fix(security): act-as - the armed state expires, is visible everywhere, and never stamps the acted-as person on a role-addressed task (#6694)

[delchev]

Fixes #6694.

An act-as (delegated entry) arming is a session-scoped override that makes the personal surfaces and the Inbox's assignee query serve someone else's world. It worked as designed — except for the one thing nobody armed it for: being forgotten. An arming made at 18:03 for one delegated timesheet entry was still armed hours later, and from then on the Inbox served the acted-as person's tasks. A live invoice-approval step looked like a broken process (the task was there all along — ACT_RU_TASK had to be read in prod to prove it), and the steps that were worked through the armed session were completed with assignee = <acted-as person>, attributing approval decisions to an employee who never made them.

Three changes, one per ask in the issue.

1. The armed state expires on its own

ActAsFacade now stamps the arming time in the session and drops the override once DIRIGIBLE_ACT_AS_TTL_SECONDS (default 1800 — 30 minutes) have passed, logging the expiry. The window is absolute: it starts at arming and no activity renews it. A sliding window would be useless here — the Inbox polls every 30s, so the state would never expire while a tab is open, which is exactly the situation the incident describes. The expiry decision fails closed: an arming whose timestamp is missing or unparsable is treated as expired.

GET /services/core/actas now also returns expiresAt (epoch millis), and both shells render it in the banner ("… - until 18:33").

2. The Inbox says what the arming is hiding

New GET /services/inbox/act-as → { actingAs, hiddenTasks }, where hiddenTasks counts the tasks assigned to the real user — the ones the armed assignee query is not serving. The shared Inbox page renders a persistent strip ("Acting as X — N of your own tasks are hidden", with Exit) and the empty state says whose list is being shown instead of "You have no pending tasks."

The Applications shell also gains the banner, the exit action and the "Stop acting as X" menu entry that until now only the Personal shell had. The armed identity follows the session into the back office; the absence of any on-screen trace there is what let the arming be forgotten in the first place.

3. A back-office group task is claimed by the REAL user

CLAIM used to assign to ActAsFacade.effectiveUser() unconditionally. It now assigns to the acting identity only for a task addressed to that person — one where they are a candidate user, i.e. their own work the delegate is entering on their behalf. A task the caller reached through their own roles (approve, issue, send) is claimed by the real user, whatever is armed. Stamping the acted-as person there both corrupts the audit trail and strands the task on an identity that the claim has just removed from every group-candidate query.

This is the answer to the issue's third ask ("should back-office group tasks be served to an armed session at all?"). Hiding them would be worse — they are the real user's own work, and making tasks disappear is the failure mode we are fixing. Serving them while attributing them correctly is the honest fix.

Not in scope

Auto-disarm on navigating out of the personal shell: the server cannot observe navigation, and a client-side disarm would fire on every iframe/hosted-app transition. The TTL plus a banner on every shell covers the same ground without a new failure mode.

Tests

• ActAsFacadeTest (unit) — the expiry decision: fresh, elapsed, configured window, and the undatable-arming fail-closed case.
• ActAsSessionIT (HTTP, untagged → runs in the PR smoke gate) — the deadline is reported; an arming with a 1s window stops being honoured with nobody disarming it; and, over a real one-user-task process addressed to ADMINISTRATOR: a claim from an armed session lands on admin, the armed Inbox reports it as hidden, and an unarmed session sees assignee = admin.

Verified locally: ActAsFacadeTest green, ActAsSessionIT green (H2, headless).

🤖 Generated with Claude Code