fix(auth): scope org tools to the caller and document the auth flow#182
fix(auth): scope org tools to the caller and document the auth flow#182annextuckner wants to merge 12 commits into
Conversation
Add README reference entries for the organizations, alerts, threat_feed, package_files, package_file_contents, and package_file_grep tools, plus an authentication section and a worked organizations -> alerts example. Mirror the tool inventory in the architecture doc.
…mode The organizations, alerts, threat_feed, and package_files tools resolved their Socket token through resolveAuthToken, which falls back to the boot-time static key. In HTTP mode that key is the deploy operator's, so a shared/hosted server answered every caller's org lookup with the operator's private organizations, alerts, and threat feed. Split the resolver: resolveScopedAuthToken (per-tenant tools) returns the per-request token, and only falls back to the static key when it is the local user's own (stdio mode); in HTTP mode it returns undefined so the tool emits the auth-required error. setStaticApiKey now records whether the key is shared (HTTP) or user-owned (stdio). Non-OAuth HTTP mode reads the caller's Authorization: Bearer token into req.auth so per-tenant tools act on the caller's behalf. depscore keeps the public static fallback since package scores are not tenant-scoped.
Co-authored-by: John-David Dalton <jdalton@users.noreply.github.com> Signed-off-by: annextuckner <john@socket.dev>
…and-docs # Conflicts: # test/http-server.test.ts
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
2 participants
What this changes
Tightens authentication in HTTP mode and documents the auth flow for the org-scoped tools.
52a87e8). In HTTP mode, organization-aware tools now resolve the caller's own token from theAuthorization: Bearerheader instead of falling back to the operator's boot-time deploy key. Stdio mode is unchanged. Covered by new tests intest/http-server.test.tsandtest/server.test.ts.SOCKET_API_TOKEN/SOCKET_API_KEYauth flow (9b78353). Adds the tool reference and the per-mode authentication guidance toREADME.mdanddocs/claude.md/repo/architecture.md.Auth model after this change
SOCKET_API_TOKENauthenticates every tool.Testing
pnpm test— new HTTP-server and server cases assert the caller-scoped behavior.