fix(linear): authorize comment triggers before acting (review MEDIUM security)

The issue→task path gated on lookupPlatformUser; the comment path did NOT. Any
workspace member or guest who could post @bgagent could approve/reject plans,
drive plan commands, and start code-pushing agent runs — all attributed to and
BILLED against the original requester. handleCommentTrigger now resolves the
commenter (payload.actor.id) to a platform user BEFORE any verdict/command/
dispatch; an unmapped commenter gets a ❓ reaction + a one-line 'link your
account first' reply and the trigger is refused. The near-miss-mention nudge
stays ahead of the gate (a nudge is not a privileged action); an app-actor
commenter is correctly unmapped (the app can't self-authorize).

Tests: unmapped-commenter-blocked regression + updated the shared ddbSend mocks
to return a mapped commenter (linear_identity Get) so the actionable paths pass.
cdk typecheck + 86 comment-path tests green.

Author: isadeks

cdk/src/handlers/linear-webhook-processor.ts

@@ -1450,6 +1450,35 @@ async function handleCommentTrigger(payload: LinearCommentEvent): Promise<void>
   // actual comment the human wrote (reactions work at any thread depth).
   const replyTargetId = payload.data.parentId ?? commentId;
 
+  // AUTHORIZATION (review MEDIUM): the issue→task path gates on lookupPlatformUser
+  // (a Linear actor with no linked ABCA user can't create tasks). The COMMENT
+  // path did NOT — so ANY workspace member or guest who can post @bgagent could
+  // approve/reject plans, drive plan commands, and START code-pushing agent runs,
+  // all attributed to and BILLED against the original requester. Resolve the
+  // commenter to a platform user BEFORE any verdict/command/dispatch. Unmapped →
+  // ❓ + a one-line reply, then stop. (The bot's own comments never carry the
+  // mention token, so they don't reach here; and an app-actor commenter is
+  // likewise unmapped, which is correct — the app can't authorize itself.)
+  const commenterId = payload.actor?.id;
+  const commenterPlatformUserId = commenterId
+    ? await lookupPlatformUser(workspaceId, commenterId)
+    : null;
+  if (!commenterPlatformUserId) {
+    logger.warn('A6 comment: commenter has no linked platform user — refusing to act on the trigger', {
+      linear_workspace_id: workspaceId, linear_user_id: commenterId, linear_issue_id: commentedIssueId,
+    });
+    const feedbackCtx = { linearWorkspaceId: workspaceId, registryTableName: WORKSPACE_REGISTRY_TABLE };
+    await reactToComment(feedbackCtx, commentId, EMOJI_NEEDS_INPUT);
+    try {
+      await upsertThreadedReply(
+        feedbackCtx, commentedIssueId, replyTargetId,
+        'I can only act on `@bgagent` requests from a linked ABCA user. Link your Linear '
+          + 'account first (ask your ABCA admin / run `bgagent linear link`), then re-comment.',
+      );
+    } catch { /* best-effort reply */ }
+    return;
+  }
+
   // #299 Mode B: a comment on a parent that has a PENDING plan (proposed but not
   // yet executed). Checked BEFORE A6 routing because NO orchestration is seeded
   // yet — the parent has only a pending-plan row, so loadOrchestration misses it.

cdk/test/handlers/linear-webhook-processor-orchestration.test.ts

@@ -450,6 +450,12 @@ describe('linear-webhook-processor — #247 A6 comment trigger', () => {
         return { Items: opts.standalone ? [opts.standalone] : [] }; // resolveTaskByLinearIssue
       }
       if (cmd._type === 'Query') return { Items: [meta, child] }; // loadOrchestration
+      // Comment-trigger authorization: lookupPlatformUser Gets the user-mapping
+      // row keyed on linear_identity. Return a mapped commenter so the auth gate
+      // passes (the un-mapped case is covered by its own dedicated test).
+      if (cmd._type === 'Get' && (cmd.input.Key as { linear_identity?: string })?.linear_identity) {
+        return { Item: { platform_user_id: 'commenter-user', status: 'active' } };
+      }
       if (cmd._type === 'Get') return { Item: opts.prUrl ? { pr_url: opts.prUrl } : {} };
       return {};
     });
@@ -462,6 +468,10 @@ describe('linear-webhook-processor — #247 A6 comment trigger', () => {
       if (cmd._type === 'Query' && cmd.input.IndexName === 'LinearIssueIndex') {
         return { Items: standalone ? [standalone] : [] };
       }
+      // Comment-trigger authorization: the commenter resolves to a mapped user.
+      if (cmd._type === 'Get' && (cmd.input.Key as { linear_identity?: string })?.linear_identity) {
+        return { Item: { platform_user_id: 'commenter-user', status: 'active' } };
+      }
       return {};
     });
   }
@@ -562,6 +572,23 @@ describe('linear-webhook-processor — #247 A6 comment trigger', () => {
     expect(createTaskCoreMock).not.toHaveBeenCalled();
   });
 
+  test('review AUTH: an UNMAPPED commenter cannot drive a dispatch (❓ + reply, no task)', async () => {
+    // Even with a fully actionable iteration target, a commenter with NO linked
+    // platform user must not be able to start a code-pushing run billed to the
+    // requester. The mapping Get returns nothing → the gate blocks before dispatch.
+    fetchIssueParentIdMock.mockResolvedValue(null);
+    ddbSend.mockImplementation(async (cmd: { _type: string; input: Record<string, unknown> }) => {
+      if (cmd._type === 'Query' && cmd.input.IndexName === 'LinearIssueIndex') {
+        return { Items: [{ task_id: 'task-solo', user_id: 'u-solo', repo: 'o/r', pr_number: 99 }] };
+      }
+      // No user-mapping row for the commenter (linear_identity Get → empty).
+      return {};
+    });
+    await handler(eventWith(comment()));
+    expect(createTaskCoreMock).not.toHaveBeenCalled(); // blocked by auth
+    expect(reactToCommentMock).toHaveBeenCalledWith(expect.anything(), 'comment-1', 'question');
+  });
+
   test('bare @bgagent (no text) → falls back to a generic iteration instruction', async () => {
     mockOrchWithChild({ subIssueId: 'sub-issue-1', childTaskId: 'task-sub-1', prUrl: 'https://github.com/o/r/pull/7' });
     await handler(eventWith(comment({ data: { id: 'c3', body: '@bgagent', issueId: 'sub-issue-1' } })));
@@ -721,7 +748,9 @@ describe('linear-webhook-processor — #247 A6 comment trigger', () => {
         if (cmd._type === 'Query' && cmd.input.IndexName === 'LinearIssueIndex') return { Items: [] };
         if (cmd._type === 'Query') return { Items: [meta, footer, news] }; // loadOrchestration (parent's own)
         if (cmd._type === 'Get') {
-          const key = cmd.input.Key as { task_id?: string; sub_issue_id?: string };
+          const key = cmd.input.Key as { task_id?: string; sub_issue_id?: string; linear_identity?: string };
+          // Comment-trigger authorization: mapped commenter (auth gate passes).
+          if (key.linear_identity) return { Item: { platform_user_id: 'commenter-user', status: 'active' } };
           // Mode B getPendingPlan Get is keyed on the #pending-plan SK — no plan
           // on this epic, so return no item (matches prod; a verdict-shaped
           // comment like "ship it" then falls through to the A6 no-match path).