fix(connectors): stop granting act-as-artist authority off the flat account_artist_ids roster edge (P0b)

Merged
SW
3mo ago
+239-47

Summary

P0b interim cut per the decision callout in https://github.com/recoupable/chat/issues/1860 (sweetman, 2026-07-08): connector paths no longer treat a bare account_artist_ids roster row as act-as-artist authority. Two accounts that both roster canonical artist A can no longer use each other's OAuth connectors for A.

What changed

  • New lib/composio/checkConnectorAuthority.ts — connector-scoped authority check. Grants on: self, RECOUP_ORG staff (admin bypass, kept), org co-membership with the target artist, workspace ownership, or membership in a target organization. It never reads the account_artist_ids roster edge. Fails closed on DB errors.
  • Narrowed call sites to the new check (was checkAccountAccess / checkAccountArtistAccess):
    • lib/composio/toolRouter/getComposioTools.ts (artist tool branch)
    • lib/composio/connectors/validateAuthorizeConnectorRequest.ts
    • lib/composio/connectors/validateExecuteConnectorActionRequest.ts (the account_id override on POST /api/connectors/actions)
    • lib/composio/connectors/validateDisconnectConnectorRequest.ts
  • Unchanged by design (scope constraint from the issue): checkAccountArtistAccess still honors the roster edge — read/analytics paths (posts, fans, socials, artist update/delete, YouTube revenue MCP tool) keep working. Connector read paths (GET /api/connectors, GET /api/connectors/actions listing) also keep the flat check per the issue's authorize/execute/disconnect scope.

Verification

  • TDD: new + updated tests written first and confirmed RED (module missing / old mocks), then implemented to GREEN.
  • pnpm exec vitest run lib/composio lib/artists: 51 files, 272 tests, all passing (includes 8 new tests in lib/composio/__tests__/checkConnectorAuthority.test.ts covering self, roster-only denial, org co-membership, RECOUP_ORG bypass, workspace, org target, and both fail-closed paths).
  • pnpm exec tsc --noEmit: 200 pre-existing errors on this branch and on main baseline (all in unrelated __tests__ files); zero errors introduced by this change.

Preview verification pending — tracked in chat#1860.

🤖 Generated with Claude Code

Summary by cubic

Connector actions and artist tool exposure no longer treat a bare account_artist_ids roster row as act-as-artist authority. Managers who only share a rostered artist can’t use each other’s OAuth connectors for that artist.

  • Bug Fixes
    • Added lib/composio/checkConnectorAuthority.ts to enforce connector authority; fails closed on DB errors.
    • Authority grants only for: self, RECOUP_ORG staff, shared org with the target artist, caller’s workspace, or caller’s organization.
    • Updated call sites to use the new check: validateAuthorizeConnectorRequest, validateExecuteConnectorActionRequest, validateDisconnectConnectorRequest, and getComposioTools (artist branch).
    • Kept checkAccountArtistAccess for read/analytics and connector listings; roster-based access still applies there.