Vault refactor to support jwt auth and allowlist auth based ownership model (#22525)

* Vault refactor

* test fix

* chore: empty commit

Trigger CI.

Co-authored-by: Cursor <cursoragent@cursor.com>

* orgID plumbing

* tenantID verification

* bump chainlink-common

* fix test

* fix test

* Code TenantID as a job-spec input

* bump chainlink-common to merged commit hash

---------

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: prashantkumar1982

core/capabilities/confidentialrelay/handler.go

@@ -22,7 +22,6 @@ import (
 	jsonrpc "github.com/smartcontractkit/chainlink-common/pkg/jsonrpc2"
 	"github.com/smartcontractkit/chainlink-common/pkg/logger"
 	"github.com/smartcontractkit/chainlink-common/pkg/services"
-	"github.com/smartcontractkit/chainlink-common/pkg/settings/cresettings"
 	"github.com/smartcontractkit/chainlink-common/pkg/settings/limits"
 	"github.com/smartcontractkit/chainlink-common/pkg/types/core"
 	sdkpb "github.com/smartcontractkit/chainlink-protos/cre/go/sdk"
@@ -108,13 +107,9 @@ type Handler struct {
 	// validateAttestation validates TEE attestation documents.
 	// Defaults to the Nitro validator; overridden in tests.
 	validateAttestation attestationValidatorFunc
-
-	// vaultIdentityGate controls whether WorkflowOwner and OrgId are set
-	// on the vault GetSecretsRequest. Gated behind VaultOrgIdAsSecretOwnerEnabled.
-	vaultIdentityGate limits.GateLimiter
 }
 
-func NewHandler(capRegistry core.CapabilitiesRegistry, conn core.GatewayConnector, responseSigner relayResponseSigner, lggr logger.Logger, limitsFactory limits.Factory) (*Handler, error) {
+func NewHandler(capRegistry core.CapabilitiesRegistry, conn core.GatewayConnector, responseSigner relayResponseSigner, lggr logger.Logger, _ limits.Factory) (*Handler, error) {
 	if responseSigner == nil {
 		return nil, errors.New("response signer is required")
 	}
@@ -123,19 +118,13 @@ func NewHandler(capRegistry core.CapabilitiesRegistry, conn core.GatewayConnecto
 		return nil, fmt.Errorf("failed to create metrics: %w", err)
 	}
 
-	vaultIdentityGate, err := limits.MakeGateLimiter(limitsFactory, cresettings.Default.VaultOrgIdAsSecretOwnerEnabled)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create vault identity gate limiter: %w", err)
-	}
-
 	h := &Handler{
 		capRegistry:         capRegistry,
 		gatewayConnector:    conn,
 		responseSigner:      responseSigner,
 		lggr:                logger.Named(lggr, HandlerName),
 		metrics:             m,
 		validateAttestation: nitro.ValidateAttestation,
-		vaultIdentityGate:   vaultIdentityGate,
 	}
 	h.Service, h.eng = services.Config{
 		Name:  HandlerName,
@@ -243,14 +232,6 @@ func (h *Handler) handleSecretsGet(ctx context.Context, gatewayID string, req *j
 	vaultReq := &vault.GetSecretsRequest{
 		Requests: make([]*vault.SecretRequest, 0, len(params.Secrets)),
 	}
-	gateEnabled, err := h.vaultIdentityGate.Limit(ctx)
-	if err != nil {
-		return h.errorResponse(ctx, gatewayID, req, jsonrpc.ErrInternal, fmt.Errorf("failed to check VaultOrgIdAsSecretOwnerEnabled gate: %w", err))
-	}
-	vaultReq.WorkflowOwner = normalizedOwner
-	if gateEnabled {
-		vaultReq.OrgId = params.OrgID
-	}
 	for _, s := range params.Secrets {
 		namespace := s.Namespace
 		if namespace == "" {
@@ -284,10 +265,6 @@ func (h *Handler) handleSecretsGet(ctx context.Context, gatewayID string, req *j
 		WorkflowDonConfigVersion: localNode.WorkflowDON.ConfigVersion,
 		ReferenceID:              req.ID,
 	}
-	if gateEnabled {
-		metadata.OrgID = params.OrgID
-	}
-
 	capResp, err := vaultCap.Execute(ctx, capabilities.CapabilityRequest{
 		Payload:      anypbReq,
 		Method:       vault.MethodGetSecrets,

core/capabilities/confidentialrelay/handler_test.go

@@ -427,12 +427,9 @@ func TestHandler_HandleGatewayMessage(t *testing.T) {
 			},
 		},
 		{
-			name:     "secrets get sets WorkflowOwner and OrgId when gate enabled",
+			name:     "secrets get invokes vault execute with stable capability metadata",
 			registry: secretsGetTestRegistry,
 			req:      secretsGetTestRequest,
-			modifyHandler: func(_ *testing.T, h *Handler) {
-				h.vaultIdentityGate = limits.NewGateLimiter(true)
-			},
 			checkResp: func(t *testing.T, resp *jsonrpc.Response[json.RawMessage]) {
 				require.Nil(t, resp.Error)
 				// signSecretsResponse hashes against the request params (no Attestation),
@@ -452,41 +449,11 @@ func TestHandler_HandleGatewayMessage(t *testing.T) {
 
 				var vaultReq vault.GetSecretsRequest
 				require.NoError(t, exec.lastRequest.Payload.UnmarshalTo(&vaultReq))
-
-				// Gate enabled: owner should be EIP-55 checksummed on the vault request.
-				assert.Equal(t, "0xAb5801a7D398351b8bE11C439e05C5B3259aeC9B", vaultReq.WorkflowOwner)
-				assert.Equal(t, "org-123", vaultReq.OrgId)
-
-				// Metadata.WorkflowOwner should be the original (non-normalized) value.
+				require.Len(t, vaultReq.Requests, 1)
+				assert.Equal(t, "0xAb5801a7D398351b8bE11C439e05C5B3259aeC9B", vaultReq.Requests[0].Id.Owner)
 				assert.Equal(t, "0xab5801a7d398351b8be11c439e05c5b3259aec9b", exec.lastRequest.Metadata.WorkflowOwner)
 				assert.Equal(t, "wf-secrets-1", exec.lastRequest.Metadata.WorkflowID)
 				assert.Equal(t, uint32(42), exec.lastRequest.Metadata.WorkflowDonID)
-				// Gate enabled: OrgID should be set on metadata.
-				assert.Equal(t, "org-123", exec.lastRequest.Metadata.OrgID)
-			},
-		},
-		{
-			name:     "secrets get omits WorkflowOwner and OrgId when gate disabled",
-			registry: secretsGetTestRegistry,
-			req:      secretsGetTestRequest,
-			modifyHandler: func(_ *testing.T, h *Handler) {
-				h.vaultIdentityGate = limits.NewGateLimiter(false)
-			},
-			checkResp: func(t *testing.T, resp *jsonrpc.Response[json.RawMessage]) {
-				require.Nil(t, resp.Error)
-			},
-			checkExecutable: func(t *testing.T, reg *mockCapRegistry) {
-				exec := reg.executables[vault.CapabilityID]
-				require.NotNil(t, exec.lastRequest, "vault Execute should have been called")
-
-				var vaultReq vault.GetSecretsRequest
-				require.NoError(t, exec.lastRequest.Payload.UnmarshalTo(&vaultReq))
-
-				// Gate disabled: WorkflowOwner is always set, OrgId must be empty.
-				assert.Equal(t, "0xAb5801a7D398351b8bE11C439e05C5B3259aeC9B", vaultReq.WorkflowOwner)
-				assert.Empty(t, vaultReq.OrgId)
-				// Gate disabled: OrgID must be empty on metadata too.
-				assert.Empty(t, exec.lastRequest.Metadata.OrgID)
 			},
 		},
 		{

core/capabilities/vault/authorizer.go

@@ -45,14 +45,12 @@ func (a *AuthResult) WorkflowOwner() string {
 	return a.workflowOwner
 }
 
-// AuthorizedOwner returns the canonical owner to use for request scoping.
+// AuthorizedOwner returns the canonical workflow-owner address used for Vault request ID prefixing
+// and secret ownership (JWT-derived owner or allowlisted workflow owner).
 func (a *AuthResult) AuthorizedOwner() string {
 	if a == nil {
 		return ""
 	}
-	if a.orgID != "" {
-		return a.orgID
-	}
 	return a.workflowOwner
 }
 

core/capabilities/vault/authorizer_test.go

@@ -59,7 +59,7 @@ func TestAuthorizer_UsesJWTWhenGateEnabled(t *testing.T) {
 	require.NoError(t, err)
 	require.Equal(t, "org-1", authResult.OrgID())
 	require.Equal(t, "0xworkflow", authResult.WorkflowOwner())
-	require.Equal(t, "org-1", authResult.AuthorizedOwner())
+	require.Equal(t, "0xworkflow", authResult.AuthorizedOwner())
 }
 
 func TestAuthorizer_DelegatesDigestVerificationToJWTAuth(t *testing.T) {
@@ -82,7 +82,7 @@ func TestAuthorizer_DelegatesDigestVerificationToJWTAuth(t *testing.T) {
 	require.NoError(t, err)
 	require.Equal(t, "org-1", authResult.OrgID())
 	require.Empty(t, authResult.WorkflowOwner())
-	require.Equal(t, "org-1", authResult.AuthorizedOwner())
+	require.Empty(t, authResult.AuthorizedOwner())
 }
 
 func TestAuthorizer_RejectsJWTReplay(t *testing.T) {
@@ -105,7 +105,7 @@ func TestAuthorizer_RejectsJWTReplay(t *testing.T) {
 
 	authResult, err := a.AuthorizeRequest(t.Context(), req)
 	require.NoError(t, err)
-	require.Equal(t, "org-1", authResult.AuthorizedOwner())
+	require.Empty(t, authResult.AuthorizedOwner())
 
 	authResult, err = a.AuthorizeRequest(t.Context(), req)
 	require.Nil(t, authResult)

core/capabilities/vault/capability.go

@@ -16,7 +16,6 @@ import (
 	vaultcommon "github.com/smartcontractkit/chainlink-common/pkg/capabilities/actions/vault"
 	"github.com/smartcontractkit/chainlink-common/pkg/capabilities/consensus/requests"
 	"github.com/smartcontractkit/chainlink-common/pkg/logger"
-	"github.com/smartcontractkit/chainlink-common/pkg/services/orgresolver"
 	"github.com/smartcontractkit/chainlink-common/pkg/settings/cresettings"
 	"github.com/smartcontractkit/chainlink-common/pkg/settings/limits"
 	"github.com/smartcontractkit/chainlink-common/pkg/types/core"
@@ -32,7 +31,6 @@ type Capability struct {
 	handler              *requests.Handler[*vaulttypes.Request, *vaulttypes.Response]
 	capabilitiesRegistry core.CapabilitiesRegistry
 	publicKey            *LazyPublicKey
-	linker               *OrgIDToWorkflowOwnerLinker
 	lifecycle            *RequestLifecycleTracker
 	*RequestValidator
 }
@@ -89,10 +87,6 @@ func (s *Capability) Close() error {
 		err = errors.Join(err, fmt.Errorf("error closing identifier namespace length limiter: %w", lerr))
 	}
 
-	if lerr := s.linker.Close(); lerr != nil {
-		err = errors.Join(err, fmt.Errorf("error closing org_id linker: %w", lerr))
-	}
-
 	return err
 }
 
@@ -155,11 +149,8 @@ func (s *Capability) Execute(ctx context.Context, request capabilities.Capabilit
 	}
 	id := fmt.Sprintf("%s::%s::%s", md.WorkflowID, phaseOrExecution, md.ReferenceID)
 
-	// When VaultOrgIdAsSecretOwnerEnabled is disabled, request.WorkflowOwner is
-	// not populated, so it has to be fetched from the first request's secret owner.
-	if r.WorkflowOwner == "" && len(r.Requests) > 0 && r.Requests[0] != nil && r.Requests[0].Id != nil {
-		r.WorkflowOwner = r.Requests[0].Id.Owner
-	}
+	// Workflow DON reads populate secret identifiers explicitly; OCR paths do not rely on legacy
+	// top-level protobuf identity fields.
 
 	resp, err := s.handleRequest(ctx, id, r)
 	if err != nil {
@@ -186,17 +177,10 @@ func (s *Capability) Execute(ctx context.Context, request capabilities.Capabilit
 
 func (s *Capability) CreateSecrets(ctx context.Context, request *vaultcommon.CreateSecretsRequest) (*vaulttypes.Response, error) {
 	s.lggr.Debugw("received create secrets request", "request", request.String())
-	resolvedIdentity, err := s.resolveRequestIdentity(ctx, request.OrgId, request.WorkflowOwner)
-	if err != nil {
+	if err := validateEncryptedSecretsUniformOwners(request.EncryptedSecrets); err != nil {
 		return nil, err
 	}
-	request.OrgId = resolvedIdentity.OrgID
-	request.WorkflowOwner = resolvedIdentity.WorkflowOwner
-	if ownerErr := validateEncryptedSecretOwnersMatchResolvedIdentity(request.EncryptedSecrets, resolvedIdentity); ownerErr != nil {
-		s.lggr.Debugw("failed identity owner checks", "requestID", request.RequestId, "err", ownerErr)
-		return nil, ownerErr
-	}
-	err = s.ValidateCreateSecretsRequest(ctx, s.publicKey.Get(), request, false)
+	err := s.ValidateCreateSecretsRequest(ctx, s.publicKey.Get(), request, false)
 	if err != nil {
 		s.lggr.Debugw("failed validation checks", "requestID", request.RequestId, "err", err)
 		return nil, err
@@ -206,17 +190,10 @@ func (s *Capability) CreateSecrets(ctx context.Context, request *vaultcommon.Cre
 
 func (s *Capability) UpdateSecrets(ctx context.Context, request *vaultcommon.UpdateSecretsRequest) (*vaulttypes.Response, error) {
 	s.lggr.Debugw("received update secrets request", "request", request.String())
-	resolvedIdentity, err := s.resolveRequestIdentity(ctx, request.OrgId, request.WorkflowOwner)
-	if err != nil {
+	if err := validateEncryptedSecretsUniformOwners(request.EncryptedSecrets); err != nil {
 		return nil, err
 	}
-	request.OrgId = resolvedIdentity.OrgID
-	request.WorkflowOwner = resolvedIdentity.WorkflowOwner
-	if ownerErr := validateEncryptedSecretOwnersMatchResolvedIdentity(request.EncryptedSecrets, resolvedIdentity); ownerErr != nil {
-		s.lggr.Debugw("failed identity owner checks", "requestID", request.RequestId, "err", ownerErr)
-		return nil, ownerErr
-	}
-	err = s.ValidateUpdateSecretsRequest(ctx, s.publicKey.Get(), request, false)
+	err := s.ValidateUpdateSecretsRequest(ctx, s.publicKey.Get(), request, false)
 	if err != nil {
 		s.lggr.Debugw("failed validation checks", "requestID", request.RequestId, "err", err)
 		return nil, err
@@ -231,14 +208,8 @@ func (s *Capability) DeleteSecrets(ctx context.Context, request *vaultcommon.Del
 		s.lggr.Debugw("failed validation checks", "requestID", request.RequestId, "request", request.String(), "err", err)
 		return nil, err
 	}
-	resolvedIdentity, err := s.resolveRequestIdentity(ctx, request.OrgId, request.WorkflowOwner)
-	if err != nil {
-		return nil, err
-	}
-	request.OrgId = resolvedIdentity.OrgID
-	request.WorkflowOwner = resolvedIdentity.WorkflowOwner
-	if err := validateSecretIdentifierOwnersMatchResolvedIdentity(request.Ids, resolvedIdentity); err != nil {
-		s.lggr.Debugw("failed identity owner checks", "requestID", request.RequestId, "request", request.String(), "err", err)
+	if err := validateSecretIdentifiersUniformOwners(request.Ids); err != nil {
+		s.lggr.Debugw("failed uniform owner checks", "requestID", request.RequestId, "request", request.String(), "err", err)
 		return nil, err
 	}
 	return s.handleRequest(ctx, request.RequestId, request)
@@ -262,16 +233,6 @@ func (s *Capability) ListSecretIdentifiers(ctx context.Context, request *vaultco
 		s.lggr.Debugw("failed validation checks", "requestID", request.RequestId, "request", request.String(), "err", err)
 		return nil, err
 	}
-	resolvedIdentity, err := s.resolveRequestIdentity(ctx, request.OrgId, request.WorkflowOwner)
-	if err != nil {
-		return nil, err
-	}
-	request.OrgId = resolvedIdentity.OrgID
-	request.WorkflowOwner = resolvedIdentity.WorkflowOwner
-	if err := validateOwnerMatchesResolvedIdentity("owner", request.Owner, resolvedIdentity); err != nil {
-		s.lggr.Debugw("failed identity owner checks", "requestID", request.RequestId, "request", request.String(), "err", err)
-		return nil, err
-	}
 	return s.handleRequest(ctx, request.RequestId, request)
 }
 
@@ -300,47 +261,40 @@ func normalizeOwner(owner string) string {
 	return strings.ToLower(strings.TrimPrefix(owner, "0x"))
 }
 
-func validateEncryptedSecretOwnersMatchResolvedIdentity(encryptedSecrets []*vaultcommon.EncryptedSecret, resolvedIdentity LinkedVaultRequestIdentity) error {
-	for idx, encryptedSecret := range encryptedSecrets {
-		if encryptedSecret == nil || encryptedSecret.Id == nil {
+func validateEncryptedSecretsUniformOwners(encryptedSecrets []*vaultcommon.EncryptedSecret) error {
+	var owner string
+	for idx, enc := range encryptedSecrets {
+		if enc == nil || enc.Id == nil {
+			continue
+		}
+		if owner == "" {
+			owner = enc.Id.Owner
 			continue
 		}
-		if err := validateOwnerMatchesResolvedIdentity(fmt.Sprintf("encrypted secret owner at index %d", idx), encryptedSecret.Id.Owner, resolvedIdentity); err != nil {
-			return err
+		if normalizeOwner(enc.Id.Owner) != normalizeOwner(owner) {
+			return fmt.Errorf("encrypted secret owner at index %d %q does not match batch owner %q", idx, enc.Id.Owner, owner)
 		}
 	}
-
 	return nil
 }
 
-func validateSecretIdentifierOwnersMatchResolvedIdentity(ids []*vaultcommon.SecretIdentifier, resolvedIdentity LinkedVaultRequestIdentity) error {
+func validateSecretIdentifiersUniformOwners(ids []*vaultcommon.SecretIdentifier) error {
+	var owner string
 	for idx, id := range ids {
 		if id == nil {
 			continue
 		}
-		if err := validateOwnerMatchesResolvedIdentity(fmt.Sprintf("secret identifier owner at index %d", idx), id.Owner, resolvedIdentity); err != nil {
-			return err
+		if owner == "" {
+			owner = id.Owner
+			continue
+		}
+		if normalizeOwner(id.Owner) != normalizeOwner(owner) {
+			return fmt.Errorf("secret identifier owner at index %d %q does not match batch owner %q", idx, id.Owner, owner)
 		}
 	}
-
 	return nil
 }
 
-func validateOwnerMatchesResolvedIdentity(field string, owner string, resolvedIdentity LinkedVaultRequestIdentity) error {
-	if resolvedIdentity.WorkflowOwner == "" && resolvedIdentity.OrgID == "" {
-		return nil
-	}
-
-	if resolvedIdentity.WorkflowOwner != "" && normalizeOwner(owner) == normalizeOwner(resolvedIdentity.WorkflowOwner) {
-		return nil
-	}
-	if resolvedIdentity.OrgID != "" && owner == resolvedIdentity.OrgID {
-		return nil
-	}
-
-	return fmt.Errorf("%s %q must match resolved workflow owner %q or org_id %q", field, owner, resolvedIdentity.WorkflowOwner, resolvedIdentity.OrgID)
-}
-
 func (s *Capability) handleRequest(ctx context.Context, requestID string, request proto.Message) (*vaulttypes.Response, error) {
 	s.lifecycle.RecordReceived(ctx, requestID, s.clock.Now())
 	respCh := make(chan *vaulttypes.Response, 1)
@@ -370,27 +324,13 @@ func (s *Capability) handleRequest(ctx context.Context, requestID string, reques
 	}
 }
 
-// resolveRequestIdentity validates and normalizes the org/workflow-owner pair that the vault plugin consumes.
-func (s *Capability) resolveRequestIdentity(ctx context.Context, orgID string, workflowOwner string) (LinkedVaultRequestIdentity, error) {
-	s.lggr.Debugw("resolving request identity", "orgID", orgID, "workflowOwner", workflowOwner)
-	linked, err := s.linker.Link(ctx, orgID, workflowOwner)
-	if err != nil {
-		s.lggr.Errorw("failed to resolve request identity", "orgID", orgID, "workflowOwner", workflowOwner, "err", err)
-		return LinkedVaultRequestIdentity{}, err
-	}
-	s.lggr.Debugw("resolved request identity", "orgID", linked.OrgID, "workflowOwner", linked.WorkflowOwner)
-
-	return linked, nil
-}
-
 func NewCapability(
 	lggr logger.Logger,
 	clock clockwork.Clock,
 	expiresAfter time.Duration,
 	handler *requests.Handler[*vaulttypes.Request, *vaulttypes.Response],
 	capabilitiesRegistry core.CapabilitiesRegistry,
 	publicKey *LazyPublicKey,
-	orgResolver orgresolver.OrgResolver,
 	limitsFactory limits.Factory,
 	lifecycle *RequestLifecycleTracker,
 ) (*Capability, error) {
@@ -401,10 +341,6 @@ func NewCapability(
 	if err != nil {
 		return nil, fmt.Errorf("could not create request batch size limiter: %w", err)
 	}
-	linker, err := NewOrgIDToWorkflowOwnerLinker(orgResolver, limitsFactory)
-	if err != nil {
-		return nil, err
-	}
 	ciphertextLimiter, err := limits.MakeUpperBoundLimiter(limitsFactory, cresettings.Default.VaultCiphertextSizeLimit)
 	if err != nil {
 		return nil, fmt.Errorf("could not create ciphertext size limiter: %w", err)
@@ -428,7 +364,6 @@ func NewCapability(
 		handler:              handler,
 		capabilitiesRegistry: capabilitiesRegistry,
 		publicKey:            publicKey,
-		linker:               linker,
 		lifecycle:            lifecycle,
 		RequestValidator:     NewRequestValidator(limiter, ciphertextLimiter, idKeyLengthLimiter, idOwnerLengthLimiter, idNamespaceLengthLimiter),
 	}, nil