Exact-path reads run under the caller's identity, so gating applies by rbuergi · Pull Request #819 · Systemorph/MeshWeaver

rbuergi · 2026-08-05T15:09:18Z

The hole

A signed-in user with no entitlement could read gated PAID content by exact path.

Measured on memex 2026-08-05: get @AgenticPrimerDe/02-CodeWunsch returned 79,650 characters of a paid course lesson to a user with no grant and no entitlement — while the gating data was entirely correct:

Public|AgenticPrimerDe                |Read|t   ← cover allow
Public|AgenticPrimerDe/02-CodeWunsch  |Read|f   ← DENY, present and correct

The SQL query path (GenerateAccessControlClause) hid the same node. Only the single-node read leaked it — which is why this had been filed on 2026-07-29 as an operational quirk: "children vanish from listings but direct get by path still works". That clause was the hole.

Cause

MeshNodeStreamCache.GetStreamRaw reads AccessService.Context at subscribe time to decide whether to apply its per-user read gate, and deliberately passes through to the shared system-identity upstream when that is null (background / hub-principal flows).

AccessContext is an AsyncLocal and is cleared across .Subscribe hops — the same reason ReadNodeOrUnified already captures it for the PII projection. So a lost identity did not fail closed: it read everything.

Fix

FetchNode captures the caller synchronously and re-establishes it (SwitchAccessContext) around the subscribe, so the existing gate applies. No second access model; it cannot lock out the flows the gate intentionally passes through, because a null capture switches to null — exactly today's behaviour. A denial is logged distinctly and collapses to "Not found", which does not disclose that a paid node exists at the path.

Tests

GatedNodeExactPathReadTests — the visitor is denied, the entitled buyer still reads the same node, and the cover stays public. (A paywall that denies everyone is not a fix; the middle case is what catches an over-strict gate — and it did, on my first attempt.)

Each case seeds its own plugin: the methods share a mesh, so a shared path makes the second CreateNode complete without emitting, and a deny-assertion would pass vacuously against a node that was never created.

⚠️ Honest limit — please read before merging

These tests pass with AND without the fix. The monolith harness sets the identity on the calling thread and no Rx hop clears it, so it does not reproduce the loss that happens in the deployed MCP pipeline. They pin the paywall's required behaviour, not this specific regression.

So the fix is unproven by CI. It is verified against production after deploy by re-running the repro: as an account with no entitlement, get @AgenticPrimerDe/02-CodeWunsch must be denied. I'll run exactly that once the image rolls and report the result.

The change is low-risk in the meantime: it only supplies an identity where one was absent.

🤖 Generated with Claude Code

A signed-in user with no entitlement could read gated PAID content by exact path. Measured on memex 2026-08-05: `get @AgenticPrimerDe/02-CodeWunsch` returned 79,650 characters of a paid course lesson to a user with no grant and no entitlement — while the gating data was entirely correct (`Public|…/02-CodeWunsch|Read|is_allow=false` present) and the SQL query path hid the same node. Only the single-node read leaked it, which is why it had been filed on 2026-07-29 as an operational quirk: "children vanish from listings but direct get by path still works". That clause was the hole. MeshNodeStreamCache.GetStreamRaw reads AccessService.Context AT SUBSCRIBE TIME to decide whether to apply its per-user read gate, and deliberately passes through to the shared system-identity upstream when that is null (background / hub-principal flows). AccessContext is an AsyncLocal and is cleared across .Subscribe hops — the same reason ReadNodeOrUnified already captures it for the PII projection — so a lost identity did not fail closed: it read everything. FetchNode now captures the caller synchronously and re-establishes it (SwitchAccessContext) around the subscribe, so the EXISTING gate applies. This adds no second access model and cannot lock out the flows the gate intentionally passes through: a null capture switches to null, exactly today's behaviour. A denial is logged distinctly and collapses to "Not found", which does not disclose that a paid node exists at the path. Tests (GatedNodeExactPathReadTests): the visitor is denied, the entitled buyer still reads the same node, and the cover stays public — a paywall that denies everyone is not a fix. Each case seeds its OWN plugin: the methods share a mesh, so a shared path makes the second CreateNode complete without emitting and a deny-assertion would pass VACUOUSLY against a node that was never created. ⚠️ HONEST LIMIT: these tests pass with AND without the production fix. The monolith harness sets the identity on the calling thread and no Rx hop clears it, so it does not reproduce the loss that happens in the deployed MCP pipeline. The tests therefore pin the paywall's REQUIRED behaviour, not the specific regression; the fix itself is verified against production after deploy by re-running the repro above. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Fixes a security gap where exact-path single-node reads could bypass row-level access gating when AccessService.Context was lost across Rx subscription boundaries, allowing unauthorised users to read gated/paid content by path even though query-based listings were correctly filtered.

Changes:

Capture the caller identity in MeshOperations.FetchNode and re-establish it around the GetMeshNodeStream(...).Subscribe(...) so MeshNodeStreamCache’s existing per-user Read gate applies.
Collapse access-denied reads to null (surfacing as “Not found” to callers) while distinguishing denial vs routing failures in logs.
Add PostgreSQL integration tests that pin expected paywall behavior for exact-path reads (visitor denied, buyer allowed, cover remains public).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
test/MeshWeaver.Hosting.PostgreSql.Test/GatedNodeExactPathReadTests.cs	Adds integration tests asserting exact-path reads respect gating semantics (deny visitor, allow buyer, keep cover public).
src/MeshWeaver.AI/MeshOperations.cs	Captures/restores `AccessContext` around exact-path read subscription so the stream-cache read gate runs under the caller’s identity; adds denial-specific logging.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+    private async Task<string> GetAs(string userId, string path)
+    {
+        var access = Mesh.ServiceProvider.GetRequiredService<AccessService>();
+        access.SetCircuitContext(new AccessContext { ObjectId = userId, Name = userId });
+        try
+        {
+            return await new MeshOperations(Mesh).Get(path)
+                .Should().Within(60.Seconds()).Emit();
+        }
+        finally
+        {
+            access.SetCircuitContext(null);
+        }
+    }


+                            if (ex is UnauthorizedAccessException)
+                                logger.LogInformation(
+                                    "FetchNode DENIED for {Path} — caller lacks Read (gated content)",
+                                    resolvedPath);


github-actions · 2026-08-05T15:27:47Z