fix: scope chat queries by project and split chat read/write authorization

[disintegrator]

Fixes AIS-424 and AIS-485.

Why

GetChat looked up chats by id alone — no project_id predicate — so every per-chat endpoint had to re-derive tenancy in Go. Only chat.load wrote the complete rule. The other five stopped at project equality and never established ownership, so any project member could read, summarize, rename, pin, delete, or attach feedback to another member's session knowing only its UUID (AIS-424).

The same missing predicate made the completions proxy's client-supplied chat id unchecked: a caller could append messages to a chat in another organization and bump its generation, which blanked the owner's transcript in their own dashboard (AIS-485). That one crosses a tenancy boundary AIS-424 does not.

The reported chat.load disclosure itself was already closed by the RBAC-by-default rollout (#4681, #4780) — see "Before merging" below.

Approach

Scope the SQL. This is the durable half: the invariant holds even when a future call site forgets it, and it brings these queries in line with the project_id rule the rest of the codebase already follows. GetChat and ~12 other queries gain the predicate; 15 weak (project_id IS NULL OR project_id = @project_id) clauses collapse to hard equality; writes on tables that carry no project_id of their own (ai_integration_config_chats, chat_resolution_messages) are scoped through the chat or resolution they belong to. UpsertChat's ON CONFLICT (id) is fenced so a foreign chat id yields no row instead of landing on the victim's. No schema change, no migration.

One gate, applied everywhere. loadAuthorizedChat pairs the lookup with the access check so they cannot be separated — the failure mode here was handlers fetching the row themselves and re-deriving a partial rule.

chat:read and chat:write are separate scopes. Reading a transcript and destroying one are different privileges: a session reviewer should be able to open every session in the project without being able to delete any. Neither is a default for any system role (matching how chat:read was already treated), chat:write satisfies chat:read by expansion, and owners always reach their own sessions without either grant.

chat.summarize also now writes the chat_session:access audit entry, including on the cached path — it returns transcript-derived prose, so the audit log should not claim the session was never read.

Assistant sessions (second commit)

Externally-triggered assistant turns — cron, Slack, warmup — carry no user, so their chat rows were written with a NULL user_id. Owner-less is not neutral here: access is decided by owner-matching first and by an explicit grant otherwise, so a session nobody owns is one nobody can open, continue, rename or delete without a custom role.

Two of those consequences predate this PR (chat.load already required chat:read, and assistants.sendMessage already 404s for everyone since CallerOwnsDashboardChat can't match NULL). What this PR newly regresses is pin/rename/delete/feedback, which previously fell back to plain project membership.

assistantChatOwnerID attributes such a session to whoever created the assistant. A dashboard turn still belongs to its sender; the fallback only fires when the turn carries no user. An assistant with no recorded creator leaves the chat owner-less exactly as before.

Existing rows stay owner-less until backfilled — tracked in DNO-807, which is worth running before this merges to avoid a window where admins cannot manage existing cron/Slack-started sessions.

Behaviour changes worth a look

1. Cross-project reads return not_found, not unauthorized. The project-scoped GetChat yields no row rather than a row that then fails a Go comparison. This removes an existence oracle and matches what the turn-stream route already did. Three existing assertions updated.
2. UpsertChat can now return ErrNoRows for a foreign chat id; StartOrResumeChat maps that to not_found rather than an unexpected error. Not-found rather than unauthorized deliberately: that branch is only reachable when the id names a real chat in another project, so a distinct code or message would confirm the id belongs to another tenant. This is the only change on a success path — worth a second pair of eyes since it sits on the completions hot path.
3. New forbidden responses on chat.delete, chat.setPinned, chat.summarize, chat.generateTitle, chat.submitFeedback. No design edit needed; errors are declared service-wide.
4. chat:read no longer conveys delete. An org that granted chat:read for session review keeps read access; anyone who relied on it to delete other members' sessions needs chat:write.

Tests

Every pre-existing chat test authenticated as a chat:read holder, which is exactly why this survived. New coverage:

• chat_write_authorization_test.go — endpoint × caller matrix (member / chat:read holder / chat:write holder / owner / cross-project / missing). A new endpoint that forgets the gate fails here.
• submit_feedback_test.go — this endpoint had no tests at all.
• queries_scoping_test.go — asserts the SQL predicates directly, not only through handlers.
• TestStartOrResumeChat_RejectsChatFromAnotherProject — the AIS-485 regression guard: the call is rejected, no rows land against the victim chat, and its generation is unchanged.

go test -race passes across chat, authz, access, risk, assistants, aiintegrations, hooks, background, skills.

Note: TestSkillEfficacySweepWorkflowContinuesAsNewPastAFullPage races intermittently under parallel load. It is pre-existing — clean main fails it 2 runs in 3 — and untouched by this branch.

Before merging

chat.load's fix depends on RBAC enforcement being live for existing orgs. #4780 states its one-time org backfill was deliberately left out of that PR. If it has not run in production, authz.Require still short-circuits and the originally reported transcript disclosure remains open independently of this change. Worth confirming before AIS-424 is closed.

🤖 Generated with Claude Code

[linear-code]

AIS-424

AIS-485

[changeset-bot]

⚠️ No Changeset found

Latest commit: 3055a35

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[cubic-dev-ai]

All reported issues were addressed across 56 files

<sub>Tip: instead of fixing issues one by one fix them all with cubic

Re-trigger cubic</sub>

[tgmendes]

LGTM - one comment which shouldn't be blocking.

RBAC wise it's what I'd expect