fix: authorize a pruned key like the message it replaces

Greptile found a real disclosure. The pruned answer ran
`authorize_query` against the synthetic `__snapshot__` operation, while a
lookup whose row survives runs the hook for the stored operation. A
caller allowed to read state but denied the operation could therefore
tell `MessagePruned` from nil and learn that the operation had run.
`snapshot` does not expose the remembered keys, so the gate granted more
than the thing it borrowed.

An actor now remembers the operation beside each key, and the pruned
answer runs the same hook against the same operation a surviving row
would. Without that the new test raises
`SolidObjects::MessagePruned` where it expects nil.

`authorized_to_invoke?` carries the check both paths share, and
`authorized_to_read?` passes a message to it.

Validation: bundle exec rake (795 runs, 0 failures).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: cardmagic

CHANGELOG.md

@@ -23,8 +23,11 @@
   store and no second write. `reference.find_by(idempotency_key:)` raises
   `SolidObjects::MessagePruned` for a key the actor remembers and whose message
   retention removed, and still answers `nil` for a key no caller ever sent.
-  The memory is actor state, so `authorize_query` gates the pruned answer and a
-  caller the policy refuses reads `nil` for both.
+  An actor remembers the operation beside each key, so the pruned answer runs
+  the same hook against the same operation a lookup of the surviving row would,
+  and a caller the policy refuses reads `nil` for both. Gating it on `snapshot`
+  would have told a caller who may read state, but not the operation, that the
+  operation had run.
   `retained_idempotency_keys` bounds the memory and defaults to 64 keys for
   each actor. A lookup by request id cannot make the distinction, because the
   runtime, not the caller, generates a request id and no actor remembers one.

docs/architecture.md

@@ -442,9 +442,12 @@ than in a separate tombstone table, which needs no second store, no second
 write, and no separate retention. `reference.find_by(idempotency_key:)` raises
 `MessagePruned` for a key the actor remembers and whose message retention
 removed, and answers `nil` for a key no caller ever sent, so a client can tell
-a lost result from a request that never arrived. The memory is actor state, so
-`authorize_query` gates the pruned answer the way it gates `snapshot`, and a
-caller the policy refuses reads `nil` for both.
+a lost result from a request that never arrived. An actor remembers the operation beside each key, so
+the pruned answer runs the same hook against the same operation that a lookup
+of the surviving row would, and a caller the policy refuses reads `nil` whether
+the message is pruned or never existed. Gating it on `snapshot` instead would
+tell a caller who may read state, but not the operation, that the operation had
+run.
 `retained_idempotency_keys` bounds the memory and defaults to 64 keys for each
 actor, and `retained_idempotency_keys_bytes` bounds its serialized size at 16 KB,
 because an idempotency key has no length limit on every adapter and the memory

docs/operations.md

@@ -567,8 +567,9 @@ observe it.
 names survives retention. A lookup by idempotency key still tells the two cases
 apart after pruning, because the actor remembers the keys of its own last
 `retained_idempotency_keys` finished turns: it raises `MessagePruned` for a key
-the actor remembers and answers `nil` for a key no caller ever sent. The
-memory is actor state, so `authorize_query` gates the pruned answer. Raise
+the actor remembers and answers `nil` for a key no caller ever sent. The actor
+remembers the operation beside each key, so the pruned answer runs the same
+authorization the surviving row would. Raise
 `retained_idempotency_keys` above the default of 64 when an actor finishes more
 keyed turns than that inside the window in which a caller may retry. A lookup
 by request id answers `nil` in both cases, so a caller that must tell them apart

lib/solid_objects/client.rb

@@ -196,24 +196,19 @@ def remembered_message(reference, idempotency_key, authorization_context:)
 
       message = Message.uncached { Message.find_by(instance_id: instance.id, idempotency_key:) }
       return message if message
-      return nil unless Array(instance.completed_idempotency_keys).include?(idempotency_key)
-      return nil unless readable_state?(reference, authorization_context:)
 
-      raise MessagePruned, idempotency_key
-    end
-
-    # @rbs (Reference, authorization_context: untyped) -> bool
-    def readable_state?(reference, authorization_context:)
-      authorize!(
-        hook: SolidObjects.configuration.authorize_query,
-        reference:,
-        operation: "__snapshot__",
+      remembered = Array(instance.completed_idempotency_keys)
+        .find { |entry| entry["key"] == idempotency_key }
+      return nil unless remembered
+      return nil unless authorized_to_invoke?(
+        actor_type: reference.actor_type,
+        actor_id: reference.actor_id,
+        operation: remembered["operation"],
         arguments: {},
         authorization_context:
       )
-      true
-    rescue Unauthorized
-      false
+
+      raise MessagePruned, idempotency_key
     end
 
     # @rbs (Message?, authorization_context: untyped) -> MessageReference?
@@ -226,21 +221,32 @@ def readable_message(message, authorization_context:)
 
     # @rbs (Message, authorization_context: untyped) -> bool
     def authorized_to_read?(message, authorization_context:)
-      actor_class = SolidObjects.registry.fetch(message.actor_type)
-      operation = message.operation.to_sym
-      query = actor_class.definition.queries.key?(operation)
-      return false unless query || actor_class.definition.messages.key?(operation)
+      authorized_to_invoke?(
+        actor_type: message.actor_type,
+        actor_id: message.actor_id,
+        operation: message.operation,
+        arguments: message.arguments,
+        authorization_context:
+      )
+    end
+
+    # @rbs (actor_type: String, actor_id: String, operation: String, arguments: Hash[String, untyped], authorization_context: untyped) -> bool
+    def authorized_to_invoke?(actor_type:, actor_id:, operation:, arguments:, authorization_context:)
+      actor_class = SolidObjects.registry.fetch(actor_type)
+      operation_symbol = operation.to_sym
+      query = actor_class.definition.queries.key?(operation_symbol)
+      return false unless query || actor_class.definition.messages.key?(operation_symbol)
 
       hook = if query
         SolidObjects.configuration.authorize_query
       else
         SolidObjects.configuration.authorize_message
       end
       hook.call(
-        actor_type: message.actor_type,
-        actor_id: message.actor_id,
-        operation: message.operation.to_s,
-        arguments: message.arguments,
+        actor_type:,
+        actor_id:,
+        operation: operation.to_s,
+        arguments:,
         authorization_context:
       )
     rescue UnknownActorType

lib/solid_objects/executor.rb

@@ -487,9 +487,11 @@ def remembered_keys(instance, message)
       remembered = Array(instance.completed_idempotency_keys)
       key = message.idempotency_key
       return remembered unless key
-      return remembered if remembered.last == key
 
-      bounded(remembered - [ key ] + [ key ])
+      entry = { "key" => key, "operation" => message.operation }
+      return remembered if remembered.last == entry
+
+      bounded(remembered.reject { |value| value["key"] == key } + [ entry ])
     end
 
     # @rbs (Array[String]) -> Array[String]

sig/generated/lib/solid_objects/client.rbs

@@ -35,15 +35,15 @@ module SolidObjects
     # @rbs (Reference, String, authorization_context: untyped) -> Message?
     def remembered_message: (Reference, String, authorization_context: untyped) -> Message?
 
-    # @rbs (Reference, authorization_context: untyped) -> bool
-    def readable_state?: (Reference, authorization_context: untyped) -> bool
-
     # @rbs (Message?, authorization_context: untyped) -> MessageReference?
     def readable_message: (Message?, authorization_context: untyped) -> MessageReference?
 
     # @rbs (Message, authorization_context: untyped) -> bool
     def authorized_to_read?: (Message, authorization_context: untyped) -> bool
 
+    # @rbs (actor_type: String, actor_id: String, operation: String, arguments: Hash[String, untyped], authorization_context: untyped) -> bool
+    def authorized_to_invoke?: (actor_type: String, actor_id: String, operation: String, arguments: Hash[String, untyped], authorization_context: untyped) -> bool
+
     # @rbs (MessageReference, Message) -> void
     def validate_message_reference!: (MessageReference, Message) -> void
 

test/integration/result_lookup_test.rb

@@ -289,6 +289,7 @@ def reject_checkout
     reference.async(idempotency_key: "checkout-7f3a").checkout(order_id: 1)
     run_actors
     SolidObjects::Message.delete_all
+    SolidObjects.configuration.authorize_message = ->(**) { false }
     SolidObjects.configuration.authorize_query = ->(**) { false }
 
     assert_nil reference.find_by(
@@ -297,6 +298,17 @@ def reject_checkout
     )
   end
 
+  test "does not tell a snapshot-only caller that a key was pruned" do
+    reference = CartActor.ref("alice")
+    reference.async(idempotency_key: "checkout-7f3a").checkout(order_id: 1)
+    run_actors
+    SolidObjects::Message.delete_all
+    SolidObjects.configuration.authorize_query = ->(**) { true }
+    SolidObjects.configuration.authorize_message = ->(**) { false }
+
+    assert_nil reference.find_by(idempotency_key: "checkout-7f3a")
+  end
+
   test "remembers a key whose message was rejected" do
     reference = CartActor.ref("alice")
     reference.async(idempotency_key: "rejected-7f3a").reject_checkout
@@ -345,16 +357,16 @@ def reject_checkout
   end
 
   test "bounds what an instance remembers by size" do
-    SolidObjects.configuration.retained_idempotency_keys_bytes = 64
+    SolidObjects.configuration.retained_idempotency_keys_bytes = 128
     reference = CartActor.ref("alice")
     keys = 3.times.map { |index| "#{index}-#{"k" * 20}" }
     keys.each_with_index { |key, index| reference.async(idempotency_key: key).checkout(order_id: index) }
     run_actors
 
     remembered = SolidObjects::Instance.sole.completed_idempotency_keys
 
-    assert_equal keys.last(2), remembered
-    assert_operator remembered.to_json.bytesize, :<=, 64
+    assert_equal keys.last(2), remembered.map { |entry| entry["key"] }
+    assert_operator remembered.to_json.bytesize, :<=, 128
   end
 
   test "remembers nothing for a key larger than what it retains" do
@@ -379,7 +391,7 @@ def reject_checkout
     run_actors
 
     assert_equal [ "second", "first" ],
-      SolidObjects::Instance.sole.completed_idempotency_keys
+      SolidObjects::Instance.sole.completed_idempotency_keys.map { |entry| entry["key"] }
   end
 
   test "remembers nothing for a message that carried no key" do