feat(proxy): bind static credentials to provider endpoints by johntmyers · Pull Request #2510 · NVIDIA/OpenShell

johntmyers · 2026-07-28T02:26:40Z

Summary

Bind static provider credentials to profile-authorized host, port, and path selectors so placeholders cannot be resolved at other policy-allowed endpoints. This is a focused, stacked extension of the proxy refactor in #2373 and preserves dynamic credential behavior.

Related Issue

Design: #2155
Stacked on: #2373

Changes

negotiate endpoint-binding capability and send non-secret binding metadata to compatible supervisors
install and revoke endpoint-scoped static credentials atomically while preserving dynamic credentials
enforce credential scope across CONNECT, forward-proxy, L7 HTTP, and WebSocket paths with fail-closed denial and OCSF reporting
document the security boundary and update provider workflow guidance
add endpoint-isolation e2e coverage and make existing credential fixtures use valid bound profiles

Testing

Checklist

Follows Conventional Commits
Commits are signed off (DCO)
Architecture docs updated

Signed-off-by: John Myers <johntmyers@users.noreply.github.com>

copy-pr-bot · 2026-07-28T02:26:43Z

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

github-actions · 2026-07-28T02:27:07Z

🌿 Preview your docs: https://nvidia-preview-pr-2510.docs.buildwithfern.com/openshell

johntmyers · 2026-07-28T02:27:38Z

/ok to test 6d36f25

github-actions · 2026-07-28T02:27:46Z

Label test:e2e applied for 6d36f25. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

Signed-off-by: John Myers <johntmyers@users.noreply.github.com>

johntmyers · 2026-07-28T02:36:11Z

/ok to test e2b271a

Signed-off-by: John Myers <johntmyers@users.noreply.github.com>

johntmyers · 2026-07-28T02:44:04Z

/ok to test 6231d64

Signed-off-by: John Myers <johntmyers@users.noreply.github.com>

johntmyers · 2026-07-28T15:08:03Z

/ok to test 94491fe

johntmyers

gator-agent

PR Review Status

Validation: Project-valid security hardening authored by a maintainer, following RFC #2155 and stacked on proxy refactor #2373.
Head SHA: 94491febb429bc4bff1d801abdef2386239d96d8

Review findings:

Four blocking authorization/lifecycle flaws are anchored inline.
One high-severity dynamic-credential lifecycle flaw and one medium-severity adapter-parity flaw are anchored inline.
General medium finding: forward-proxy telemetry still receives the original request path. Without L7 this can expose query strings, placeholder syntax, and environment-key names, contrary to the documented OCSF boundary. Construct a syntax-only redacted target before all forward telemetry, omit queries, and add allowed/denied/malformed-request log assertions.

Docs: Fern coverage is extensive and the affected pages are auto-indexed, so no navigation update is needed. The current text promises canonical path matching, immediate detach revocation, preserved dynamic credentials, and adapter-parity reporting; those claims are not accurate until the findings are resolved.

Checks: Required branch, Helm, DCO, and E2E gates are green. The required test:e2e label and current-head /ok to test are already present.

Next state: gator:in-review pending author changes.

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

johntmyers · 2026-07-28T19:17:30Z

Addressed the general forward-telemetry finding in 59b7c13. Allowed and denied events now receive a query-free, syntax-redacted canonical path, while malformed targets use a fixed sentinel. Regression coverage serializes allowed, denied, and malformed OCSF events and asserts that query values, placeholder syntax, and environment-key names are absent.

johntmyers

gator-agent

PR Review Status

Validation: Project-valid security hardening authored by a maintainer, following RFC #2155 and stacked on proxy refactor #2373.
Head SHA: 59b7c13f00bbe696c71df6100d1ce281aa2a9f71

Thanks @johntmyers. I checked your current-head remediation notes against the full diff. The canonical target boundary, live-state authority, provider identity, dynamic-snapshot preservation, and typed body/SigV4 denial changes resolve six prior findings. The forward-telemetry finding remains incomplete for no-path absolute URIs, and the independent review found one additional WebSocket fail-closed edge plus two documentation inaccuracies.

Review findings:

Four actionable findings are anchored inline.
No unanchored general findings.

Docs: Fern pages and related skills were updated, and docs/index.yml navigation does not need a change. Two statements still need correction as noted inline.

Checks: Code-only review; no local tests were run. The required test:e2e label is already present. Pipeline progression remains gated on author changes.

Next state: gator:in-review pending author changes.

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

johntmyers

gator-agent

PR Review Status

Validation: Project-valid credential security hardening authored by a maintainer, following design #2155 and stacked on proxy refactor #2373.
Head SHA: 44ba6839f994dfe5855cfe9c2cc17cb3b3176a4b

Thanks @johntmyers. I checked your current-head replies against the full diff. The absolute-URI telemetry fix, fail-closed WebSocket relay selection, gateway dynamic-snapshot wording, and HTTP-versus-WebSocket failure documentation resolve all four findings from the prior head.

Review findings:

Critical — CWE-284: Provider environment revisioning hashes the catalog's effective profile, while credential binding resolution selects a profile using provider.profile_workspace. When a workspace override and platform fallback share an ID, narrowing the platform profile can leave provider_env_revision unchanged and let a supervisor retain an obsolete broader binding. Hash the exact scoped profile selected by get_provider_type_profile_for_scope(), including its scope, and add a platform-scoped-provider regression beneath a same-ID workspace override. Relevant code: crates/openshell-server/src/grpc/policy.rs:1611 and crates/openshell-server/src/provider_profile_sources.rs:437,470.
Two actionable warnings are anchored inline.
Warning — agent guidance: The sync-agent-infra maintenance map routes provider and direct-inference behavior changes to debug-inference, but that skill still diagnoses direct external denials only as missing policy/provider attachment. Add credential_endpoint_mismatch guidance that checks profile endpoints and warns against widening sandbox policy unless the profile intentionally authorizes the recipient.

Docs: Fern pages are updated and already navigated, so no navigation change is needed. One architecture statement remains inaccurate as noted inline.

Checks: Code-only review; no local tests were run. test:e2e is already applied and the current E2E run is pending. No additional /ok to test action is needed in this cycle.

Next state: gator:in-review pending author changes.

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

johntmyers · 2026-07-28T23:11:40Z

Addressed the two unanchored findings from review 4802466107:

b92f7696 hashes the exact provider profile selected by profile_workspace, including its scope and the platform fallback beneath a same-ID workspace override. Regressions cover broad-to-narrow platform endpoint changes and verify workspace-scoped providers remain keyed to the workspace override.
42a454bb adds credential_endpoint_mismatch diagnosis to debug-inference, including profile endpoint inspection and an explicit warning not to widen sandbox policy as a workaround. The sync-agent-infra maintenance map and companion openshell-cli guidance were checked.

Validation: 1,116 gateway tests and 1,074 network tests passed; pre-commit passed.

johntmyers

gator-agent

PR Review Status

Validation: Project-valid credential security hardening authored by a maintainer, following design #2155 and stacked on proxy refactor #2373.
Head SHA: 42a454bb4143e672fa57f3daa0e0ee34eab11131

Thanks @johntmyers. I checked your current-head remediation notes against the full diff. The exact scoped-profile revision hash and its fallback/override regressions resolve the prior critical finding. The new credential_endpoint_mismatch guidance correctly warns against widening policy, but its inspection command is incomplete. The independent review also found two remaining single-route adapter-parity gaps after the request-admission ordering fix.

Review findings:

Three actionable warnings are anchored inline.
No unanchored general findings.

Docs: Fern coverage is extensive and the affected pages are already navigated, so no docs/index.yml change is needed. The documented HTTP 403 and OCSF behavior remains inaccurate for single-config JSON-RPC/MCP and GraphQL until the two relay findings are resolved.

Checks: Code-only review; no local tests were run. test:e2e is already applied and the current-head E2E run is pending. No additional /ok to test action is needed in this cycle.

Next state: gator:in-review pending author changes.

johntmyers · 2026-07-28T23:35:15Z


        let req = parsed.request;
        let jsonrpc_info = parsed.info;
+        let scoped_ctx = scoped_context_for_request(ctx, &req.target);


gator-agent

Warning — CWE-532/CWE-778: This scopes credentials, but the single-config JSON-RPC/MCP branch still logs req.target without credential redaction and propagates resolver failures directly. Use redact_target_for_policy, then route the post-policy relay through relay_http_request_with_credential_rejection so mismatches return the typed 403 and emit both OCSF events. Please add single-config JSON-RPC/MCP regressions.

johntmyers · 2026-07-28T23:35:15Z


        let req = parsed.request;
        let graphql_info = parsed.info;
+        let scoped_ctx = scoped_context_for_request(ctx, &req.target);


gator-agent

Warning — CWE-778: The single-config GraphQL relay still propagates scoped resolver failures directly, so endpoint mismatches close the connection without the documented 403 or OCSF finding. Use relay_http_request_with_credential_rejection after policy admission, matching REST and route-selected handling, and add a regression for this branch.

johntmyers · 2026-07-28T23:35:15Z


+If the response reports `credential_endpoint_mismatch`, the provider is attached
+but its credential profile does not authorize that request recipient. Inspect
+`openshell provider get <provider-name>` and compare the profile's endpoint host,


gator-agent

Warning — troubleshooting guidance: provider get does not display profile endpoints or the selected profile scope. Have the workflow use it to identify the provider type, then run openshell provider profile export <type> -o yaml with the appropriate workspace/platform scope before comparing host, port, and path.

johntmyers added 4 commits July 27, 2026 19:04

feat(proxy): bind static credentials to provider endpoints

893be80

Signed-off-by: John Myers <johntmyers@users.noreply.github.com>

test(e2e): verify static credential endpoint isolation

ea56878

Signed-off-by: John Myers <johntmyers@users.noreply.github.com>

docs(provider): explain static credential endpoint binding

30b8736

Signed-off-by: John Myers <johntmyers@users.noreply.github.com>

fix(e2e): use valid endpoint isolation fixtures

6d36f25

Signed-off-by: John Myers <johntmyers@users.noreply.github.com>

johntmyers added the test:e2e Requires end-to-end coverage label Jul 28, 2026

test(proxy): stabilize OCSF compatibility capture

e2b271a

Signed-off-by: John Myers <johntmyers@users.noreply.github.com>

test(proxy): avoid global tracing capture race

6231d64

Signed-off-by: John Myers <johntmyers@users.noreply.github.com>

docs(provider): explain static credential endpoint binding

94491fe

Signed-off-by: John Myers <johntmyers@users.noreply.github.com>

johntmyers marked this pull request as ready for review July 28, 2026 16:08

johntmyers requested review from a team, derekwaynecarr, maxamillion and mrunalp as code owners July 28, 2026 16:08

johntmyers commented Jul 28, 2026

View reviewed changes

johntmyers added the gator:in-review Gator is reviewing or awaiting PR review feedback label Jul 28, 2026

johntmyers added 2 commits July 28, 2026 12:15

fix(credentials): preserve binding identity across rotations

131b261

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

fix(proxy): enforce bindings across request lifecycle

59b7c13

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

johntmyers commented Jul 28, 2026

View reviewed changes

Comment thread crates/openshell-supervisor-network/src/proxy.rs

Comment thread crates/openshell-supervisor-network/src/l7/relay.rs

Comment thread architecture/gateway.md Outdated

Comment thread docs/sandboxes/providers-v2.mdx Outdated

johntmyers mentioned this pull request Jul 28, 2026

fix(supervisor-network): redact FORWARD query strings in OCSF and denials #2531

Closed

6 tasks

johntmyers added 2 commits July 28, 2026 15:28

fix(proxy): close credential relay gaps

62d3c21

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

docs(credentials): clarify binding failure behavior

44ba683

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

johntmyers commented Jul 28, 2026

View reviewed changes

Comment thread crates/openshell-supervisor-network/src/l7/relay.rs Outdated

Comment thread architecture/sandbox.md Outdated

johntmyers added 3 commits July 28, 2026 16:09

fix(credentials): hash selected provider profile scope

b92f769

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

fix(proxy): resolve credentials after request admission

348859f

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

docs(credentials): clarify binding failure diagnostics

42a454b

Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>

johntmyers commented Jul 28, 2026

View reviewed changes

Uh oh!

Conversation

johntmyers commented Jul 28, 2026

Summary

Related Issue

Changes

Testing

Checklist

Uh oh!

copy-pr-bot Bot commented Jul 28, 2026

Uh oh!

github-actions Bot commented Jul 28, 2026

Uh oh!

johntmyers commented Jul 28, 2026

Uh oh!

github-actions Bot commented Jul 28, 2026

Uh oh!

johntmyers commented Jul 28, 2026

Uh oh!

johntmyers commented Jul 28, 2026

Uh oh!

johntmyers commented Jul 28, 2026

Uh oh!

johntmyers left a comment

Choose a reason for hiding this comment

PR Review Status

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

johntmyers commented Jul 28, 2026

Uh oh!

johntmyers left a comment

Choose a reason for hiding this comment

PR Review Status

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

johntmyers left a comment

Choose a reason for hiding this comment

PR Review Status

Uh oh!

Uh oh!

Uh oh!

johntmyers commented Jul 28, 2026

Uh oh!

johntmyers left a comment

Choose a reason for hiding this comment

PR Review Status

Uh oh!

johntmyers Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

johntmyers Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

johntmyers Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant