gitscratch: optional per-repo ownership (config.owned)

melvincarvalho · melvincarvalho · commit a8847a3e585a · 2026-07-11T10:31:30.000+02:00
Audit finding: the auth gate required *an* agent but never checked it
against the repo's recorded creator, so any authenticated user could push
to another's scratch repo. Default stays shared (the scratch model);
config.owned: true binds each repo to its first materializer — thereafter
only that creator may push (and read, under requireAuth), others get 403.
Regression test: alice creates, bob is refused, alice still allowed.
diff --git a/gitscratch/plugin.js b/gitscratch/plugin.js
@@ -23,6 +23,12 @@
 //     NIP-98, … An anonymous push gets 401 + WWW-Authenticate.
 //   - clone/fetch is public unless config.requireAuth is true.
 //   - the agent id is passed to the backend as REMOTE_USER.
+//   - by default a scratch repo is SHARED: any verified agent may push to
+//     any repo (that is the "scratch" model). Set config.owned: true to bind
+//     each repo to the agent that first materialized it — thereafter only
+//     that creator may push (and, when requireAuth is set, read); others get
+//     403. This closes the cross-agent-overwrite gap for deployments that
+//     want per-repo ownership without changing the shared default.
 //
 // Raw bodies (relates to JSS #583): the routes live in a Fastify scope
 // whose content-type parser hands the *unconsumed request stream* through
@@ -63,6 +69,7 @@ export async function activate(api) {
   const ttlMs = api.config.ttlMs ?? DEFAULT_TTL_MS;
   const sweepIntervalMs = api.config.sweepIntervalMs ?? Math.min(ttlMs, DEFAULT_SWEEP_MS);
   const requireAuth = api.config.requireAuth ?? false;
+  const owned = api.config.owned ?? false;
   const backend = await findBackend(api.config);
 
   const reposDir = path.join(api.storage.pluginDir(), 'repos');
@@ -86,6 +93,14 @@ export async function activate(api) {
     '',
   ].join('\n');
 
+  // The agent that first materialized a repo, or null if unknown/shared.
+  function repoCreator(name) {
+    try {
+      const meta = JSON.parse(fs.readFileSync(path.join(reposDir, name, META_FILE), 'utf8'));
+      return meta.creator ?? null;
+    } catch { return null; }
+  }
+
   // ------------------------------------------------------- materialize
   async function materialize(name, agent) {
     const repoPath = path.join(reposDir, name);
@@ -242,6 +257,16 @@ export async function activate(api) {
         return reply.code(401).send('authentication required\n');
       }
 
+      // Ownership (config.owned): once a repo has a creator, only that agent
+      // may push to it — and, under requireAuth, read it. Anonymous access is
+      // already handled above; here `agent` is set whenever the gate matters.
+      if (owned) {
+        const creator = repoCreator(name);
+        if (creator && agent !== creator && (isWrite || requireAuth)) {
+          return reply.code(403).send('this scratch repo belongs to another agent\n');
+        }
+      }
+
       // First access materializes the repo; the TTL clock starts here.
       await materialize(name, agent);
 
diff --git a/gitscratch/test.js b/gitscratch/test.js
@@ -195,6 +195,41 @@ describe('gitscratch plugin', () => {
     }
   });
 
+  it('owned: true binds a repo to its creator — other agents cannot push', async () => {
+    const owned = await startJss({
+      idp: true,
+      plugins: [{
+        id: 'gitscratch',
+        module: module_,
+        prefix: '/git',
+        config: { owned: true },
+      }],
+    });
+    try {
+      const { access_token: aliceTok } = await registerAndMint(owned.base, 'aliceowns');
+      const { access_token: bobTok } = await registerAndMint(owned.base, 'bobintrudes');
+      const ownedRemote = `${owned.base}/git/mine.git`;
+
+      // Alice creates the repo by first push.
+      await git([...authFlag(aliceTok), 'push', ownedRemote, 'main'], { cwd: work });
+
+      // Bob, though a verified agent, is refused a push to alice's repo.
+      await assert.rejects(
+        git([...authFlag(bobTok), 'push', ownedRemote, 'main'], { cwd: work }),
+        (err) => {
+          assert.match(String(err.stderr), /403|belongs to another agent|forbidden/i,
+            `bob's push should be forbidden: ${err.stderr}`);
+          return true;
+        },
+      );
+
+      // Alice can still push (a no-op update proves her access survives).
+      await git([...authFlag(aliceTok), 'push', ownedRemote, 'main'], { cwd: work });
+    } finally {
+      await owned.close();
+    }
+  });
+
   it('TTL sweeper reaps expired repos', async () => {
     const shortLived = await startJss({
       plugins: [{
