fix(security): enforce single-trust-domain; block shared credentials in hosted mode (#718)

[frankbria]

What & why

CodeFRAME's credential store is machine-wide (one LLM key set + one GitHub PAT per host), and self-hosted mode had no workspace-owner check. In a multi-tenant deployment every user could view (last-4), overwrite, or delete another's secrets, and — with no WORKSPACE_ROOT — read/write another's workspace.

Fixes #718 [P0.7]. Approach: enforce + document a single-trust-domain model (the AC's sanctioned alternative to a full per-user credential rework; confirmed with the maintainer).

Context — what already existed

Hosted-mode workspace isolation shipped in #655: WORKSPACE_ROOT is mandatory in hosted mode (fails closed if unset) and each user is confined to <root>/<user_id>. This PR closes the credential side + formalizes the model.

Changes

• forbid_shared_credentials_in_hosted_mode() (ui/dependencies.py): credential + GitHub-PAT mutation endpoints fail closed (403) in hosted mode — PUT/DELETE /api/v2/settings/keys/*, POST /connect, DELETE /disconnect. GET status stays readable. Self-hosted (single trust domain) is unaffected.
• owner_user_id persistence (workspace_v2.py): _register_workspace now records auth["user_id"] (was hardcoded None). Defense-in-depth; owner-scoped list/delete enforcement is [P0.9] Owner-scope the workspace registry (list/delete currently unrestricted) #720.
• SECURITY.md: documents the self-hosted single-trust-domain model and the hosted-mode credential block.

Tests (tests/ui/test_hosted_credential_block.py)

Guard unit (hosted→raises, self-hosted→no-op); PUT/DELETE /keys → 403 in hosted, not-hosted-403 in self-hosted; _register_workspace forwards owner_user_id. 124 passed across settings/github/workspace/registry/scope suites. ruff + mypy clean.

Demo (auth-off to isolate the guard; a real hosted tenant is authenticated then hits the same 403)

mode          PUT keys  DELETE keys  GET keys
self_hosted        400          400       200   (allowed; 400 = value format)
hosted             403          403       200   (mutations blocked; read status allowed)

Acceptance criteria

• Deployments intended for >1 user require WORKSPACE_ROOT (fail closed in hosted mode) — shipped in [P7.0.1] Workspace path allowlist — prevent authenticated cross-tenant RCE (M1) #655, documented here
• Workspaces persist owner_user_id from auth["user_id"] (owner-scoped enforcement is [P0.9] Owner-scope the workspace registry (list/delete currently unrestricted) #720)
• Single-trust-domain limitation enforced (hosted-mode credential 403) and documented (SECURITY.md); multi-tenant shared-credential path blocked

Known limitation / follow-up

Per-user credential scoping (so hosted tenants can store their own keys through the API) is deferred to the follow-up issue below.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 30 minutes

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 8ef9b222-ceac-48a4-b43d-fe8a5d123e62

📥 Commits

Reviewing files that changed from the base of the PR and between 00aa25b and 83154b7.

📒 Files selected for processing (6)

• SECURITY.md
• codeframe/ui/dependencies.py
• codeframe/ui/routers/github_integrations_v2.py
• codeframe/ui/routers/settings_v2.py
• codeframe/ui/routers/workspace_v2.py
• tests/ui/test_hosted_credential_block.py

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/p0.7-single-trust-domain

---

_{Comment @coderabbitai help to get the list of available commands.}

[claude]

Code Review — PR #789: Single-trust-domain enforcement (#718)

Overall: Solid, well-scoped security fix. The fail-closed approach is correct, the SECURITY.md documentation is clear, and is_hosted_mode() reads the env var at call time with no caching, so monkeypatch.setenv in tests is reliable. Three things worth addressing:

---

Issues

1. Missing test coverage for GitHub credential endpoints

TestCredentialEndpointHostedBlock tests PUT/DELETE /api/v2/settings/keys/* but has no coverage for POST /connect and DELETE /disconnect, which the PR also guards. Add analogous cases:

def test_connect_blocked_in_hosted_mode(self, monkeypatch):
    monkeypatch.setenv("CODEFRAME_DEPLOYMENT_MODE", "hosted")
    r = self._client().post("/api/v2/integrations/github/connect", json={"pat": "ghp_x", ...})
    assert r.status_code == 403

def test_disconnect_blocked_in_hosted_mode(self, monkeypatch):
    monkeypatch.setenv("CODEFRAME_DEPLOYMENT_MODE", "hosted")
    r = self._client().delete("/api/v2/integrations/github/disconnect")
    assert r.status_code == 403

2. Obscure double-negation assertion

test_store_key_not_hosted_blocked_in_self_hosted passes even if the endpoint returns 500, which is not the intent:

# current - passes on any non-(403 + hosted detail) response, including 500
assert not (r.status_code == 403 and "hosted mode" in r.json().get("detail", "").lower())

# clearer
assert r.status_code != 403, f"Unexpected hosted-mode 403 in self-hosted: {r.json()}"
# or assert r.status_code in {200, 400}  # 400 = value-format rejection

3. Undocumented deferred import

The from codeframe.ui.server import is_hosted_mode inside the function body is a circular-import workaround — correct but non-obvious. A brief comment helps:

def forbid_shared_credentials_in_hosted_mode() -> None:
    # Deferred: codeframe.ui.server imports from dependencies at module level.
    from codeframe.ui.server import is_hosted_mode

---

Confirmed correct (no action needed)

• is_hosted_mode() has no caching — get_deployment_mode() calls os.getenv on every invocation, so monkeypatch.setenv is reliable in tests and runtime mode changes are immediate.
• auth.get("user_id") returning None in dev — require_auth returns {"user_id": None, ...} when auth is disabled; owner_user_id=None in dev is intentional and owner-scoped enforcement is deferred to [P0.9] Owner-scope the workspace registry (list/delete currently unrestricted) #720.
• auth=Depends(require_auth) added to workspace handlers — all v2 routers already have router-level auth from Enforce authentication across the v2 API (routers, WS/SSE, and web-UI login) #336, so this just extracts the cached auth dict with no behavioral change for auth enforcement.
• GET key-status readable in hosted mode — intentional; tenants need to know whether keys are configured.
• Mutation block scope — PUT/DELETE keys + POST connect + DELETE disconnect covers all write paths to the machine-wide credential store.

---

The two test gaps (GitHub PAT endpoints + assertion clarity) are worth fixing before merge. Everything else looks good.

[frankbria]

Thanks — applied all three:

• Add Claude Code GitHub Workflow #1 (GitHub endpoint coverage) ✅ Added test_github_connect_blocked_in_hosted_mode + test_github_disconnect_blocked_in_hosted_mode (both 403 in hosted; the guard fires before allowlist resolution, so no WORKSPACE_ROOT setup needed).
• Brainstorming: Integrate remaining general concepts into specification #2 (double-negation assertion) ✅ Simplified to assert r.status_code != 403 with a message, so a 500 would now fail the test.
• feat(sprint-4): Multi-Agent Coordination System - P0 & P1 Complete #3 (deferred import comment) ✅ Added an inline comment explaining the circular-import workaround.

[claude]

Follow-up review: all previous issues resolved.

The three items from my last review are addressed in the updated diff:

1. GitHub endpoint tests: test_github_connect_blocked_in_hosted_mode and test_github_disconnect_blocked_in_hosted_mode both present; the comment noting the guard fires before WORKSPACE_ROOT allowlist resolution is helpful context.
2. Assertion clarity: simplified to assert r.status_code != 403 with a message; a 500 will now correctly fail the test.
3. Deferred import comment: the inline comment in forbid_shared_credentials_in_hosted_mode makes the circular-import workaround self-documenting.

One optional addition (not blocking):

TestCredentialEndpointHostedBlock covers mutation endpoints in hosted mode, but there is no regression guard ensuring GET endpoints (GET /api/v2/settings/keys, GET /api/v2/integrations/github/status) remain accessible in hosted mode. A small negative test would catch a future accidental Depends(forbid_...) on a read path. Not required before merge; the guard is intentionally read-permissive by omission and that is documented in SECURITY.md.

This is ready to merge. The fail-closed guard is correct, the scope is tight, the documentation is clear, and test coverage now spans all four guarded endpoints.