{"record":{"id":"fda955dde9f99a83","repo":"paperclipai/paperclip","slug":"invalid-cloud-runtime-identity","errorCode":"invalid_cloud_runtime_identity","errorMessage":"invalid_cloud_runtime_identity","messagePattern":"invalid_cloud_runtime_identity","errorType":"http","errorClass":null,"httpStatus":401,"severity":"error","filePath":"server/src/middleware/cloud-runtime-identity.ts","lineNumber":30,"sourceCode":" * header, and possession of the shared tenant-session token cannot mint it.\n */\nexport function cloudRuntimeIdentityMiddleware(db: Db): RequestHandler {\n  return async (req, res, next) => {\n    const assertion = req.get(CLOUD_RUNTIME_IDENTITY_HEADER)?.trim();\n    if (!assertion) {\n      next();\n      return;\n    }\n    if (req.method !== \"GET\" || req.path !== \"/api/health\") {\n      res.status(400).json({ error: \"cloud_runtime_identity_wrong_endpoint\" });\n      return;\n    }\n    try {\n      await applyCloudRuntimeIdentityAssertion({ db, compactJws: assertion });\n      next();\n    } catch (error) {\n      logger.warn({ err: error }, \"Rejected Cloud runtime identity assertion\");\n      res.status(401).json({ error: \"invalid_cloud_runtime_identity\" });\n    }\n  };\n}\n","sourceCodeStart":12,"sourceCodeEnd":34,"githubUrl":"https://github.com/paperclipai/paperclip/blob/01ad8584922b5d85292b1723cae71fa0d9b07a19/server/src/middleware/cloud-runtime-identity.ts#L12-L34","documentation":"The middleware verified a Cloud runtime identity assertion via applyCloudRuntimeIdentityAssertion, and the verification threw (bad signature, expired token, wrong issuer/audience, malformed compact JWS). The middleware logs a warning and responds 401 with this code. It means the assertion was present and on the right endpoint, but its cryptographic or semantic contents failed validation.","triggerScenarios":"applyCloudRuntimeIdentityAssertion({ db, compactJws: assertion }) rejects the compact JWS: signature verification failure, expired assertion, key not found, wrong audience, or a malformed JWT. Thrown for any GET /api/health request carrying an invalid assertion header.","commonSituations":"Clock skew between the runtime and the identity issuer expires assertions early; rotated signing keys not yet present in the verifier's key set; truncated or re-encoded tokens from header sanitization; a stale runtime reusing an assertion from a previous identity.","solutions":["Check the server logs for the accompanying 'Rejected Cloud runtime identity assertion' warning to see the underlying verification error","Regenerate the runtime identity assertion (fresh signing key, current timestamps) and retry the health request","Verify the issuer's signing keys are present and synced with the verifier (key rotation propagation)","Confirm clock sync (NTP) on the runtime container to avoid premature expiry","Validate the compact JWS is untruncated and not header-escaped before sending"],"exampleFix":"// before (stale assertion reused)\nconst assertion = cachedAssertionFromBoot;\n// after (refresh before each health probe)\nconst assertion = await fetchFreshRuntimeIdentityAssertion();","handlingStrategy":"try-catch","validationCode":"function isWellFormedCompactJws(t: string) { const p = t.split('.'); return p.length === 3 && p.every(s => s.length > 0); }","typeGuard":"null","tryCatchPattern":"try { await applyCloudRuntimeIdentityAssertion({ db, compactJws: assertion }); } catch (e) { logger.warn({ err: e }, 'runtime identity rejected'); // fail closed, regenerate assertion and retry once with a fresh token }","preventionTips":["Fetch a fresh assertion at probe time rather than caching from boot","Keep verifier signing keys in sync with the issuer (watch rotation events)","Enforce NTP/clock sync in runtime containers","Validate JWS structure before sending"],"tags":["auth","jwt","http-401","middleware"],"backgroundTag":"jwt-token-expired","analyzedSha":"01ad8584922b5d85292b1723cae71fa0d9b07a19","analyzedAt":"2026-09-10T03:14:50.855Z","contentChangedAt":"2026-09-10T03:14:50.855Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}