[sea-snake]

Summary

RequestService::create_request now re-checks the requester after the request has been prepared and before it is stored. Preparing a request can await an external call (the validation method of a CallExternalCanister request), and the caller was only authorized once, before that await. The service now reloads the caller's user and runs the same authorization the create_request endpoint runs, for the same resource. If the caller no longer maps to the same user, the user is no longer active, or the permission no longer allows the request, creation fails with RequestError::Unauthorized and nothing is stored.

Changes

• services/request.rs: compute the request's Resource before the input moves into the factory, and after the factory returns, refuse creation unless the caller still resolves to the requester and Authorization::is_allowed passes.
• Unit tests that call create_request directly now grant the permission their request needs, because the service checks it as well as the endpoint.

Tests

• New create_request_refuses_requester_deactivated_after_authorization: an active requester creates a request, then the same call context (authorized while the user was active) is refused with UNAUTHORIZED after the user is set inactive, and no second request is stored. The test fails without the change.
• cargo test -p station --lib: 410 passed, 0 failed.
• cargo fmt --check and cargo clippy -p station --tests -- -D warnings are clean.

🤖 Generated with Claude Code

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to 771fb6c.

Security Overview

• 🔎 Scanned files: 5 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/5243341a-e7d7-47de-848a-f52264761c93?scanId=1df2a63f-00d3-4b33-bd18-a2ad76265fe7&codeScanTypes=PrScan&tab=issues&detectionTypes=traditional,businessLogic,customRule,IAC,SECRETS,CICD,EOL,uncategorized

Detected Code Changes

Change Type	Relevant files
Enhancement	► core/station/impl/src/models/request_policy.rs       Add permission and resource-related imports and insert a default admin permission into PERMISSION_REPOSITORY ► core/station/impl/src/services/request.rs       Introduce resource-based authorization check before storing a request
Enhancement	► tests/mod.rs (implicit context in repo snippets not present; no direct file path)
Enhancement	► tests/integration/src/external_canister_tests.rs       Update imports to include new DTOs and test flow for external canister call requests
Enhancement	► tests/canister/impl/src/lib.rs       Add validation state flag for release-based validation flow
Enhancement	► tests/canister/api/spec.did       Extend API spec with validate_when_released and release_validation methods
Enhancement	► tests/integration/src/external_canister_tests.rs (new test)       Add test for create_call_external_canister_request_refuses_requester_deactivated_during_validation

[Copilot]

🟡 Changes recommended

Public permissions still allow inactive requesters through the guard, and the regression test does not cover deactivation during suspended preparation.

2 open issues

• Require active requester after external validation · New
• Test deactivation during pending external validation · New

What changed in this PR

This PR strengthens station request creation by reloading the requester and checking authorization after potentially asynchronous preparation, before storing the request.

Changes:

• Capture the request resource and recheck requester identity and authorization after preparation.
• Grant required permissions in existing test fixtures.
• Add a regression test for request creation using a previously authorized, now-inactive requester.

File	Description
core/​station/​impl/​src/​services/​request.rs	Add post-preparation authorization checks and update request tests.
core/​station/​impl/​src/​models/​request_policy.rs	Grant user-creation permission in the request-policy test helper.

_{Review effort: Balanced}