "user"
+
+    if pr_role == "owner":
+        # Server-verified owner may browse a requested scope.
+        q_user, q_group, q_role = user_id, group_id, "owner"
+        summary_scope = None
+    elif pr_user:
+        # Authenticated non-owner: strictly scoped to own tenant.
+        q_user, q_group, q_role = pr_user, None, "user"
+        summary_scope = pr_user
+    else:
+        # Anonymous: nothing scoped to them.
+        q_user, q_group, q_role = None, None, "user"
+        summary_scope = None
+
+    records = store.query(q_user, q_group, q_role)
     return {
         "status": "ok",
         "records": records,
-        "summary": store.load().summary(user_id if role != "owner" else None),
+        "summary": store.load().summary(summary_scope),
     }
 
 

active-runtime/app/aios_gitops_model_api.py

@@ -57,10 +57,36 @@ def seed_base_models():
     if not one('SELECT * FROM gitops_versions WHERE version=?', ('V1R1C0',)):
         exec_sql('INSERT INTO gitops_versions(version,tag,level,summary,status,created_by,created_at) VALUES(?,?,?,?,?,?,?)', ('V1R1C0','V1R1C0','R','MultiUser runtime selector + GitOps + custom LLM priority registry','ready','system',now()))
 
+_ROLE_WHITELIST = {'owner', 'admin', 'user'}
+def token_identity(token: str):
+    """Resolve the server-authoritative identity bound to a token.
+
+    Format of each TOKEN_FILE line (one per line, ':'-separated):
+        <token>                  -> authenticated principal, role 'user'
+        <token>:<user>:<role>    -> mapped principal; role restricted to owner/admin/user
+    Identity NEVER comes from a client-supplied header. In local dev mode the
+    DEV_ALLOW flag maps a fixed dev principal (must be explicitly enabled).
+    """
+    if DEV_ALLOW:
+        return {'username': 'dev-owner', 'role': 'owner'}
+    if not token or not TOKEN_FILE.exists():
+        return None
+    for line in TOKEN_FILE.read_text().splitlines():
+        line = line.strip()
+        if not line:
+            continue
+        parts = [x.strip() for x in line.split(':')]
+        if not parts or parts[0] != token:
+            continue
+        if len(parts) >= 3:
+            role = parts[2] if parts[2] in _ROLE_WHITELIST else 'user'
+            return {'username': safe_name(parts[1]), 'role': role}
+        return {'username': 'user-%s' % token[:8], 'role': 'user'}
+    return None
+
 def valid_token(token: str) -> bool:
     if DEV_ALLOW: return True
-    if not token or not TOKEN_FILE.exists(): return False
-    return token.strip() in [x.strip() for x in TOKEN_FILE.read_text().splitlines() if x.strip()]
+    return token_identity(token) is not None
 def git_cmd(args, check=False):
     WORKSPACE.mkdir(parents=True, exist_ok=True); p = subprocess.run(['git'] + args, cwd=str(WORKSPACE), text=True, capture_output=True)
     if check and p.returncode != 0: raise RuntimeError(p.stderr or p.stdout or 'git command failed')
@@ -90,8 +116,10 @@ class Handler(BaseHTTPRequestHandler):
     server_version = 'AIOSGitOpsModelAPI/V1R1C0'
     def actor(self):
         auth = self.headers.get('Authorization',''); token = auth.replace('Bearer ', '').strip() if auth.startswith('Bearer ') else self.headers.get('X-AIOS-Token','')
-        ok = valid_token(token); user = self.headers.get('X-AIOS-User') or ('dev-owner' if DEV_ALLOW else 'anonymous'); role = self.headers.get('X-AIOS-Role') or ('owner' if DEV_ALLOW else 'user')
-        return {'username': safe_name(user), 'role': role, 'token_ok': ok}
+        ident = token_identity(token)
+        if ident is None:
+            return {'username': 'anonymous', 'role': 'user', 'token_ok': False}
+        return {'username': ident['username'], 'role': ident['role'], 'token_ok': True}
     def require_write(self, roles=None):
         a = self.actor()
         if not a['token_ok']: self.send_json({'error':'unauthorized','hint':'write APIs require Bearer token or AIOS_GITOPS_DEV_ALLOW=1'}, 401); return None

active-runtime/app/task_action_api.py

@@ -12,6 +12,29 @@ from .task_lifecycle import TaskLifecycle
 
 lifecycle = TaskLifecycle()
 
+# Role must come from an authenticated principal, never from the client body.
+_ROLE_WHITELIST = {"user", "agent", "executor", "dispatcher", "notifier", "group_admin", "owner"}
+_authenticator = None  # callable(payload) -> {"role": ...} | None, injected by host
+
+
+def set_authenticator(fn):
+    """Install a server-side authenticator used to derive the actor role.
+
+    `fn` receives the raw request payload and must return either None (or a
+    dict without a whitelisted "role") for anonymous, or a dict containing a
+    server-verified "role". The client-supplied `payload["role"]` is ignored.
+    """
+    global _authenticator
+    _authenticator = fn
+
+
+def effective_role(payload: dict[str, Any]) -> str:
+    if _authenticator is not None:
+        principal = _authenticator(payload)
+        if isinstance(principal, dict) and principal.get("role") in _ROLE_WHITELIST:
+            return principal["role"]
+    return "user"
+
 
 def get_task_actions(task: dict[str, Any], role: str) -> dict[str, Any]:
     return {
@@ -31,7 +54,8 @@ def build_router():
 
     @router.post("/{task_id}/actions/{action}", operation_id="executeTaskAction")
     def action(task_id: str, action: str, payload: dict[str, Any]):
-        return execute_task_action(payload.get("task", {}), action, payload.get("role", "user"), payload.get("reason"))
+        # Role is derived from the authenticated principal; body role is ignored.
+        return execute_task_action(payload.get("task", {}), action, effective_role(payload), payload.get("reason"))
 
     return router
 

adapters/gitops/aios_gitops_model_api.py

@@ -55,10 +55,36 @@ def seed_base_models():
     if not one('SELECT * FROM gitops_versions WHERE version=?', ('V1R1C0',)):
         exec_sql('INSERT INTO gitops_versions(version,tag,level,summary,status,created_by,created_at) VALUES(?,?,?,?,?,?,?)', ('V1R1C0','V1R1C0','R','MultiUser runtime selector + GitOps + custom LLM priority registry','ready','system',now()))
 
+_ROLE_WHITELIST = {'owner', 'admin', 'user'}
+def token_identity(token: str):
+    """Resolve the server-authoritative identity bound to a token.
+
+    Format of each TOKEN_FILE line (one per line, ':'-separated):
+        <token>                  -> authenticated principal, role 'user'
+        <token>:<user>:<role>    -> mapped principal; role restricted to owner/admin/user
+    Identity NEVER comes from a client-supplied header. In local dev mode the
+    DEV_ALLOW flag maps a fixed dev principal (must be explicitly enabled).
+    """
+    if DEV_ALLOW:
+        return {'username': 'dev-owner', 'role': 'owner'}
+    if not token or not TOKEN_FILE.exists():
+        return None
+    for line in TOKEN_FILE.read_text().splitlines():
+        line = line.strip()
+        if not line:
+            continue
+        parts = [x.strip() for x in line.split(':')]
+        if not parts or parts[0] != token:
+            continue
+        if len(parts) >= 3:
+            role = parts[2] if parts[2] in _ROLE_WHITELIST else 'user'
+            return {'username': safe_name(parts[1]), 'role': role}
+        return {'username': 'user-%s' % token[:8], 'role': 'user'}
+    return None
+
 def valid_token(token: str) -> bool:
     if DEV_ALLOW: return True
-    if not token or not TOKEN_FILE.exists(): return False
-    return token.strip() in [x.strip() for x in TOKEN_FILE.read_text().splitlines() if x.strip()]
+    return token_identity(token) is not None
 def git_cmd(args, check=False):
     WORKSPACE.mkdir(parents=True, exist_ok=True); p = subprocess.run(['git'] + args, cwd=str(WORKSPACE), text=True, capture_output=True)
     if check and p.returncode != 0: raise RuntimeError(p.stderr or p.stdout or 'git command failed')
@@ -88,8 +114,10 @@ class Handler(BaseHTTPRequestHandler):
     server_version = 'AIOSGitOpsModelAPI/V1R1C0'
     def actor(self):
         auth = self.headers.get('Authorization',''); token = auth.replace('Bearer ', '').strip() if auth.startswith('Bearer ') else self.headers.get('X-AIOS-Token','')
-        ok = valid_token(token); user = self.headers.get('X-AIOS-User') or ('dev-owner' if DEV_ALLOW else 'anonymous'); role = self.headers.get('X-AIOS-Role') or ('owner' if DEV_ALLOW else 'user')
-        return {'username': safe_name(user), 'role': role, 'token_ok': ok}
+        ident = token_identity(token)
+        if ident is None:
+            return {'username': 'anonymous', 'role': 'user', 'token_ok': False}
+        return {'username': ident['username'], 'role': ident['role'], 'token_ok': True}
     def require_write(self, roles=None):
         a = self.actor()
         if not a['token_ok']: self.send_json({'error':'unauthorized','hint':'write APIs require Bearer token or AIOS_GITOPS_DEV_ALLOW=1'}, 401); return None