Add optional Studio identity signing configuration

app/security/middleware.py

@@ -1,6 +1,10 @@
 from __future__ import annotations
 
+import hashlib
+import hmac
+import re
 import time
+from dataclasses import replace
 from typing import Any
 from uuid import uuid4
 
@@ -17,6 +21,7 @@ from app.security.errors import ForbiddenError, RateLimitError, UnauthorizedErro
 from app.security.policy import ScopePolicy
 from app.security.rate_limit import APIKeyRateLimiter, RateLimitLease
 from app.security.service import APIKeyService
+from app.security.scopes import effective_scopes
 
 logger = get_logger(__name__)
 
@@ -54,8 +59,59 @@ class APIKeyAuthenticationMiddleware(BaseHTTPMiddleware):
         bytes_uploaded = self._content_length(request.headers.get("content-length"))
         bytes_downloaded = 0
         try:
+            identity_header_names = (
+                "x-mr-studio-subject", "x-mr-studio-email", "x-mr-studio-name",
+                "x-mr-studio-timestamp", "x-mr-studio-signature",
+            )
+            identity_values = {name: request.headers.get(name) for name in identity_header_names}
+            has_identity_headers = any(value is not None for value in identity_values.values())
+            studio_identity: tuple[str, str, str] | None = None
+            if has_identity_headers:
+                secret = self.settings.studio_identity_secret.get_secret_value() if self.settings.studio_identity_secret else ""
+                if len(secret) < 32 or any(not value for value in identity_values.values()):
+                    raise UnauthorizedError
+                subject = identity_values["x-mr-studio-subject"] or ""
+                email = identity_values["x-mr-studio-email"] or ""
+                name = identity_values["x-mr-studio-name"] or ""
+                timestamp = identity_values["x-mr-studio-timestamp"] or ""
+                supplied_signature = identity_values["x-mr-studio-signature"] or ""
+                if not re.fullmatch(r"[0-9a-fA-F-]{36}", subject):
+                    raise UnauthorizedError
+                try:
+                    issued_at = int(timestamp)
+                except ValueError as exc:
+                    raise UnauthorizedError from exc
+                if abs(int(time.time()) - issued_at) > 60:
+                    raise UnauthorizedError
+                expected_signature = hmac.new(
+                    secret.encode("utf-8"),
+                    "\n".join((timestamp, subject, email, name)).encode("utf-8"),
+                    hashlib.sha256,
+                ).hexdigest()
+                if not hmac.compare_digest(expected_signature, supplied_signature):
+                    raise UnauthorizedError
+                studio_identity = (subject, email, name)
+
             api_key = self._bearer_token(request.headers.get("authorization"))
             context = await self.api_keys.authenticate(api_key)
+            if studio_identity is not None:
+                subject, email, name = studio_identity
+                principal = await self.api_keys.tenants.resolve_studio_identity(
+                    subject=subject, email=email, display_name=name
+                )
+                # The service credential authenticates only the trusted server hop.
+                # End-user scopes are derived from the persisted membership role, never browser input.
+                studio_role = "developer" if principal.membership_role in {"admin", "owner"} else "viewer"
+                context = replace(
+                    context,
+                    key_name=f"Studio user: {email or subject[:8]}",
+                    role=studio_role,
+                    scopes=effective_scopes(studio_role, (), self.settings.auth_role_scopes),
+                    workspace_id=principal.workspace_id,
+                    user_id=principal.user_id,
+                    membership_id=principal.membership_id,
+                    membership_role=principal.membership_role,
+                )
             request.state.auth = context
             context_token = auth_context.set(context)
             required_scope = await self.policy.required_scope(request)

app/security/tenancy.py

@@ -100,6 +100,62 @@ class TenantService:
                 membership_role=membership.role,
             )
 
+    async def resolve_studio_identity(
+        self, *, subject: str, email: str, display_name: str
+    ) -> TenantPrincipal:
+        """Resolve a verified Supabase subject to its own backend workspace."""
+        if not subject or len(subject) > 255:
+            raise UnauthorizedError
+        external_subject = f"supabase:{subject}"
+        async with self.database.session() as session:
+            user = await session.scalar(select(User).where(User.subject == external_subject))
+            if user is not None:
+                if user.status != "active":
+                    raise ForbiddenError
+                membership = await session.scalar(
+                    select(WorkspaceMembership).where(
+                        WorkspaceMembership.user_id == user.id,
+                        WorkspaceMembership.status == "active",
+                    ).order_by(WorkspaceMembership.created_at.asc())
+                )
+                if membership is None:
+                    raise ForbiddenError
+                workspace = await session.get(Workspace, membership.workspace_id)
+                if workspace is None or workspace.status != "active":
+                    raise ForbiddenError
+                return TenantPrincipal(workspace.id, user.id, membership.id, membership.role)
+
+            user_id, workspace_id, membership_id = str(uuid4()), str(uuid4()), str(uuid4())
+            safe_name = (display_name or email or "Studio user").strip()[:255] or "Studio user"
+            user = User(id=user_id, subject=external_subject, display_name=safe_name,
+                        metadata_json={"identity_provider": "supabase"})
+            workspace = Workspace(id=workspace_id, slug=f"studio-{user_id.replace('-', '')}",
+                                  name=f"{safe_name}'s workspace"[:255],
+                                  metadata_json={"provisioned_from": "studio_auth"})
+            membership = WorkspaceMembership(id=membership_id, workspace_id=workspace_id,
+                                             user_id=user_id, role="admin", status="active")
+            session.add_all([user, workspace, membership])
+            try:
+                await session.commit()
+            except IntegrityError:
+                await session.rollback()
+                user = await session.scalar(select(User).where(User.subject == external_subject))
+                if user is None or user.status != "active":
+                    raise
+                membership = await session.scalar(
+                    select(WorkspaceMembership).where(
+                        WorkspaceMembership.user_id == user.id,
+                        WorkspaceMembership.status == "active",
+                    ).order_by(WorkspaceMembership.created_at.asc())
+                )
+                if membership is None:
+                    raise ForbiddenError
+                workspace = await session.get(Workspace, membership.workspace_id)
+                if workspace is None or workspace.status != "active":
+                    raise ForbiddenError
+                return TenantPrincipal(workspace.id, user.id, membership.id, membership.role)
+            return TenantPrincipal(workspace_id, user_id, membership_id, "admin")
+
     async def bind_api_key(
         self, *, api_key_id: str, workspace_id: str, user_id: str
     ) -> TenantPrincipal: