feat(tenancy): harden shared cloud runtime boundaries

tests/unit_tests/api/http/test_internal_error_responses.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import contextlib
 from types import SimpleNamespace
 from unittest.mock import AsyncMock, Mock
 
@@ -101,6 +102,60 @@ async def test_public_webhook_error_uses_same_generic_error_contract():
     assert 'do-not-return' not in (await response.get_data(as_text=True))
 
 
+async def test_public_webhook_carries_scope_without_holding_database_session():
+    class ScopeOnlyPersistenceManager:
+        mode = SimpleNamespace(value='cloud_runtime')
+
+        def __init__(self):
+            self.active_workspace = None
+
+        @contextlib.asynccontextmanager
+        async def tenant_scope(self, workspace_uuid):
+            self.active_workspace = workspace_uuid
+            try:
+                yield
+            finally:
+                self.active_workspace = None
+
+        def current_session(self):
+            return None
+
+    persistence_mgr = ScopeOnlyPersistenceManager()
+    workspace_uuid = '00000000-0000-0000-0000-00000000000a'
+    bot_uuid = '11111111-1111-4111-8111-111111111111'
+
+    class Adapter:
+        async def handle_unified_webhook(self, **_kwargs):
+            assert persistence_mgr.active_workspace == workspace_uuid
+            assert persistence_mgr.current_session() is None
+            return {'ok': True}
+
+    async def get_execution_binding(resolved_workspace_uuid, expected_generation=None):
+        assert resolved_workspace_uuid == workspace_uuid
+        assert expected_generation == 4
+
+    runtime_bot = SimpleNamespace(
+        workspace_uuid=workspace_uuid,
+        placement_generation=4,
+        enable=True,
+        adapter=Adapter(),
+    )
+    application = SimpleNamespace(
+        logger=Mock(),
+        persistence_mgr=persistence_mgr,
+        platform_mgr=SimpleNamespace(resolve_public_bot=AsyncMock(return_value=runtime_bot)),
+        workspace_service=SimpleNamespace(get_execution_binding=get_execution_binding),
+    )
+    quart_app = quart.Quart(__name__)
+    await WebhookRouterGroup(application, quart_app).initialize()
+
+    response = await quart_app.test_client().post(f'/bots/{bot_uuid}')
+
+    assert response.status_code == 200
+    assert await response.get_json() == {'ok': True}
+    assert persistence_mgr.active_workspace is None
+
+
 async def test_authentication_failure_does_not_return_internal_exception_text():
     logger = Mock()
     application = SimpleNamespace(

tests/unit_tests/api/http/test_route_tenant_scope.py

@@ -0,0 +1,73 @@
+from __future__ import annotations
+
+import asyncio
+from types import SimpleNamespace
+from unittest.mock import AsyncMock, Mock
+
+import pytest
+import quart
+from sqlalchemy.ext.asyncio import create_async_engine
+
+from langbot.pkg.api.http.controller import group
+from langbot.pkg.persistence.mgr import PersistenceManager, PersistenceMode
+
+
+pytestmark = pytest.mark.asyncio
+
+
+async def test_authenticated_route_does_not_hold_database_session_during_external_wait():
+    entered = asyncio.Event()
+    release = asyncio.Event()
+    observations: list[bool] = []
+    engine = create_async_engine('sqlite+aiosqlite:///:memory:')
+    persistence = PersistenceManager(object(), mode=PersistenceMode.CLOUD_RUNTIME)
+    persistence.db = SimpleNamespace(get_engine=lambda: engine)
+
+    class BlockingRouter(group.RouterGroup):
+        name = 'blocking-route-test'
+        path = '/blocking-route-test'
+
+        async def initialize(self) -> None:
+            @self.route('', methods=['GET'], auth_type=group.AuthType.USER_TOKEN)
+            async def _():
+                observations.append(persistence.current_session() is None)
+                entered.set()
+                await release.wait()
+                observations.append(persistence.current_session() is None)
+                return self.success(data={})
+
+    account = SimpleNamespace(uuid='account-a', user='owner@example.com')
+    access = SimpleNamespace(
+        execution=SimpleNamespace(instance_uuid='instance-a', placement_generation=1),
+        workspace=SimpleNamespace(uuid='workspace-a'),
+        membership=SimpleNamespace(uuid='membership-a', role='owner', projection_revision=1),
+    )
+    application = SimpleNamespace(
+        persistence_mgr=persistence,
+        deployment=SimpleNamespace(multi_workspace_enabled=False),
+        user_service=SimpleNamespace(get_authenticated_account=AsyncMock(return_value=account)),
+        workspace_collaboration_service=SimpleNamespace(resolve_account_workspace=AsyncMock(return_value=access)),
+        logger=Mock(),
+    )
+    quart_app = quart.Quart(__name__)
+    await BlockingRouter(application, quart_app).initialize()
+    client = quart_app.test_client()
+
+    request = asyncio.create_task(
+        client.get(
+            '/blocking-route-test',
+            headers={'Authorization': 'Bearer token', 'X-Workspace-Id': 'workspace-a'},
+        )
+    )
+    try:
+        await entered.wait()
+        assert observations == [True]
+        release.set()
+        response = await request
+        assert response.status_code == 200
+        assert observations == [True, True]
+    finally:
+        release.set()
+        if not request.done():
+            await request
+        await engine.dispose()