security(authz): grant-ceiling for role create/assign + bearer aud/scope (PACA-3/4, C1)

[phancao]

Summary

Vertical-authorization (RBAC) remediation for Galaxy-Paca. Full report: Galaxy-Nexus/docs/AUTHZ-AUDIT-2026-07-18.md. Conceptual golden pattern: a grant ceiling — a caller must not create or assign a role whose permission set is broader than the caller's own effective permissions.

PACA-3 (CRITICAL) — Global-role self-escalation

globalrole service Create/Update/ReplaceUserRoles never compared the created/assigned role's permissions to the caller's own. Now:

• Create/Update reject any permission the caller does not hold.
• ReplaceUserRoles rejects unless every target role's permission set is a subset of the caller's own effective permissions.
• */SUPER_ADMIN bypasses. Rejections return 403 FORBIDDEN (ErrPermissionCeilingExceeded).
• The caller's effective global permissions are threaded from GlobalRoleHandler (now wired with the authorizer).

PACA-4 (CRITICAL) — Project-role self-escalation via shared PROJECT_OWNER template

project member service AddMember/UpdateMemberRoleByMemberID verified only that the target role belonged to the project/was a template. Now they also reject a role whose permissions exceed the caller's project-scoped effective permissions (agent- and user-aware, threaded from the handler).

PACA-C1 (HIGH) — Audience/scope confused-deputy on the trusted-issuer bearer path

• bearer.go now verifies the token with Paca's configured resource audience (GALAXY_BEARER_AUDIENCE) instead of an empty expectedAudience.
• The bearer path now enforces the token scope against the operation: a token that carries resource-family scopes but none for Paca is rejected (foreign-resource / confused deputy), and a read-only (mcp:paca:read) token is denied write methods. Prefix configurable via GALAXY_RESOURCE_SCOPE_PREFIX (default mcp:paca:); the HTTP method is threaded from the GalaxyBearer middleware. Tokens without a scope claim (identity's service/act_as tokens) are unaffected.

Design

Shared ceiling logic added in platform/authz/ceiling.go (PermissionSet, EffectivePermissions, EffectivePermissionsForAgent, PermissionsFromMap); HasPermissions refactored onto the same core so route-guard and ceiling can never diverge. Changes are minimal and fail-closed.

Tests

Fail-before/pass-after unit tests added for PACA-3, PACA-4 (service layer) and PACA-C1 (bearer). Verified the reject-tests fail when the ceiling/scope checks are neutered. One pre-existing integration test (TestIntegrationProjectRolesAndMembers_Flow) encoded the vulnerable behavior (caller assigned tasks.read it didn't hold) and was updated to a legitimately-authorized caller.

go build ./... and go test ./... are green (34 packages).

🤖 Generated with Claude Code

[pullfrog]

Important

Two enforcement gaps should be closed before merge: UpdateMemberRole has no PACA-4 grant-ceiling check, and an empty GALAXY_RESOURCE_SCOPE_PREFIX silently disables PACA-C1 scope enforcement.

Core PACA-3/4 and C1 work is sound — grant ceilings are correctly shared via authz.Ceil/IsCoveredBy, audience enforcement is opt-in, X-Agent-ID impersonation is default-disabled, and go build ./... / go test ./... pass for services/api. Please see the inline comments for the required changes.

Other (non-blocking) observations:

• oidc.Provider.fetchJWKSLocked silently skips malformed JWKS entries and caches an empty keyset; consider logging warnings or failing on an empty JWKS.
• Plugin proxy authentication is intentionally handled inside ProxyRequest, so it correctly bypasses the new Galaxy bearer group middleware.

---

Note: 1 inline comment(s) dropped because they did not anchor to lines inside the PR diff:

• services/api/internal/service/project/project_member_service.go:84 (RIGHT) — line 84 (RIGHT) is not inside a diff hunk

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using Kimi K2 (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

Empty prefix should not be treated as "scope check disabled" when audience enforcement is also optional. A misconfigured deployment can accidentally disable both PACA-C1 audience and scope validation, creating a fail-open path. Please reject an empty GALAXY_RESOURCE_SCOPE_PREFIX at startup when bearer auth is enabled, or return an error here so the scope check fails closed.

[pullfrog]

⚠️ Requested change: UpdateMemberRole lacks PACA-4 grant-ceiling enforcement

My inline review comment on this method was dropped because the line is outside the current diff hunk, so I'm surfacing it here.

In services/api/internal/service/project/project_member_service.go, UpdateMemberRole(ctx, userID, projectID, role) is still part of the MemberService interface but does not take a caller authz.PermissionSet and does not call enforceRoleGrantCeiling(...). The HTTP handler routes to UpdateMemberRoleByMemberID, which is correctly guarded, but the unguarded method remains reachable internal surface.

Please either:

• Add caller authz.PermissionSet to UpdateMemberRole and enforce the same PACA-4 ceiling used by AddMember and UpdateMemberRoleByMemberID, or
• Remove UpdateMemberRole from the service interface if it is no longer used.

This is the remaining blocker alongside the bearer.go:142 fail-open scope issue already noted in the review.

  ^{｜ View workflow run ｜ via Pullfrog ｜ Using Kimi K2 (free via Pullfrog for OSS) ｜ 𝕏}