fix(auth): enforce permission scope on config writes

[cristim]

Config writes checked permission verbs but could ignore the granting permission's account, provider, service, or region constraints. This rejects out-of-scope writes before persistence: ladder configuration requires matching account/provider scope, while global and RI-exchange configuration require unrestricted scope.

The request-only strict matcher also bounds constrained admin grants on these paths. Existing account-access checks, key-owner permission intersection, region normalization, and RI-exchange auto-mode authorization remain in force.

Validation:

• Real HTTP, production router/auth adapter, and PostgreSQL regressions reproduced unauthorized 200 responses and persisted changes before the fix. The corrected matrix verifies denials leave data unchanged and permitted writes persist.
• Covers finite ladder scopes, singleton rejection even when finite lists include every current account, constrained admin grants, user-key restrictions, and independent account scope.
• Infrastructure-key acceptance uses a preloaded credential and an HTTP adapter fixture with real PostgreSQL. It verifies zero user-auth calls, not secret loading.
• Local PostgreSQL 17 verification substitutes only the testcontainers bootstrap. Committed integration tests retain the normal container harness.
• Go 1.26.6 race checks, build, pinned golangci-lint 2.10.1, and normal commit hooks passed.
• Independent gpt-6-astra review approved exact commit d1f27a6de6ee71d1d9836a756ed7b1511ffaf662 with no actionable findings. Fresh reviewer PostgreSQL databases passed the production HTTP/auth matrix in 3.823s and the infrastructure-key HTTP/router fixture in 3.683s, both with the race detector. The reviewer used the same disclosed local database bootstrap substitution; no cloud SDK or secret-loading claim is made.

Refs #404. This is part 1 of 3. Marketplace and revoke enforcement remain tracked by #404, which must stay open until both dependent parts land.

Summary by CodeRabbit

• Bug Fixes
  • Configuration updates now enforce stricter permission scopes. Global settings require unrestricted account access, while ladder settings are limited to accounts and providers the caller is authorized to manage.
  • Requests for missing or out-of-scope ladder accounts return the same not-found response; requests with a provider mismatch are rejected.
  • Permission checks now handle constrained scopes more strictly, including when requests omit scope details.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: LeanerCloud/cloud-commitments-platform/.coderabbit.yaml

Review profile: CHILL

Plan: Essentials

Run ID: 052f60e4-2a7f-473c-894f-d9a69c5d7bda

📥 Commits

Reviewing files that changed from the base of the PR and between 616a91f and d1f27a6.

📒 Files selected for processing (9)

• internal/api/handler_config.go
• internal/api/handler_ladder.go
• internal/api/handler_ri_exchange.go
• internal/api/permission_constraints_config_integration_test.go
• internal/api/ri_exchange_automode_gate_test.go
• internal/auth/permission_strict_scope_test.go
• internal/auth/service_group.go
• internal/auth/types.go
• internal/server/permission_constraints_config_integration_test.go

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

---

📝 Walkthrough

Walkthrough

Configuration updates now apply strict-scope permission checks and account-scope rules. The permission matcher evaluates constrained grants more narrowly. Integration tests exercise the updated handlers with varied permissions and account scopes.

Changes

Configuration permission constraints

Layer / File(s)	Summary
Strict-scope permission matching internal/auth/types.go, internal/auth/service_group.go, internal/auth/permission_strict_scope_test.go	PermissionConstraints adds a request-only StrictScope field. Strict matching checks whether account, provider, and service constraints cover the request; tests cover matching behavior and serialization.
Configuration handler scope checks internal/api/handler_config.go, internal/api/handler_ladder.go, internal/api/handler_ri_exchange.go, internal/api/ri_exchange_automode_gate_test.go	Global and RI exchange configuration updates require global-config scope. Ladder updates check account scope, provider, and strict permission constraints scoped to the account and provider. The automode gate test checks strict-scope permissions for the key and its owner.
Configuration HTTP validation internal/api/permission_constraints_config_integration_test.go, internal/server/permission_constraints_config_integration_test.go	Integration tests send configuration update requests and check responses and persisted settings across permission and account-scope cases. The API test also checks that the mock auth service records no calls or usage bookings.

Priority: ⬆️ High

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant Requester
  participant updateConfig
  participant requirePermission
  participant requireGlobalConfigScope
  Requester->>updateConfig: Send configuration update
  updateConfig->>requirePermission: Check update:config
  requirePermission-->>updateConfig: Return authorized session
  updateConfig->>requireGlobalConfigScope: Check session scope
  requireGlobalConfigScope->>requirePermission: Check strict-scope update:config
  requirePermission-->>requireGlobalConfigScope: Return permission result
  requireGlobalConfigScope-->>updateConfig: Return scope result
  updateConfig->>updateConfig: Proceed with update when checks pass

Loading

Merge Risk: ⚪ Minimal · up to d1f27

The configuration writes enforce the intended scope restrictions while preserving key-owner permission intersection. No concrete merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 9 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: enforcing permission scope on configuration writes.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[cristim]

Final gate: independent review and fresh HTTP/auth/PostgreSQL race verification cover d1f27a6; all hosted checks passed, and the automatic review reports no actionable findings. The docstring-percentage warning does not justify adding comments that restate these private helpers; the request-only StrictScope behavior is documented in code, consistent with the project guidance to comment sparingly. This resolves only the config slice. Issue #404 remains open for marketplace and revoke enforcement.