Issue #3608269: Authorize interaction resume by the node assignments, not the doorway; restore instance-scoped return

Frank Mablyrequested to merge
issue/orchestra-3608269:3608269-resume-authz-by-assignment into 1.x

This replaces the fragile scope the link authorization with an assignment-based check, so a bearer capability link can never complete a step that belongs to an operator.

Problem

An interaction step assigned to an operator (a node declaring assignments) is completed through the identity doorway (the task route / inbox), under userCanAct. Previously the only thing stopping a bearer link from completing such a step was scoping the capability link to a single token, so an instance-scoped link that chained onto a later operator step could resume it. That made security depend on how every link was scoped, which is easy to get wrong (and forced a start return link to be token-scoped as a band-aid).

Fix

The base layer now refuses to complete an assigned node through any bearer doorway:

  • InteractionResolver::isAssigned() reads the node's assignments straight from config (no dependency on the module that defines the assignment plugins).
  • InteractionController::signal() refuses to signal an assigned node, even with a valid token.
  • The webform handler refuses to resume an assigned node from a bearer submission (and stores nothing against it).

Because completion is now gated on the assignment, not the link scope, the webform start return link is restored to instance-scoped: an instance-scoped link chaining onto a later operator step is safe, since it shows that step's status but refuses to complete it. The firstParkedTokenId() scoping helper is removed.

Tests

  • InteractionAccessTest::testSignalRefusesAssignedStep (instance- and branch-scoped): signal() refuses an assigned step, the run stays parked and active.
  • InteractionAccessTest::testAssignedStepShowsItsStatusMessage: a bearer link still displays an assigned step's render-only status message.
  • OrchestraInteractionHandlerTest::testAssignedStepNotResumedByBearerSubmission: a bearer webform submission cannot complete an assigned step.

Full interaction + webform + task kernel suites: 61 tests, 634 assertions, green.

Docs

Security notes added to interaction.md and webform.md describing the bearer-cannot-complete-assigned rule.

Merge request reports