Fix staging impersonation and integration timeouts

Author: julianknutsen

Makefile

@@ -18,6 +18,7 @@ BUILD_TIME := $(shell date -u +"%Y-%m-%dT%H:%M:%SZ")
 
 # Set to "true" to enable inference UI in CLI and web.
 INFER_ENABLED ?= false
+INTEGRATION_TIMEOUT ?= 45m
 
 LDFLAGS := -X main.version=$(VERSION) \
            -X main.commit=$(COMMIT) \
@@ -78,11 +79,11 @@ test:
 
 ## test-integration: run all tests including integration
 test-integration:
-	go test -tags integration -timeout 20m ./...
+	go test -tags integration -timeout $(INTEGRATION_TIMEOUT) ./...
 
 ## test-integration-offline: run offline integration tests only (no network, requires dolt)
 test-integration-offline:
-	go test -tags integration -v -timeout 20m ./internal/remote/ ./test/integration/offline/
+	go test -tags integration -v -timeout $(INTEGRATION_TIMEOUT) ./internal/remote/ ./test/integration/offline/
 
 ## test-cover: run tests with coverage output
 test-cover:

cmd/wl/cmd_accept.go

@@ -29,6 +29,9 @@ The item must be in 'in_review' status.
 A stamp is created with quality and optional reliability ratings (1-5),
 severity (leaf/branch/root), and optional skill tags.
 
+Self-stamps are not allowed. If you completed the item yourself, use
+'wl close' instead.
+
 In wild-west mode the commit is auto-pushed to upstream and origin.
 Use --no-push to skip pushing (offline work).
 
@@ -114,7 +117,11 @@ func runAccept(cmd *cobra.Command, stdout, _ io.Writer, wantedID string, quality
 	}
 
 	renderMutationResult(stdout, "Accepted", wantedID, result, extras...)
-	printNextHint(stdout, "Next: stamp issued. View: wl status "+wantedID)
+	nextHint := "Next: stamp issued. View: wl status " + wantedID
+	if result.Detail == nil || result.Detail.Stamp == nil {
+		nextHint = "Next: item completed without a stamp. View: wl status " + wantedID
+	}
+	printNextHint(stdout, nextHint)
 
 	return nil
 }

cmd/wl/cmd_accept_upstream.go

@@ -28,6 +28,9 @@ This adopts the submitter's upstream PR into the main wanted item, creates a
 completion record, and issues a stamp. The submitter must currently have an
 in-review upstream submission for the wanted item.
 
+Self-stamps are not allowed. If the submitter is you, use 'wl close-upstream'
+instead.
+
 Examples:
   wl accept-upstream w-abc123 charlie --quality 4
   wl accept-upstream w-abc123 charlie --quality 5 --reliability 4 --severity branch

internal/commons/lifecycle.go

@@ -157,7 +157,7 @@ func CanPerformTransition(item *WantedItem, t Transition, actor string) bool {
 	case TransitionDone:
 		return item.ClaimedBy == actor
 	case TransitionAccept:
-		return isPoster || isAdmin
+		return (isPoster || isAdmin) && item.ClaimedBy != actor
 	case TransitionReject:
 		return isPoster || isAdmin
 	case TransitionClose:

internal/commons/lifecycle_test.go

@@ -122,8 +122,8 @@ func TestCanPerformTransition_Accept(t *testing.T) {
 		PostedBy:  "poster",
 		ClaimedBy: "poster",
 	}
-	if !CanPerformTransition(selfItem, TransitionAccept, "poster") {
-		t.Error("poster should be able to accept own claimed work")
+	if CanPerformTransition(selfItem, TransitionAccept, "poster") {
+		t.Error("poster should not be able to accept own claimed work")
 	}
 	if CanPerformTransition(item, TransitionAccept, "claimer") {
 		t.Error("claimer should not be able to accept without poster/admin rights")
@@ -161,8 +161,8 @@ func TestCanPerformTransition_Admin(t *testing.T) {
 		PostedBy:  "poster",
 		ClaimedBy: "csells",
 	}
-	if !CanPerformTransition(selfItem, TransitionAccept, "csells") {
-		t.Error("admin who claimed should be able to accept")
+	if CanPerformTransition(selfItem, TransitionAccept, "csells") {
+		t.Error("admin who claimed should not be able to accept")
 	}
 	// Admin cannot delete (poster-only).
 	openItem := &WantedItem{

internal/hosted/auth.go

@@ -143,13 +143,9 @@ func (s *Server) AuthMiddleware(next http.Handler) http.Handler {
 		s.sessions.RememberActiveUpstream(sessionID, upstream)
 		r.Header.Set("X-Wasteland", upstream)
 
-		// Staging-only impersonation: X-Impersonate header overrides rig handle
-		// for read-only requests so operators can see the UI as another user.
+		// Staging-only impersonation: X-Impersonate overrides the rig handle so
+		// operators can exercise the UI and backend flows as another user.
 		if impersonate := r.Header.Get("X-Impersonate"); impersonate != "" && s.environment == "staging" {
-			if r.Method != http.MethodGet {
-				writeJSON(w, http.StatusForbidden, map[string]string{"error": "impersonation is read-only"})
-				return
-			}
 			slog.Info("staging impersonation active", "real", client.RigHandle(), "impersonate", impersonate)
 			client = client.WithRigHandle(impersonate)
 		}

internal/hosted/auth_test.go

@@ -997,7 +997,7 @@ func TestAuthMiddleware_Impersonate_Staging_PreservesResolvedViewerIdentity(t *t
 	}
 }
 
-func TestAuthMiddleware_Impersonate_Staging_POST_Blocked(t *testing.T) {
+func TestAuthMiddleware_Impersonate_Staging_POST_Allowed(t *testing.T) {
 	sessions, ts := setupStagingTestServer(t)
 	sessionID, _ := sessions.Create("conn-1")
 
@@ -1012,9 +1012,18 @@ func TestAuthMiddleware_Impersonate_Staging_POST_Blocked(t *testing.T) {
 	}
 	defer resp.Body.Close() //nolint:errcheck // test cleanup
 
-	if resp.StatusCode != http.StatusForbidden {
+	if resp.StatusCode != http.StatusOK {
 		body, _ := io.ReadAll(resp.Body)
-		t.Errorf("expected 403, got %d: %s", resp.StatusCode, string(body))
+		t.Fatalf("expected 200, got %d: %s", resp.StatusCode, string(body))
+	}
+
+	var result map[string]string
+	_ = json.NewDecoder(resp.Body).Decode(&result)
+	if result["rig_handle"] != "bob" {
+		t.Errorf("expected impersonated rig_handle=bob, got %s", result["rig_handle"])
+	}
+	if result["viewer"] != "alice" {
+		t.Errorf("expected resolved viewer=alice, got %s", result["viewer"])
 	}
 }
 

internal/hosted/authservice_integration_test.go

@@ -138,6 +138,91 @@ func (f *fakeAuthService) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	http.Error(w, "not found", http.StatusNotFound)
 }
 
+func setupAuthServiceStagingMiddlewareTestServer(t *testing.T) (*SessionStore, *httptest.Server) {
+	t.Helper()
+
+	authStub := &fakeAuthService{t: t}
+	authTS := httptest.NewServer(authStub)
+	t.Cleanup(authTS.Close)
+
+	authClient := dolthubauth.NewClient(dolthubauth.ClientConfig{
+		BaseURL:      authTS.URL,
+		TenantID:     "tenant-1",
+		Environment:  "staging",
+		KeyID:        "kid-1",
+		SharedSecret: "shared-secret",
+		Now: func() time.Time {
+			return time.Date(2026, 4, 8, 12, 0, 0, 0, time.UTC)
+		},
+	})
+
+	sessions := NewSessionStore()
+	resolver := NewAuthServiceWorkspaceResolver(authClient, sessions)
+	t.Cleanup(resolver.Stop)
+
+	hostedServer := NewAuthServiceServer(resolver, sessions, authClient, "session-secret", "subject-secret", "staging")
+	inner := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		client, ok := ClientFromContext(r.Context())
+		if !ok {
+			w.WriteHeader(http.StatusInternalServerError)
+			return
+		}
+		scope, _ := api.ResolvedReadIdentityFromContext(r.Context())
+		writeJSON(w, http.StatusOK, map[string]string{
+			"rig_handle": client.RigHandle(),
+			"upstream":   scope.Upstream,
+			"viewer":     scope.Viewer,
+		})
+	})
+
+	mux := http.NewServeMux()
+	mux.Handle("/", hostedServer.AuthMiddleware(inner))
+	ts := httptest.NewServer(mux)
+	t.Cleanup(ts.Close)
+	return sessions, ts
+}
+
+func TestAuthServiceAuthMiddleware_Impersonate_Staging_POST_Allowed(t *testing.T) {
+	sessions, ts := setupAuthServiceStagingMiddlewareTestServer(t)
+	sessionID, err := sessions.CreateWithSubject("conn-1", "subject-1")
+	if err != nil {
+		t.Fatalf("CreateWithSubject() error = %v", err)
+	}
+
+	req, err := http.NewRequest(http.MethodPost, ts.URL+"/api/wanted", nil)
+	if err != nil {
+		t.Fatalf("new request: %v", err)
+	}
+	req.AddCookie(&http.Cookie{Name: cookieName, Value: SignSessionCookie(sessionID, "conn-1", "session-secret")})
+	req.AddCookie(&http.Cookie{Name: subjectCookieName, Value: SignSubjectID("subject-1", "subject-secret")})
+	req.Header.Set("X-Wasteland", "hop/wl-commons")
+	req.Header.Set("X-Impersonate", "bob")
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatalf("POST /api/wanted: %v", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(resp.Body)
+		t.Fatalf("expected 200, got %d: %s", resp.StatusCode, string(body))
+	}
+
+	var result map[string]string
+	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
+		t.Fatalf("decode response: %v", err)
+	}
+	if result["rig_handle"] != "bob" {
+		t.Fatalf("rig_handle = %q, want bob", result["rig_handle"])
+	}
+	if result["viewer"] != "alice" {
+		t.Fatalf("viewer = %q, want alice", result["viewer"])
+	}
+	if result["upstream"] == "" {
+		t.Fatal("expected resolved upstream to be set")
+	}
+}
+
 func TestAuthServiceHostedEndToEnd(t *testing.T) {
 	authStub := &fakeAuthService{t: t}
 	authTS := httptest.NewServer(authStub)

internal/hosted/authservice_server.go

@@ -547,10 +547,6 @@ func (s *AuthServiceServer) AuthMiddleware(next http.Handler) http.Handler {
 		r.Header.Set("X-Wasteland", upstream)
 
 		if impersonate := r.Header.Get("X-Impersonate"); impersonate != "" && s.environment == "staging" {
-			if r.Method != http.MethodGet {
-				writeJSON(w, http.StatusForbidden, map[string]string{"error": "impersonation is read-only"})
-				return
-			}
 			client = client.WithRigHandle(impersonate)
 		}
 

internal/sdk/additional_test.go

@@ -851,6 +851,42 @@ func TestCloseUpstream(t *testing.T) {
 	}
 }
 
+func TestCloseUpstream_SelfAllowed(t *testing.T) {
+	db := newFakeDB()
+	db.seedItem(fakeItem{ID: "w-1", Title: "Fix bug", Status: "in_review", PostedBy: "alice", EffortLevel: "medium"})
+
+	c := New(ClientConfig{
+		DB:        db,
+		RigHandle: "charlie",
+		Mode:      "wild-west",
+		ListPendingItems: pendingItems(map[string][]PendingItem{
+			"w-1": {{
+				RigHandle:   "charlie",
+				Status:      "in_review",
+				CompletedBy: "charlie",
+				Evidence:    "proof",
+			}},
+		}),
+	})
+
+	result, err := c.CloseUpstream("w-1", "charlie")
+	if err != nil {
+		t.Fatalf("CloseUpstream() error = %v", err)
+	}
+	if result.Detail == nil || result.Detail.Item == nil {
+		t.Fatal("CloseUpstream() should return detail with item")
+	}
+	if result.Detail.Item.Status != "completed" {
+		t.Fatalf("status = %q, want completed", result.Detail.Item.Status)
+	}
+	if db.completions["w-1"].CompletedBy != "charlie" {
+		t.Fatalf("completion = %q, want charlie", db.completions["w-1"].CompletedBy)
+	}
+	if db.completions["w-1"].StampID != "" {
+		t.Fatalf("stamp_id = %q, want empty", db.completions["w-1"].StampID)
+	}
+}
+
 func TestFindUpstreamSubmissionErrorsAndLeaderboard(t *testing.T) {
 	t.Run("find upstream submission errors", func(t *testing.T) {
 		c := New(ClientConfig{DB: newFakeDB(), RigHandle: "alice"})