fix(rbac): gate user-actor membership floor on a scoped context

Only load the user and run the membership floor when organizationId or projectId is present, restoring pre-P5 behavior for unscoped tokens (no user query, no denial). The user lookup falls back to the primary before failing closed, so replica lag can't spuriously 401 a just-created member.

Author: kathiekiwi

internal-packages/rbac/src/fallback.ts

@@ -261,22 +261,26 @@ class RoleBaseAccessFallbackController implements RoleBaseAccessController {
       return { ok: false, status: 401, error: "Invalid user-actor token" };
     }
 
-    // Same tenant floor as authenticateSession: a non-member's delegated token is
-    // denied here, not handed a usable ability (even for reads). Admins are exempt.
-    const user = await this.replica.user.findFirst({
-      where: { id: claims.userId },
-      select: { id: true, admin: true },
-    });
-    if (!user) {
-      return { ok: false, status: 401, error: "Invalid user-actor token" };
-    }
-    if (!user.admin) {
-      const denied = await this.deniedByMembership(
-        context.organizationId,
-        context.projectId,
-        user.id
-      );
-      if (denied) return { ok: false, status: 403, error: "Unauthorized" };
+    // Same tenant floor as authenticateSession: in a scoped context a non-member's
+    // delegated token is denied here, not handed a usable ability (even for reads).
+    // Admins are exempt. An unscoped context is not a tenant claim — skip the lookup
+    // entirely and keep the prior behavior (no user query, no denial).
+    if (context.organizationId || context.projectId) {
+      const where = { id: claims.userId };
+      const user =
+        (await this.replica.user.findFirst({ where, select: { id: true, admin: true } })) ??
+        (await this.prisma.user.findFirst({ where, select: { id: true, admin: true } }));
+      if (!user) {
+        return { ok: false, status: 401, error: "Invalid user-actor token" };
+      }
+      if (!user.admin) {
+        const denied = await this.deniedByMembership(
+          context.organizationId,
+          context.projectId,
+          user.id
+        );
+        if (denied) return { ok: false, status: 403, error: "Unauthorized" };
+      }
     }
 
     return {

internal-packages/rbac/src/fallback.userActor.test.ts

@@ -18,33 +18,34 @@ async function seedUser(prisma: PrismaClient, email: string, admin = false) {
   });
 }
 
+async function uat(userId: string) {
+  return signUserActorToken(SECRET, { userId, client: "test" });
+}
+
 postgresTest(
-  "authenticateUserActor: member is allowed, non-member is denied",
+  "authenticateUserActor: scoped membership floor",
   async ({ prisma }) => {
-    const org = await prisma.organization.create({
+    const p = prisma as PrismaClient;
+    const org = await p.organization.create({
       data: { slug: `org-${Date.now()}`, title: "Org" },
     });
-    const member = await seedUser(prisma as PrismaClient, "member@example.test");
-    const stranger = await seedUser(prisma as PrismaClient, "stranger@example.test");
-    await prisma.orgMember.create({
-      data: { organizationId: org.id, userId: member.id },
+    const project = await p.project.create({
+      data: {
+        slug: `proj-${Date.now()}`,
+        name: "Project",
+        externalRef: `ref-${Date.now()}`,
+        organizationId: org.id,
+      },
     });
+    const member = await seedUser(p, "member@example.test");
+    const stranger = await seedUser(p, "stranger@example.test");
+    const admin = await seedUser(p, "admin@example.test", true);
+    await p.orgMember.create({ data: { organizationId: org.id, userId: member.id } });
 
-    const controller = new RoleBaseAccessFallback(prisma as PrismaClient, {
-      userActorSecret: SECRET,
-    }).create();
-
-    const memberToken = await signUserActorToken(SECRET, {
-      userId: member.id,
-      client: "test",
-    });
-    const strangerToken = await signUserActorToken(SECRET, {
-      userId: stranger.id,
-      client: "test",
-    });
+    const controller = new RoleBaseAccessFallback(p, { userActorSecret: SECRET }).create();
 
     // Member with a capless token keeps the read:all default.
-    const memberResult = await controller.authenticateUserActor(uatRequest(memberToken), {
+    const memberResult = await controller.authenticateUserActor(uatRequest(await uat(member.id)), {
       organizationId: org.id,
     });
     expect(memberResult.ok).toBe(true);
@@ -53,12 +54,48 @@ postgresTest(
     }
 
     // Non-member is denied at the ability layer, not handed a usable ability.
-    const strangerResult = await controller.authenticateUserActor(uatRequest(strangerToken), {
+    const strangerResult = await controller.authenticateUserActor(
+      uatRequest(await uat(stranger.id)),
+      { organizationId: org.id }
+    );
+    expect(strangerResult.ok).toBe(false);
+    if (!strangerResult.ok) expect(strangerResult.status).toBe(403);
+
+    // A token for a user that no longer exists fails closed.
+    const ghostResult = await controller.authenticateUserActor(uatRequest(await uat("usr_ghost")), {
       organizationId: org.id,
     });
-    expect(strangerResult.ok).toBe(false);
-    if (!strangerResult.ok) {
-      expect(strangerResult.status).toBe(403);
+    expect(ghostResult.ok).toBe(false);
+    if (!ghostResult.ok) expect(ghostResult.status).toBe(401);
+
+    // A platform admin is exempt from the membership floor.
+    const adminResult = await controller.authenticateUserActor(uatRequest(await uat(admin.id)), {
+      organizationId: org.id,
+    });
+    expect(adminResult.ok).toBe(true);
+
+    // A project-only scope resolves through the project's org: non-member denied.
+    const projectResult = await controller.authenticateUserActor(
+      uatRequest(await uat(stranger.id)),
+      { projectId: project.id }
+    );
+    expect(projectResult.ok).toBe(false);
+    if (!projectResult.ok) expect(projectResult.status).toBe(403);
+  },
+  120_000
+);
+
+postgresTest(
+  "authenticateUserActor: unscoped context skips the floor and never queries the user",
+  async ({ prisma }) => {
+    const p = prisma as PrismaClient;
+    const stranger = await seedUser(p, "unscoped@example.test");
+    const controller = new RoleBaseAccessFallback(p, { userActorSecret: SECRET }).create();
+
+    const result = await controller.authenticateUserActor(uatRequest(await uat(stranger.id)), {});
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.ability.can("read", { type: "runs", id: "run_x" })).toBe(true);
     }
   },
   120_000