mirror of
https://gitee.com/mateos/mateclaw.git
synced 2026-09-13 19:23:42 +08:00
a1221ac02d
The identity forwarded to opt-in MCP servers was a one-dimensional string (ChatOrigin.requesterId): a MateClaw username for web logins, but a webchat visitorId for visitors and an IM sender id for IM — indistinguishable to the REST backend. The signed-token mode (d204b702) made this worse: an RS256 signature over an unauthenticated visitorId reads as "MateClaw authenticated this user" to any backend that trusts the signature. Introduce an identity-typing dimension at McpIdentityForwardService: - classify() branches on ChatOrigin: authenticated (web login, sub=immutable userId), anonymous (webchat visitor, trust=anonymous), external (IM sender, trust=external), or none (cron/system → nothing injected, fail-closed). - mint() adds `trust` and `channel_type` claims; plaintext value is prefixed `trust:subject` so backends can tell the kinds apart without a JWT. The immutable userId reaches resolve() without coupling it to the user store: JwtAuthFilter stamps user.id into auth.setDetails() (both JWT and PAT paths), and ChatController.memoryOrigin carries it on a new ChatOrigin.requesterUserId field (only-add, per the record's evolution rule). Resolves the webchat semantic mismatch raised in #459 and the "sub should be an immutable user id" follow-up. 82 tests green (4 identity classes covered with claim assertions + full ChatOrigin/MCP regression). (cherry picked from commit b5d2cfbf98b39848d7139c743a0b81fea71e8ffe) |
||
|---|---|---|
| .. | ||
| binding | ||
| context | ||
| delegation | ||
| graph | ||
| progress | ||
| service | ||
| AgentAuthoringToolTest.java | ||
| AgentGraphBuilderBasePathResolutionTest.java | ||
| AgentGraphBuilderIdentityBlockTest.java | ||
| AgentGraphBuilderIT.java | ||
| AgentGraphBuilderPreferenceTest.java | ||
| AgentServiceUniquenessTest.java | ||
| AgentToolSetTest.java | ||
| BaseAgentApprovalSanitizationTest.java | ||
| BaseAgentCarryRecentImageTest.java | ||
| BaseAgentCronIsolationTest.java | ||
| BaseAgentDirectToolHistoryScrubTest.java | ||
| BaseAgentHeadOrphanRepairTest.java | ||
| BaseAgentImageCaptionPersistTest.java | ||
| BaseAgentMultimodalSkipNoticeTest.java | ||
| BaseAgentToolCallReplayTest.java | ||
| GraphEventPublisherIterationTest.java | ||