feat: commit OIDC sponsor evidence atomically

Author: kjgbot

packages/server/src/__tests__/sponsor-oidc-binding.test.ts

@@ -10,6 +10,7 @@ import {
   createTestApp,
   createTestRequest,
   generateTestToken,
+  TEST_RS256_PUBLIC_KEY_PEM,
 } from "./test-helpers.js";
 
 const OIDC_KEY_PAIR = crypto.generateKeyPairSync("rsa", { modulusLength: 2048 });
@@ -182,6 +183,47 @@ test("OIDC-bound org accepts verified sponsor proof and records binding evidence
   const stored = await assertJsonResponse<CreatedIdentity>(storedResponse, 200);
   assert.deepEqual(stored.sponsorBinding, identity.sponsorBinding);
 
+  const ledger = await app.storage.DB.prepare(`
+    SELECT entry_type, agent_id, sponsor_id, jti, payload_json, jws
+    FROM attestation_ledger
+    WHERE org_id = ? AND agent_id = ?
+  `).bind(org, identity.id).first<{
+    entry_type: string;
+    agent_id: string;
+    sponsor_id: string;
+    jti: string | null;
+    payload_json: string;
+    jws: string;
+  }>();
+  assert.ok(ledger);
+  assert.equal(ledger.entry_type, "identity.created");
+  assert.equal(ledger.agent_id, identity.id);
+  assert.equal(ledger.sponsor_id, "user_alice");
+  assert.equal(ledger.jti, "idp-session-1");
+  const [encodedHeader, encodedPayload, encodedSignature] = ledger.jws.split(".");
+  assert.ok(encodedHeader && encodedPayload && encodedSignature);
+  const signedPayloadJson = Buffer.from(encodedPayload, "base64url").toString("utf8");
+  assert.equal(signedPayloadJson, ledger.payload_json);
+  assert.deepEqual(JSON.parse(ledger.payload_json), {
+    agentId: identity.id,
+    sponsorId: "user_alice",
+    issuer,
+    subject: "alice",
+    iat: now,
+    jti: "idp-session-1",
+    sponsorBinding: identity.sponsorBinding,
+    ts: identity.createdAt,
+  });
+  assert.equal(
+    crypto.verify(
+      "RSA-SHA256",
+      Buffer.from(`${encodedHeader}.${encodedPayload}`),
+      TEST_RS256_PUBLIC_KEY_PEM,
+      Buffer.from(encodedSignature, "base64url"),
+    ),
+    true,
+  );
+
   const patchResponse = await app.request(
     createTestRequest(
       "PATCH",
@@ -338,3 +380,69 @@ test("malformed sponsor federation configuration fails closed", async () => {
   const body = await assertJsonResponse<{ code: string }>(response, 503);
   assert.equal(body.code, "sponsor_binding_misconfigured");
 });
+
+test("OIDC-bound identity creation rolls back when the signed ledger append fails", async (t) => {
+  const { issuer } = await startOidcFixture(t);
+  const org = "org_oidc_atomic_ledger";
+  const app = createTestApp({
+    RELAYAUTH_SPONSOR_FEDERATIONS: JSON.stringify({
+      [org]: { sponsorBinding: "oidc", issuer, clientId: "chief-fixture" },
+    }),
+  });
+  const apiKey = await createWorkspaceApiKey(app, org);
+  const now = Math.floor(Date.now() / 1000);
+  const proofResponse = await app.request(
+    createTestRequest(
+      "POST",
+      "/v1/sponsors/proof",
+      {
+        idToken: signIdToken({
+          iss: issuer,
+          sub: "alice",
+          aud: "chief-fixture",
+          iat: now,
+          exp: now + 300,
+        }),
+      },
+      { "x-api-key": apiKey },
+    ),
+    undefined,
+    app.bindings,
+  );
+  const proof = await assertJsonResponse<SponsorProof>(proofResponse, 201);
+
+  await app.storage.DB.prepare(`
+    CREATE TRIGGER reject_identity_created_ledger
+    BEFORE INSERT ON attestation_ledger
+    WHEN NEW.entry_type = 'identity.created'
+    BEGIN
+      SELECT RAISE(ABORT, 'fixture ledger failure');
+    END
+  `).run();
+
+  const response = await app.request(
+    createTestRequest(
+      "POST",
+      "/v1/identities",
+      {
+        name: "must-roll-back",
+        sponsorId: proof.sponsorId,
+        sponsorProof: proof.sponsorProof,
+      },
+      { "x-api-key": apiKey },
+    ),
+    undefined,
+    app.bindings,
+  );
+  const body = await assertJsonResponse<{ code: string }>(response, 500);
+  assert.equal(body.code, "identity_create_failed");
+
+  const identityRow = await app.storage.DB.prepare(
+    "SELECT id FROM identities WHERE org_id = ? AND name = ?",
+  ).bind(org, "must-roll-back").first<{ id: string }>();
+  const ledgerRow = await app.storage.DB.prepare(
+    "SELECT seq FROM attestation_ledger WHERE org_id = ?",
+  ).bind(org).first<{ seq: number }>();
+  assert.equal(identityRow ?? null, null);
+  assert.equal(ledgerRow ?? null, null);
+});

packages/server/src/lib/sponsor-binding.ts

@@ -3,6 +3,7 @@ import { rsaPublicJwkFromPem } from "./jwk.js";
 import {
   encodeBytesAsBase64Url,
   keyIdFromPublicJwk,
+  signCanonicalRs256,
   signRs256,
 } from "./sign-rs256.js";
 import {
@@ -63,6 +64,17 @@ export type IssuedSponsorProof = {
   expiresAt: string;
 };
 
+export type IdentityCreatedLedgerPayload = {
+  agentId: string;
+  sponsorId: string;
+  issuer: string;
+  subject: string;
+  iat: number;
+  jti?: string;
+  sponsorBinding: Extract<SponsorBinding, { mode: "oidc" }>;
+  ts: string;
+};
+
 type JsonWebKeySet = {
   keys: JsonWebKey[];
 };
@@ -358,6 +370,21 @@ export class SponsorOidcService {
     };
   }
 
+  async signIdentityCreatedLedgerPayload(
+    env: SponsorBindingEnv,
+    payload: IdentityCreatedLedgerPayload,
+  ): Promise<string> {
+    const privateKey = env.RELAYAUTH_SIGNING_KEY_PEM?.trim();
+    const publicKey = env.RELAYAUTH_SIGNING_KEY_PEM_PUBLIC?.trim();
+    if (!privateKey || !publicKey) {
+      throw configurationError("RelayAuth signing keys are required for sponsor binding ledger entries");
+    }
+
+    const publicJwk = await rsaPublicJwkFromPem(publicKey, "");
+    const kid = await keyIdFromPublicJwk(publicJwk);
+    return signCanonicalRs256(payload, privateKey, kid);
+  }
+
   async #resolveJwks(
     config: Extract<SponsorFederationConfig, { sponsorBinding: "oidc" }>,
     forceRefresh: boolean,

packages/server/src/routes/identities.ts

@@ -11,7 +11,10 @@ import { Hono, type Context } from "hono";
 import type { AppEnv } from "../env.js";
 import { authenticateAndAuthorizeFromContext, authenticateBearerOrApiKey, authorizeClaims, decodeBase64UrlJson } from "../lib/auth.js";
 import { emitObserverEvent, now as observerNow } from "../lib/events.js";
-import { SponsorBindingError } from "../lib/sponsor-binding.js";
+import {
+  SponsorBindingError,
+  type IdentityCreatedLedgerPayload,
+} from "../lib/sponsor-binding.js";
 import {
   isStorageCapacityExhausted,
   isTransientStorageOverload,
@@ -509,10 +512,43 @@ identities.post("/", async (c) => {
       // Identity creation is not guaranteed to be idempotent across storage
       // adapters. Never retry a write that may have committed before its
       // adapter surfaced an overload error.
-      createdIdentity = await storage.identities.create(storedIdentity);
+      if (sponsorBinding.mode === "oidc") {
+        const ledgerPayload: IdentityCreatedLedgerPayload = {
+          agentId: storedIdentity.id,
+          sponsorId,
+          issuer: sponsorBinding.issuer,
+          subject: sponsorBinding.subject,
+          iat: sponsorBinding.iat,
+          ...(sponsorBinding.jti ? { jti: sponsorBinding.jti } : {}),
+          sponsorBinding,
+          ts: timestamp,
+        };
+        const jws = await c.get("sponsorOidcService").signIdentityCreatedLedgerPayload(
+          c.env,
+          ledgerPayload,
+        );
+        createdIdentity = await storage.attestations.createIdentityWithLedgerEntry(
+          storedIdentity,
+          {
+            orgId: storedIdentity.orgId,
+            entryType: "identity.created",
+            agentId: storedIdentity.id,
+            sponsorId,
+            ...(sponsorBinding.jti ? { jti: sponsorBinding.jti } : {}),
+            payload: ledgerPayload,
+            jws,
+            createdAt: timestamp,
+          },
+        );
+      } else {
+        createdIdentity = await storage.identities.create(storedIdentity);
+      }
     } catch (error) {
       if (isTransientStorageOverload(error)) {
-        throw new StorageOverloadedError("identities.create", 1, { cause: error });
+        const operation = sponsorBinding.mode === "oidc"
+          ? "attestations.create_identity_with_ledger"
+          : "identities.create";
+        throw new StorageOverloadedError(operation, 1, { cause: error });
       }
       throw error;
     }