Skip to main content
← Back to list
01Issue
BugShippedSwamp CLIPublic
Assigneesstack72

Relationships

#1875 serve: access check --server evaluates the target subject with the caller's IdP groups/collectives

Opened by stack72 · 8/27/2026· Shipped 8/27/2026

Summary

swamp access check --server parses the target --subject from the payload but evaluates idp-group and collectives context from the calling admin's own connection, not the target subject. Checking any stranger against an idp-group: grant reports ALLOW whenever the caller happens to hold that group — the explain tool answers about the wrong identity.

Steps to reproduce

Serve in oauth mode with a grant idp-group:platform-eng → allow run on workflow:*. Admin logs in via device flow with userinfo groups: ["platform-eng"], then:

swamp access check --subject user:total-stranger --action run --on workflow:anything --server <url>

Actual

ALLOW via grant … (exit 0) — user:total-stranger has no grants, no groups, and has never connected; the verdict reflects the admin's groups.

Expected

DENY (implicit) for the stranger. If per-subject IdP context is unavailable server-side, the honest options are to evaluate with empty groups for a foreign subject or to reject the query with a clear message — not to substitute the caller's identity.

Root cause pointer

src/serve/handlers/access_handlers.ts handleAccessCheck (~L392-400): the target subject comes from the payload while collectives/groups are read off the calling connection (shared.ts connection context). The CLI already blocks --groups/--collectives with --server ("the server uses the IdP groups from your authenticated token") — which is exactly the behavior that is wrong for a --subject other than the caller.

Impact

The one tool an operator has to audit another user's effective access gives false ALLOWs whenever the auditing admin is in privileged IdP groups — which admins usually are. Pinned as a characterization test in swamp-uat (tests/cli/serve/access/idp_test.ts, GRANTS-TEST-PLAN.md §9#2); the test flips to DENY when this is fixed.

Environment

swamp 20260826.235928.0-sha.da5373d1, serve oauth mode against the UAT stub club; reproduced deterministically in the grants UAT suite.

02Bog Flow
✓OPEN✓TRIAGED✓IN PROGRESS✓SHIPPED+ 1 MOREASSIGNED+ 5 MOREREVIEW+ 7 MOREPR_MERGED+ 2 MORESESSION_SUMMARIZED

Shipped

8/27/2026, 8:10:47 PM

Click a lifecycle step above to view its details.

03Sludge Pulse
stack72 assigned stack728/27/2026, 7:03:22 PM

Sign in to post a ripple.