fix: canonicalize personal chat scope (#694)

Author: rogerchappel

src/app/api/chat/route.test.ts

@@ -70,11 +70,11 @@ vi.mock("@/lib/agent-mode-diagnostics", () => ({
 import { PolicyViolation } from "@/lib/collaboration-policy";
 import { POST } from "./route";
 
-function makeRequest(body: Record<string, unknown>) {
+function makeRequest(body: Record<string, unknown>, headers: Record<string, string> = {}) {
   return new NextRequest(new URL("/api/chat", "http://localhost:3000"), {
     method: "POST",
     body: JSON.stringify(body),
-    headers: { "Content-Type": "application/json" },
+    headers: { "Content-Type": "application/json", ...headers },
   });
 }
 
@@ -163,6 +163,82 @@ describe("POST /api/chat", () => {
     expect(mockGetGatewayClient).not.toHaveBeenCalled();
   });
 
+  it("keeps explicit personal workspace scope when the company cookie is stale", async () => {
+    mockResolveAccessibleWorkspace.mockResolvedValueOnce({
+      id: "workspace-personal",
+      companyId: null,
+    });
+
+    const response = await POST(makeRequest({
+      messages: [{ role: "user", content: "hello" }],
+      agent: "main",
+      companyId: null,
+      workspaceId: "workspace-personal",
+    }, {
+      Cookie: "active_company=company-stale; active_workspace=workspace-personal",
+    }));
+
+    expect(response.status).toBe(200);
+    expect(mockResolveAccessibleWorkspace).toHaveBeenCalledWith(expect.objectContaining({
+      explicitCompanyId: null,
+      explicitWorkspaceId: "workspace-personal",
+      requireExplicitForBearer: true,
+    }));
+    expect(mockAssertPrimaryRuntimeInvocationAllowedForContext).toHaveBeenCalledWith(expect.objectContaining({
+      companyId: null,
+      workspaceId: "workspace-personal",
+    }));
+
+    await readFirstChunk(response);
+  });
+
+  it("keeps explicit company scope when the workspace cookie is stale", async () => {
+    mockResolveAccessibleWorkspace.mockResolvedValueOnce({
+      id: "workspace-company",
+      companyId: "company-1",
+    });
+
+    const response = await POST(makeRequest({
+      messages: [{ role: "user", content: "hello" }],
+      agent: "main",
+      companyId: "company-1",
+    }, {
+      Cookie: "active_company=company-1; active_workspace=workspace-personal-stale",
+    }));
+
+    expect(response.status).toBe(200);
+    expect(mockResolveAccessibleWorkspace).toHaveBeenCalledWith(expect.objectContaining({
+      explicitCompanyId: "company-1",
+      explicitWorkspaceId: null,
+      requireExplicitForBearer: true,
+    }));
+    expect(mockAssertPrimaryRuntimeInvocationAllowedForContext).toHaveBeenCalledWith(expect.objectContaining({
+      companyId: "company-1",
+      workspaceId: "workspace-company",
+    }));
+
+    await readFirstChunk(response);
+  });
+
+  it("rejects conflicting explicit company and workspace scopes", async () => {
+    mockResolveAccessibleWorkspace.mockResolvedValueOnce({
+      id: "workspace-personal",
+      companyId: null,
+    });
+
+    const response = await POST(makeRequest({
+      messages: [{ role: "user", content: "hello" }],
+      agent: "main",
+      companyId: "company-1",
+      workspaceId: "workspace-personal",
+    }));
+
+    expect(response.status).toBe(403);
+    await expect(response.json()).resolves.toEqual({ error: "Forbidden" });
+    expect(mockAssertPrimaryRuntimeInvocationAllowedForContext).not.toHaveBeenCalled();
+    expect(mockGetGatewayClient).not.toHaveBeenCalled();
+  });
+
   it("rejects shared-context chat when the selected OpenClaw runtime is personal", async () => {
     mockAssertPrimaryRuntimeInvocationAllowedForContext.mockRejectedValueOnce(new PolicyViolation({
       allowed: false,

src/app/api/chat/route.ts

@@ -1000,19 +1000,27 @@ export async function POST(request: NextRequest) {
       .map((message: { content?: unknown }) => asString(message.content))
       .filter((content: string | null): content is string => Boolean(content));
 
-    // Resolve durable chat scope from body or cookies. Company scope is used
-    // for org workspaces; workspace scope keeps personal workspace chat durable.
-    const companyId = bodyCompanyId ||
-      request.cookies.get("active_company")?.value ||
-      null;
-    const workspaceId = bodyWorkspaceId ||
-      request.cookies.get("active_workspace")?.value ||
-      null;
+    // Explicit request scope is authoritative, including null values. Cookies
+    // are only a fallback when the caller did not send either scope field.
+    const hasExplicitCompanyId = Object.prototype.hasOwnProperty.call(body, "companyId");
+    const hasExplicitWorkspaceId = Object.prototype.hasOwnProperty.call(body, "workspaceId");
+    const hasExplicitScope = hasExplicitCompanyId || hasExplicitWorkspaceId;
+    const explicitCompanyId = hasExplicitCompanyId ? asString(bodyCompanyId) : null;
+    const explicitWorkspaceId = hasExplicitWorkspaceId ? asString(bodyWorkspaceId) : null;
+    let companyId = hasExplicitCompanyId
+      ? explicitCompanyId
+      : hasExplicitScope
+        ? null
+        : asString(request.cookies.get("active_company")?.value);
+    let workspaceId = hasExplicitWorkspaceId
+      ? explicitWorkspaceId
+      : hasExplicitScope
+        ? null
+        : asString(request.cookies.get("active_workspace")?.value);
     const channelId = typeof bodyChannelId === "string" && bodyChannelId.trim() ? bodyChannelId.trim() : null;
     const channelInvocationMode = firstString(bodyChannelInvocationMode)?.toLowerCase() === "mention"
       ? "mention"
       : "active";
-    const persistenceScope: ChatPersistenceScope = { companyId, workspaceId, channelId };
     if (companyId || workspaceId) {
       const accessibleWorkspace = await resolveAccessibleWorkspace({
         request,
@@ -1023,17 +1031,28 @@ export async function POST(request: NextRequest) {
       if (!accessibleWorkspace) {
         return Response.json({ error: "Forbidden" }, { status: 403 });
       }
+      if (
+        (explicitCompanyId && accessibleWorkspace.companyId !== explicitCompanyId) ||
+        (explicitWorkspaceId && accessibleWorkspace.id !== explicitWorkspaceId)
+      ) {
+        return Response.json({ error: "Forbidden" }, { status: 403 });
+      }
+
+      // Downstream policy and persistence must use one canonical scope rather
+      // than a potentially contradictory mix of body and cookie identifiers.
+      companyId = accessibleWorkspace.companyId;
+      workspaceId = accessibleWorkspace.id;
       if (channelId && !(await canAccessChatSession(request, {
-        companyId: accessibleWorkspace.companyId,
-        workspaceId: accessibleWorkspace.id,
+        companyId,
+        workspaceId,
         channelId,
       }))) {
         return Response.json({ error: "Forbidden" }, { status: 403 });
       }
       if (channelId) {
         const violation = await resolveChannelAgentInvocationViolation({
           channelId,
-          companyId: accessibleWorkspace.companyId,
+          companyId,
           agentCallsign: targetAgentCallsign || agentId,
           agentMode: bodyAgentMode === true,
           invocationMode: channelInvocationMode,
@@ -1044,6 +1063,7 @@ export async function POST(request: NextRequest) {
         }
       }
     }
+    const persistenceScope: ChatPersistenceScope = { companyId, workspaceId, channelId };
     const currentUser = await resolveCurrentUser(request);
     try {
       await assertPrimaryRuntimeInvocationAllowedForContext({