[sea-snake]

Summary

RequestService::create_request now re-checks the requester after the request has been prepared and before it is stored. Preparing a request can await an external call (the validation method of a CallExternalCanister request), and the caller was only authorized once, before that await. The service now reloads the caller's user and runs the same authorization the create_request endpoint runs, for the same resource. If the caller no longer maps to the same user, the user is no longer active, or the permission no longer allows the request, creation fails with RequestError::Unauthorized and nothing is stored.

Changes

• services/request.rs: compute the request's Resource before the input moves into the factory, and after the factory returns, refuse creation unless the caller still resolves to the requester and Authorization::is_allowed passes.
• Unit tests that call create_request directly now grant the permission their request needs, because the service checks it as well as the endpoint.

Tests

• New create_request_refuses_requester_deactivated_after_authorization: an active requester creates a request, then the same call context (authorized while the user was active) is refused with UNAUTHORIZED after the user is set inactive, and no second request is stored. The test fails without the change.
• cargo test -p station --lib: 410 passed, 0 failed.
• cargo fmt --check and cargo clippy -p station --tests -- -D warnings are clean.

🤖 Generated with Claude Code

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to b28aa7c.

Security Overview

• 🔎 Scanned files: 5 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/5243341a-e7d7-47de-848a-f52264761c93?scanId=0d4bb2b0-5aa5-4baf-a1e0-5cee3e1aeaae&codeScanTypes=PrScan&tab=issues&detectionTypes=traditional,businessLogic,customRule,IAC,SECRETS,CICD,EOL,uncategorized

Detected Code Changes

Change Type	Relevant files
Enhancement	► core/station/impl/src/models/request_policy.rs     Add permission handling imports and repository interaction in tests ► core/station/impl/src/services/request.rs     Enforce authorization against current requester state and resource permissions
Enhancement	► tests/canister/integration/src/external_canister_tests.rs     Add external canister request test for deactivated requester during validation

[Copilot]

🟡 Changes recommended

Public permissions still allow inactive requesters through the guard, and the regression test does not cover deactivation during suspended preparation.

2 open issues

• Require active requester after external validation · New
• Test deactivation during pending external validation · New

What changed in this PR

This PR strengthens station request creation by reloading the requester and checking authorization after potentially asynchronous preparation, before storing the request.

Changes:

• Capture the request resource and recheck requester identity and authorization after preparation.
• Grant required permissions in existing test fixtures.
• Add a regression test for request creation using a previously authorized, now-inactive requester.

File	Description
core/​station/​impl/​src/​services/​request.rs	Add post-preparation authorization checks and update request tests.
core/​station/​impl/​src/​models/​request_policy.rs	Grant user-creation permission in the request-policy test helper.

_{Review effort: Balanced}