feat(worker): split agent git auth from publication write auth (#4) (#37)

* feat(worker): add token redaction and result-envelope sanitizer (#4)

Signed-off-by: Val Alexander <bunsthedev@gmail.com>

* feat(worker): split orchestration, agent-git, and publication token phases (#4)

Installation tokens are now minted per role and constrained to the single
target repository: orchestration (contents:read, checks:write, issues:write,
pull_requests:read) held by the adapter; agent git (contents:write only)
injected via COVEN_GIT_TOKEN; publication (pull_requests:write, issues:write)
minted only after the result envelope passes contract validation. The result
envelope is sanitized before any persistence or publication, and the worker
refuses to write a session brief containing a live token.

Signed-off-by: Val Alexander <bunsthedev@gmail.com>

* test(worker): end-to-end token isolation and redaction coverage (#4)

Signed-off-by: Val Alexander <bunsthedev@gmail.com>

* docs: document scoped three-role token flow (#4)

Signed-off-by: Val Alexander <bunsthedev@gmail.com>

---------

Signed-off-by: Val Alexander <bunsthedev@gmail.com>

Author: BunsDev

Cargo.lock

@@ -36,3 +36,4 @@ tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 uuid = { version = "1", features = ["v4"] }
 hex = "0.4"
 toml = "0.8"
+wiremock = "0.6"

Cargo.toml

@@ -18,32 +18,83 @@ struct TokenResponse {
     token: String,
 }
 
-/// Generates a fresh installation access token for the given installation ID.
-/// Tokens expire after 1 hour; callers should cache and refresh.
-pub async fn get_token(app_id: u64, private_key_pem: &str, installation_id: u64) -> Result<String> {
-    get_token_with_base_url(
+/// Authority role a scoped installation token is minted for (issue #4).
+///
+/// Each role maps to the minimum GitHub App permission set for one phase of a
+/// task's lifecycle, constrained to the single target repository. The agent
+/// process only ever receives an `AgentGit` token; `Publication` is minted
+/// after the result envelope has passed contract validation.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum TokenRole {
+    /// Adapter-held: resolve refs, drive Check Runs, post progress comments.
+    Orchestration,
+    /// Agent-held (`COVEN_GIT_TOKEN`): clone/fetch and push of the working
+    /// branch. No issues, pull-request, or checks authority.
+    AgentGit,
+    /// Adapter-held, minted post-validation: open the draft PR and post the
+    /// PR-opened comment.
+    Publication,
+}
+
+impl TokenRole {
+    fn permissions(self) -> serde_json::Value {
+        match self {
+            TokenRole::Orchestration => serde_json::json!({
+                "contents": "read",
+                "checks": "write",
+                "issues": "write",
+                "pull_requests": "read",
+            }),
+            TokenRole::AgentGit => serde_json::json!({ "contents": "write" }),
+            TokenRole::Publication => serde_json::json!({
+                "contents": "read",
+                "issues": "write",
+                "pull_requests": "write",
+            }),
+        }
+    }
+}
+
+/// Generates a fresh installation access token constrained to one repository
+/// and one [`TokenRole`]'s permission set. Tokens expire after 1 hour.
+pub async fn get_scoped_token(
+    app_id: u64,
+    private_key_pem: &str,
+    installation_id: u64,
+    repo_name: &str,
+    role: TokenRole,
+) -> Result<String> {
+    get_scoped_token_with_base_url(
         DEFAULT_API_BASE_URL,
         app_id,
         private_key_pem,
         installation_id,
+        repo_name,
+        role,
     )
     .await
 }
 
-pub async fn get_token_with_base_url(
+pub async fn get_scoped_token_with_base_url(
     api_base_url: &str,
     app_id: u64,
     private_key_pem: &str,
     installation_id: u64,
+    repo_name: &str,
+    role: TokenRole,
 ) -> Result<String> {
-    tracing::info!(installation_id, "generating installation access token");
+    tracing::info!(
+        installation_id,
+        ?role,
+        "generating scoped installation access token"
+    );
     let jwt = app_jwt(app_id, private_key_pem)?;
     let client = client()?;
     let response = send_json(
         &client,
         api_base_url,
         &jwt,
-        access_token_request(installation_id),
+        scoped_access_token_request(installation_id, repo_name, role),
     )
     .await?;
     let body: TokenResponse = response.json().await?;
@@ -70,26 +121,77 @@ fn jwt_claims(app_id: u64, now: u64) -> JwtClaims {
     }
 }
 
-fn access_token_request(installation_id: u64) -> GitHubRequest {
+fn scoped_access_token_request(
+    installation_id: u64,
+    repo_name: &str,
+    role: TokenRole,
+) -> GitHubRequest {
     GitHubRequest {
         method: "POST",
         path: format!("/app/installations/{installation_id}/access_tokens"),
-        body: serde_json::json!({}),
+        // `repositories` takes bare repo names (not owner/name). Requesting a
+        // permission the App was not installed with fails with 422; the App
+        // manifest grants contents/checks/issues/pull_requests, all superset.
+        body: serde_json::json!({
+            "repositories": [repo_name],
+            "permissions": role.permissions(),
+        }),
     }
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
 
+    use serde_json::json;
+
     #[test]
-    fn access_token_request_targets_installation_endpoint() {
-        let request = access_token_request(12345);
+    fn scoped_token_request_targets_installation_endpoint() {
+        let request = scoped_access_token_request(12345, "coven-code", TokenRole::Orchestration);
 
         assert_eq!(request.method, "POST");
         assert_eq!(request.path, "/app/installations/12345/access_tokens");
     }
 
+    #[test]
+    fn agent_git_scope_grants_contents_write_only() {
+        let request = scoped_access_token_request(1, "coven-code", TokenRole::AgentGit);
+
+        assert_eq!(request.body["repositories"], json!(["coven-code"]));
+        assert_eq!(request.body["permissions"], json!({ "contents": "write" }));
+    }
+
+    #[test]
+    fn orchestration_scope_cannot_write_contents_or_pulls() {
+        let request = scoped_access_token_request(1, "coven-code", TokenRole::Orchestration);
+
+        assert_eq!(request.body["repositories"], json!(["coven-code"]));
+        assert_eq!(
+            request.body["permissions"],
+            json!({
+                "contents": "read",
+                "checks": "write",
+                "issues": "write",
+                "pull_requests": "read",
+            })
+        );
+    }
+
+    #[test]
+    fn publication_scope_grants_pr_write_without_checks_or_contents_write() {
+        let request = scoped_access_token_request(1, "coven-code", TokenRole::Publication);
+
+        assert_eq!(request.body["repositories"], json!(["coven-code"]));
+        assert_eq!(
+            request.body["permissions"],
+            json!({
+                "contents": "read",
+                "issues": "write",
+                "pull_requests": "write",
+            })
+        );
+    }
+
     #[test]
     fn jwt_claims_use_app_id_as_issuer_and_short_expiry() {
         let now = 1_700_000_000;

crates/github/src/installation.rs

@@ -13,3 +13,6 @@ tracing.workspace = true
 uuid.workspace = true
 coven-github-api = { path = "../github" }
 coven-github-config = { path = "../config" }
+
+[dev-dependencies]
+wiremock.workspace = true