feat: session ownership, role fix, SSRF fix, E2E suite

cmd/serve.go

@@ -6,7 +6,9 @@ import (
 	"fmt"
 	"log/slog"
 	"net/http"
+	"os"
 	"os/signal"
+	"strconv"
 	"syscall"
 	"time"
 
@@ -16,6 +18,20 @@ import (
 	"github.com/koopa0/koopa/internal/config"
 )
 
+// parseRateBurst reads KOOPA_RATE_BURST from the environment.
+// Returns 0 (use default) if unset or invalid.
+func parseRateBurst() int {
+	v := os.Getenv("KOOPA_RATE_BURST")
+	if v == "" {
+		return 0
+	}
+	n, err := strconv.Atoi(v)
+	if err != nil || n < 0 {
+		return 0
+	}
+	return n
+}
+
 // Server timeout configuration.
 const (
 	readHeaderTimeout = 10 * time.Second
@@ -72,6 +88,7 @@ func runServe() error {
 		CORSOrigins:  cfg.CORSOrigins,
 		IsDev:        cfg.PostgresSSLMode == "disable",
 		TrustProxy:   cfg.TrustProxy,
+		RateBurst:    parseRateBurst(),
 	})
 	if err != nil {
 		return fmt.Errorf("creating API server: %w", err)

db/migrations/000002_add_owner_id.down.sql

@@ -0,0 +1,2 @@
+DROP INDEX IF EXISTS idx_sessions_owner_id;
+ALTER TABLE sessions DROP COLUMN IF EXISTS owner_id;

db/migrations/000002_add_owner_id.up.sql

@@ -0,0 +1,6 @@
+-- Add owner_id to sessions for multi-session support.
+-- Each session is owned by a user identified by a persistent uid cookie.
+-- Existing sessions get empty owner_id (orphaned — invisible to new users).
+ALTER TABLE sessions ADD COLUMN owner_id TEXT NOT NULL DEFAULT '';
+
+CREATE INDEX idx_sessions_owner_id ON sessions(owner_id, updated_at DESC);

db/queries/sessions.sql

@@ -2,22 +2,30 @@
 -- Generated code will be in internal/sqlc/sessions.sql.go
 
 -- name: CreateSession :one
-INSERT INTO sessions (title)
-VALUES ($1)
+INSERT INTO sessions (title, owner_id)
+VALUES ($1, sqlc.arg(owner_id))
 RETURNING *;
 
 -- name: Session :one
-SELECT id, title, created_at, updated_at
+SELECT id, title, owner_id, created_at, updated_at
 FROM sessions
 WHERE id = $1;
 
 -- name: Sessions :many
-SELECT id, title, created_at, updated_at
+SELECT id, title, owner_id, created_at, updated_at
 FROM sessions
+WHERE owner_id = sqlc.arg(owner_id)
 ORDER BY updated_at DESC
 LIMIT sqlc.arg(result_limit)
 OFFSET sqlc.arg(result_offset);
 
+-- name: SessionByIDAndOwner :one
+-- Verify session exists and is owned by the given user.
+-- Used for ownership checks without a separate query + comparison.
+SELECT id, title, owner_id, created_at, updated_at
+FROM sessions
+WHERE id = sqlc.arg(session_id) AND owner_id = sqlc.arg(owner_id);
+
 -- name: UpdateSessionUpdatedAt :exec
 UPDATE sessions
 SET updated_at = NOW()

internal/api/chat.go

@@ -84,24 +84,20 @@ func (h *chatHandler) send(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// Resolve session from context (set by session middleware from cookie)
-	sessionID, ok := sessionIDFromContext(r.Context())
-	if !ok {
-		WriteError(w, http.StatusBadRequest, "session_required", "session ID required", h.logger)
+	if req.SessionID == "" {
+		WriteError(w, http.StatusBadRequest, "session_required", "sessionId is required", h.logger)
 		return
 	}
 
-	// If body also specifies a session, verify it matches (defense-in-depth)
-	if req.SessionID != "" {
-		parsed, err := uuid.Parse(req.SessionID)
-		if err != nil {
-			WriteError(w, http.StatusBadRequest, "invalid_session", "invalid session ID", h.logger)
-			return
-		}
-		if parsed != sessionID {
-			WriteError(w, http.StatusForbidden, "forbidden", "session access denied", h.logger)
-			return
-		}
+	sessionID, err := uuid.Parse(req.SessionID)
+	if err != nil {
+		WriteError(w, http.StatusBadRequest, "invalid_session", "invalid session ID", h.logger)
+		return
+	}
+
+	if !h.sessionAccessAllowed(r, sessionID) {
+		WriteError(w, http.StatusForbidden, "forbidden", "session access denied", h.logger)
+		return
 	}
 
 	msgID := uuid.New().String()
@@ -118,6 +114,30 @@ func (h *chatHandler) send(w http.ResponseWriter, r *http.Request) {
 	}, h.logger)
 }
 
+// sessionAccessAllowed checks whether the request may access the session.
+// Returns true when no session manager is configured (unit tests, CLI mode).
+// When configured, verifies the session belongs to the authenticated user.
+func (h *chatHandler) sessionAccessAllowed(r *http.Request, sessionID uuid.UUID) bool {
+	if h.sessions == nil {
+		return true // no session manager → allow (test/CLI mode)
+	}
+	if h.sessions.store == nil {
+		return false // configured but no store → deny
+	}
+
+	userID, ok := userIDFromContext(r.Context())
+	if !ok || userID == "" {
+		return false
+	}
+
+	sess, err := h.sessions.store.Session(r.Context(), sessionID)
+	if err != nil {
+		return false
+	}
+
+	return sess.OwnerID == userID
+}
+
 // stream handles GET /api/v1/chat/stream — SSE endpoint with JSON events.
 func (h *chatHandler) stream(w http.ResponseWriter, r *http.Request) {
 	msgID := r.URL.Query().Get("msgId")
@@ -129,14 +149,13 @@ func (h *chatHandler) stream(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// Verify session ownership
 	parsedID, err := uuid.Parse(sessionID)
 	if err != nil {
 		WriteError(w, http.StatusBadRequest, "invalid_session", "invalid session ID", h.logger)
 		return
 	}
-	ctxID, ok := sessionIDFromContext(r.Context())
-	if !ok || ctxID != parsedID {
+
+	if !h.sessionAccessAllowed(r, parsedID) {
 		WriteError(w, http.StatusForbidden, "forbidden", "session access denied", h.logger)
 		return
 	}