Validate signed Studio identity and apply per-user tenant context

app/security/middleware.py

@@ -1,6 +1,10 @@
 from __future__ import annotations
 
+import hashlib
+import hmac
+import re
 import time
+from dataclasses import replace
 from typing import Any
 from uuid import uuid4
 
@@ -17,6 +21,7 @@ from app.security.errors import ForbiddenError, RateLimitError, UnauthorizedErro
 from app.security.policy import ScopePolicy
 from app.security.rate_limit import APIKeyRateLimiter, RateLimitLease
 from app.security.service import APIKeyService
+from app.security.scopes import effective_scopes
 
 logger = get_logger(__name__)
 
@@ -54,8 +59,58 @@ class APIKeyAuthenticationMiddleware(BaseHTTPMiddleware):
         bytes_uploaded = self._content_length(request.headers.get("content-length"))
         bytes_downloaded = 0
         try:
+            identity_header_names = (
+                "x-mr-studio-subject", "x-mr-studio-email", "x-mr-studio-name",
+                "x-mr-studio-timestamp", "x-mr-studio-signature",
+            )
+            identity_values = {name: request.headers.get(name) for name in identity_header_names}
+            has_identity_headers = any(value is not None for value in identity_values.values())
+            studio_identity: tuple[str, str, str] | None = None
+            if has_identity_headers:
+                secret = self.settings.studio_identity_secret.get_secret_value() if self.settings.studio_identity_secret else ""
+                if len(secret) < 32 or any(not value for value in identity_values.values()):
+                    raise UnauthorizedError
+                subject = identity_values["x-mr-studio-subject"] or ""
+                email = identity_values["x-mr-studio-email"] or ""
+                name = identity_values["x-mr-studio-name"] or ""
+                timestamp = identity_values["x-mr-studio-timestamp"] or ""
+                supplied_signature = identity_values["x-mr-studio-signature"] or ""
+                if not re.fullmatch(r"[0-9a-fA-F-]{36}", subject):
+                    raise UnauthorizedError
+                try:
+                    issued_at = int(timestamp)
+                except ValueError as exc:
+                    raise UnauthorizedError from exc
+                if abs(int(time.time()) - issued_at) > 60:
+                    raise UnauthorizedError
+                expected_signature = hmac.new(
+                    secret.encode("utf-8"),
+                    "\\n".join((timestamp, subject, email, name)).encode("utf-8"),
+                    hashlib.sha256,
+                ).hexdigest()
+                if not hmac.compare_digest(expected_signature, supplied_signature):
+                    raise UnauthorizedError
+                studio_identity = (subject, email, name)
+
             api_key = self._bearer_token(request.headers.get("authorization"))
             context = await self.api_keys.authenticate(api_key)
+            if studio_identity is not None:
+                subject, email, name = studio_identity
+                principal = await self.api_keys.tenants.resolve_studio_identity(
+                    subject=subject, email=email, display_name=name
+                )
+                # The service credential authenticates only the trusted server hop.
+                # End-user scopes are narrowed to the developer role.
+                context = replace(
+                    context,
+                    key_name=f"Studio user: {email or subject[:8]}",
+                    role="developer",
+                    scopes=effective_scopes("developer", (), self.settings.auth_role_scopes),
+                    workspace_id=principal.workspace_id,
+                    user_id=principal.user_id,
+                    membership_id=principal.membership_id,
+                    membership_role=principal.membership_role,
+                )
             request.state.auth = context
             context_token = auth_context.set(context)
             required_scope = await self.policy.required_scope(request)