fix: correct session-ownership check

AdminForth/1871/https-claude.aicodeartifacteff

Author: yaroslav8765

application/runTurnUseCase.ts

@@ -178,6 +178,10 @@ export class RunTurnUseCase {
     return this.pendingInterrupts.get(sessionId) ?? [];
   }
 
+  private requiresSessionOwnership(input: BaseAgentTurnInput) {
+    return !input.chatSurface;
+  }
+
   /** Verify the session exists and belongs to the requesting admin user. */
   private async assertSessionOwnership(sessionId: string, adminUser: BaseAgentTurnInput["adminUser"]) {
     const s = this.deps.sessionResource;
@@ -193,9 +197,9 @@ export class RunTurnUseCase {
   }
 
   /**
-   * Prepare an edit/branch turn: validate ownership, resolve the fork checkpoint from
-   * the previous turn, truncate the conversation after the edited turn, and reuse the
-   * edited turn's id for the regenerated response.
+   * Prepare an edit/branch turn: resolve the fork checkpoint from the previous turn,
+   * truncate the conversation after the edited turn, and reuse the edited turn's id
+   * for the regenerated response. Ownership is already asserted by `prepareTurn`.
    */
   private async prepareEditTurn(input: RunAndPersistAgentResponseInput): Promise<PreparedTurn> {
     const sequenceDebugSink = this.deps.createDebugSink();
@@ -205,7 +209,6 @@ export class RunTurnUseCase {
     if (!this.deps.turnCheckpointsEnabled) {
       throw new Error("Edit/fork requires checkpointIdField to be configured on turnResource.");
     }
-    await this.assertSessionOwnership(input.sessionId, input.adminUser);
 
     const agentTurns = await this.deps.sessions.getAgentTurns(input.sessionId);
     const targetIndex = agentTurns.findIndex((turn) => turn.id === editTurnId);
@@ -266,6 +269,12 @@ export class RunTurnUseCase {
     const approvalDecision = getApprovalDecision(input);
     const shouldResume = Boolean(approvalDecision);
 
+    console.log(`Preparing turn for session "${input.sessionId}" (resume=${shouldResume})`);
+    if (this.requiresSessionOwnership(input)) {
+      console.log(`Asserting session ownership for session "${input.sessionId}"`);
+      await this.assertSessionOwnership(input.sessionId, input.adminUser);
+    }
+
     if (input.editTurnId && !shouldResume) {
       return this.prepareEditTurn(input);
     }

tests/turn_flow.test.ts

@@ -394,6 +394,54 @@ describe('RunTurnUseCase.handleTurn', () => {
     await expect(useCase.handleTurn(input as any)).rejects.not.toThrow('No pending approval');
   });
 
+  it('rejects a normal turn on a session the user does not own, before creating a turn', async () => {
+    const { useCase, sessions, llm } = buildUseCase({
+      sessionOwnerPk: 'someone-else',
+      streamFor: () => streamOf(text('secret')),
+    });
+    const { input } = makeInput();
+
+    await expect(useCase.handleTurn(input as any)).rejects.toThrow(/does not belong/);
+    // Nothing about the victim's session may be touched or streamed back.
+    expect(sessions.calls.createNewTurn).toHaveLength(0);
+    expect(llm.calls).toHaveLength(0);
+  });
+
+  it('rejects a turn on a session that does not exist', async () => {
+    const { useCase } = buildUseCase({ sessionOwnerPk: null });
+    const { input } = makeInput();
+
+    await expect(useCase.handleTurn(input as any)).rejects.toThrow(/not found/);
+  });
+
+  it('rejects an approval resume on a session the user does not own, before resolving interrupts', async () => {
+    const { useCase, llm } = buildUseCase({
+      sessionOwnerPk: 'someone-else',
+      hasPersistentCheckpointer: true,
+      pendingInterrupts: [{ id: 'int-1', count: 1 }],
+    });
+    const { input } = makeInput({ prompt: '', approvalDecision: 'approve' });
+
+    // An attacker must not be able to approve a dangerous tool call pending in
+    // someone else's session.
+    await expect(useCase.handleTurn(input as any)).rejects.toThrow(/does not belong/);
+    expect(llm.getPendingInterruptsCalls).toHaveLength(0);
+    expect(llm.calls).toHaveLength(0);
+  });
+
+  it('allows a chat-surface turn whose session is shared with other linked users', async () => {
+    const { useCase, llm } = buildUseCase({
+      sessionOwnerPk: 'someone-else',
+      streamFor: () => streamOf(text('ok')),
+    });
+    const { input } = makeInput({ chatSurface: 'telegram' });
+
+    const result = await useCase.handleTurn(input as any);
+
+    expect(result.text).toBe('ok');
+    expect(llm.calls).toHaveLength(1);
+  });
+
   it('rejects (does not swallow) an approval with no pending interrupt, after emitting turn-started', async () => {
     const { useCase } = buildUseCase();
     const { input, events } = makeInput({ prompt: '', approvalDecision: 'approve' });