Repository navigation
fix(approvals): revoking a session rule needs control, not the lease (r7.3) - #76
Merged
Merged
Conversation
…(r7.3)
A user tapped Revoke in Astation without holding control; Atem refused the
approval_rule_revoke with stale_lease and the rule kept auto-allowing.
approval_rule_revoke (session-v1 and chat-v1) is now admitted from any
attachment with `control`, with or without the lease: view-only is
forbidden, a closed session session_closed, and the rule must be active for
the binding's exact process (else stale_target). The binding's lease_epoch
is optional and never checked (a stale one is not refused); a revoke never
takes, renews or moves the lease. `acquire` is refused: the payload stays
exactly {rule_id}, so a client can't believe a revoke gave it control.
Journaling, receipts and duplicate/request_id_reused semantics are
unchanged. runtime.log gets one line per remote revoke naming the rule and
session, never the command.
Contract §6a r7.2 -> r7.3. The shared fixture is renamed to
approval-rule-revoke-needs-control-not-the-lease and covers a control
attachment revoking while another holds the lease, view-only, an inactive
rule, another process, acquire, a duplicate and the holder still renewing.
AGENTS.md, agent-chat-host.md, agent-chat-api.md and the Astation handoff
note updated.
🤖 Built with SMT <smt@agora.build>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Found in a live test with Astation: revoking an Atem session rule needed the session's lease. The user tapped Revoke without holding control, Atem refused it, and the rule kept auto-allowing. Revoking only takes a permission away, so it shouldn't need control.
Contract §6a, r7.3
controlcan revoke a rule withapproval_rule_revoke(session-v1 and chat-v1), with or without the lease.forbidden, and a closed session getssession_closed. A rule that isn't active for that exact process getsstale_target.lease_epochis optional and never checked. A revoke never takes, renews or moves the lease.acquireis not accepted: the payload stays exactly{rule_id}.approval-rule-revoke-needs-control-not-the-lease.json. Docs and the Astation handoff are updated.Tests
cargo testpassed twice (1663 unit tests plus every binary test), andruntime_fixtures_binarypassed.For Astation: don't acquire before a revoke, and don't put
acquirein its payload.Generated with SMT smt@agora.build