feat(workspace-service): the membership gate — identity must clear the instance's org

Build-order step 3. In DIDI_AUTH=required mode, a verified didi_session
is necessary but no longer sufficient: the didi_id must hold a
membership in REQUIRED_ORG_ID (the single-tenant instance's org — e.g.
humain.vc) or the superuser role anywhere. Checked once per WS upgrade
via /api/me with the cookie forwarded, cached 60s per session so
reconnect storms don't hammer the id service, and failing CLOSED when
the id service is unreachable — an identity outage must not silently
open the tenant's door. Rejection closes 4403 (vs 4401 for no
identity), so the shell can distinguish "sign in" from "no access".

This is the users/orgs/workspaces triangulation ENFORCING for the first
time: id.didi.sh says who you are and what orgs you hold; this gate
says what that means here.

Proven by the prove script's new GATE mode against the live container
in required mode: anonymous 4401, superuser admitted, signed-in
non-member 4403 — then optional mode restored and the base proof green
(local dev workflow unchanged).

Files changed:
- services/workspace/src/didi.ts (checkMembership + cache + fail-closed)
- services/workspace/src/ws.ts (gate on upgrade, 4403)
- scripts/prove-didi-auth.mjs (GATE mode)
- docker-compose.yml (REQUIRED_ORG_ID passthrough)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: mpstaton

docker-compose.yml

@@ -36,6 +36,10 @@ services:
       ID_JWKS_URL: ${ID_JWKS_URL:-http://host.docker.internal:4000/.well-known/jwks.json}
       ID_ISSUER: ${ID_ISSUER:-http://localhost:4000}
       DIDI_AUTH: ${DIDI_AUTH:-optional}
+      # Step 3's membership gate: in required mode, identity must also hold
+      # a membership in this org (or superuser anywhere). Unset → identity
+      # alone suffices. The single-tenant deploy sets humain.vc.
+      REQUIRED_ORG_ID: ${REQUIRED_ORG_ID:-}
     volumes:
       - workspace-data:/data
       - ./clients:/clients:ro

scripts/prove-didi-auth.mjs

@@ -33,6 +33,30 @@ const fail = (msg) => {
 };
 const step = (msg) => console.log(`\n\x1b[1m== ${msg}\x1b[0m`);
 
+// ── GATE MODE (build-order step 3) — runs ONLY the gate tests ──────────────
+// The base steps below assume DIDI_AUTH=optional; gate mode assumes the
+// container is running with:
+//   DIDI_AUTH=required REQUIRED_ORG_ID=humain.vc docker compose up -d workspace-service
+if (process.env.GATE === '1') {
+  step('GATE 1. no cookie → rejected 4401');
+  await expectClose(WS_URL, {}, 4401);
+  console.log('anonymous rejected ✓');
+
+  step('GATE 2. superuser (michael, lossless.group) → admitted');
+  const su = await signInAs('mpstaton@gmail.com');
+  const suFrame = await firstFrame(WS_URL, { Cookie: `didi_session=${su}` });
+  if (!suFrame.didi_id) fail('superuser should be admitted with identity');
+  console.log('superuser admitted ✓');
+
+  step('GATE 3. signed-in NON-member (alice) → rejected 4403');
+  const alice = await signInAs('alice@example.com');
+  await expectClose(WS_URL, { Cookie: `didi_session=${alice}` }, 4403);
+  console.log('non-member rejected ✓');
+
+  console.log('\n\x1b[32mMEMBERSHIP GATE PROVEN\x1b[0m');
+  process.exit(0);
+}
+
 // ── 1. magic link → didi_session cookie ────────────────────────────────────
 step('1. issue + redeem magic link against local id service');
 const issue = await fetch(`${ID_BASE}/api/magic-links`, {
@@ -86,6 +110,43 @@ console.log('tampered token rejected ✓');
 console.log('\n\x1b[32mDIDI AUTH PROVEN AGAINST LOCAL DEV\x1b[0m');
 process.exit(0);
 
+async function signInAs(addr) {
+  const issue = await fetch(`${ID_BASE}/api/magic-links`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ email: addr, app: 'gate-test' }),
+  }).then((r) => r.json());
+  if (!issue.dev_token) fail(`no dev_token for ${addr} — seeded?`);
+  const redeem = await fetch(`${ID_BASE}/api/magic-links/redeem`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ token: issue.dev_token }),
+  });
+  const cookie = /didi_session=([^;]+)/.exec(redeem.headers.get('set-cookie') ?? '')?.[1];
+  if (!cookie) fail(`no cookie for ${addr}`);
+  return cookie;
+}
+
+function expectClose(url, headers, wantCode) {
+  return new Promise((resolve) => {
+    const ws = new WebSocket(url, { headers });
+    const timer = setTimeout(() => {
+      ws.terminate();
+      fail(`expected close ${wantCode}, got timeout`);
+    }, 8000);
+    ws.on('message', () => {
+      clearTimeout(timer);
+      fail(`expected close ${wantCode}, but got a frame (admitted)`);
+    });
+    ws.on('close', (code) => {
+      clearTimeout(timer);
+      if (code !== wantCode) fail(`expected close ${wantCode}, got ${code}`);
+      resolve(undefined);
+    });
+    ws.on('error', () => {});
+  });
+}
+
 function firstFrame(url, headers) {
   return new Promise((resolve, reject) => {
     const ws = new WebSocket(url, { headers });

services/workspace/src/didi.ts

@@ -64,6 +64,68 @@ export async function verifyDidiCookie(
   }
 }
 
+// ── Membership gate (build-order step 3) ────────────────────────────────
+// In 'required' mode, verified identity is necessary but not sufficient:
+// the didi_id must hold a membership in the instance's org
+// (REQUIRED_ORG_ID env — e.g. humain.vc for the single-tenant deploy) or
+// the superuser role anywhere. Checked once per WS upgrade via /api/me
+// with the cookie forwarded; cached briefly so reconnect storms don't
+// hammer the id service.
+
+const ID_BASE = process.env.ID_BASE ?? deriveIdBase();
+const REQUIRED_ORG_ID = process.env.REQUIRED_ORG_ID;
+
+function deriveIdBase(): string | undefined {
+  // Convenience: ID_JWKS_URL is .../.well-known/jwks.json on the same host.
+  if (!JWKS_URL) return undefined;
+  try {
+    return new URL(JWKS_URL).origin;
+  } catch {
+    return undefined;
+  }
+}
+
+type Membership = { org_id: string; role: string };
+const membershipCache = new Map<string, { at: number; ok: boolean }>();
+const MEMBERSHIP_CACHE_MS = 60_000;
+
+/**
+ * Does this identity clear the instance's org requirement?
+ * - No REQUIRED_ORG_ID configured → gate is open (identity alone suffices).
+ * - Membership in REQUIRED_ORG_ID, any role → admitted.
+ * - Role 'superuser' in ANY org → admitted (the operating-team fast path).
+ */
+export async function checkMembership(
+  identity: DidiIdentity,
+  cookieHeader: string | string[] | undefined,
+): Promise<boolean> {
+  if (!REQUIRED_ORG_ID) return true;
+  if (!ID_BASE) return false;
+
+  const cached = membershipCache.get(identity.session_id);
+  if (cached && Date.now() - cached.at < MEMBERSHIP_CACHE_MS) return cached.ok;
+
+  try {
+    const raw = Array.isArray(cookieHeader) ? cookieHeader.join('; ') : (cookieHeader ?? '');
+    const res = await fetch(`${ID_BASE}/api/me`, { headers: { cookie: raw } });
+    if (!res.ok) {
+      membershipCache.set(identity.session_id, { at: Date.now(), ok: false });
+      return false;
+    }
+    const me = (await res.json()) as { memberships?: Membership[] };
+    const memberships = me.memberships ?? [];
+    const ok =
+      memberships.some((m) => m.org_id === REQUIRED_ORG_ID) ||
+      memberships.some((m) => m.role === 'superuser');
+    membershipCache.set(identity.session_id, { at: Date.now(), ok });
+    return ok;
+  } catch {
+    // id service unreachable: fail CLOSED in required mode — an identity
+    // instance outage should not silently open the tenant's door.
+    return false;
+  }
+}
+
 function readCookie(
   header: string | string[] | undefined,
   name: string,

services/workspace/src/ws.ts

@@ -14,7 +14,7 @@ import type { FastifyInstance, FastifyRequest } from 'fastify';
 import type { WebSocket } from '@fastify/websocket';
 import { type Subscription } from '@nats-io/transport-node';
 import { isValid, mint } from './auth';
-import { verifyDidiCookie, didiMode, type DidiIdentity } from './didi';
+import { verifyDidiCookie, didiMode, checkMembership, type DidiIdentity } from './didi';
 import { dispatch } from './capabilities';
 import { dispatchChatTurn } from './chat';
 import { getNats } from './nats';
@@ -91,10 +91,19 @@ export async function registerWebsocket(app: FastifyInstance): Promise<void> {
     // rejected; in 'optional' mode the legacy continuity token still works
     // and identity rides along when present.
     const didi = (await verifyDidiCookie(req.headers.cookie)) ?? undefined;
-    if (didiMode() === 'required' && !didi) {
-      app.log.warn('ws reject: didi auth required, no valid didi_session');
-      socket.close(4401, 'didi auth required');
-      return;
+    if (didiMode() === 'required') {
+      if (!didi) {
+        app.log.warn('ws reject: didi auth required, no valid didi_session');
+        socket.close(4401, 'didi auth required');
+        return;
+      }
+      // Step 3's gate: identity must also clear the instance's org
+      // requirement (membership in REQUIRED_ORG_ID, or superuser anywhere).
+      if (!(await checkMembership(didi, req.headers.cookie))) {
+        app.log.warn({ didi_id: didi.didi_id }, 'ws reject: membership required');
+        socket.close(4403, 'membership required');
+        return;
+      }
     }
 
     const session: Session = { token, socket, seq: 0, didi };