From 1efe2bf053860ce43a75ad164d7fe89df99278c6 Mon Sep 17 00:00:00 2001 From: naiba Date: Tue, 19 May 2026 01:58:53 +0000 Subject: [PATCH] fix(rpc): allow global agent secret across server owners Co-authored-by: naiba/CloudCode --- service/rpc/auth.go | 5 +++++ service/rpc/auth_test.go | 12 ++++++++++++ 2 files changed, 17 insertions(+) diff --git a/service/rpc/auth.go b/service/rpc/auth.go index 3ea7dd0c..02f1418b 100644 --- a/service/rpc/auth.go +++ b/service/rpc/auth.go @@ -101,6 +101,11 @@ func authorizeAgentForUUID(userId uint64, clientUUID string) (clientID uint64, h // Treat as unknown (registration path) rather than impersonation. return 0, false, nil } + if userId == 0 { + // The legacy global agent secret maps to user 0. It predates per-user + // agent secrets, so keep it compatible by allowing any existing UUID. + return cid, true, nil + } if server.UserID != userId { return 0, false, fmt.Errorf("client UUID does not belong to the agent secret owner") } diff --git a/service/rpc/auth_test.go b/service/rpc/auth_test.go index 373c9849..d61afec4 100644 --- a/service/rpc/auth_test.go +++ b/service/rpc/auth_test.go @@ -73,6 +73,18 @@ func TestAuthorizeAgentForUUIDRejectsForeignServerUUID(t *testing.T) { } } +func TestAuthorizeAgentForUUIDAllowsGlobalDefaultSecret(t *testing.T) { + defer setupAuthAgentFixture(t)() + + cid, hasID, err := authorizeAgentForUUID(0, "uuid-bob") + if err != nil { + t.Fatalf("global default secret must be allowed to use existing UUIDs, got %v", err) + } + if !hasID || cid != 2 { + t.Fatalf("expected (cid=2, hasID=true), got (cid=%d, hasID=%v)", cid, hasID) + } +} + // An unknown UUID must NOT be treated as an impersonation attempt — it is // the normal first-time registration path and the caller (Check) creates a // new server bound to the secret owner.