Skip to content

Add key co-creator permission validation middleware #1156

Closed
#1206
#1158
Closed
Add key co-creator permission validation middleware#1156
#1206
#1158
Assignees
Samuel-21-eng
Labels
Stellar WaveIssues in the Stellar wave program

Description

@Chucks1093
Chucks1093
opened on Oct 20, 2026

Summary

Build a middleware layer that validates co-creator permissions before proxying creator-only API requests, checking the on-chain co-creator registry to enforce role-based access for ADMIN, CONTENT, and REVENUE roles.

Scope

  • Middleware intercepts creator-action endpoints and checks co-creator role
  • Role-to-endpoint mapping: ADMIN all, CONTENT announcements only, REVENUE royalties/revenue only
  • Co-creator role fetched from GET /keys/:key_id/co-creators/:wallet with 60s cache
  • Returns 403 with role_required and current_role when access denied
  • Primary creator bypasses co-creator check

Acceptance Criteria

  • ADMIN role passes all creator-action endpoints correctly
  • CONTENT role blocked correctly on non-announcement endpoints
  • REVENUE role blocked correctly on non-revenue endpoints
  • 403 returned with correct role_required and current_role
  • Primary creator wallet bypasses check correctly

ETA

12 hours

Activity

  1. drips-wave
    added
    Stellar WaveIssues in the Stellar wave program
    on Oct 20, 2026

  2. AllysiadevOps commented on Oct 20, 2026

    @AllysiadevOps
    AllysiadevOps
    on Oct 20, 2026 – with Drips Wave

    @AllysiadevOps has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

    Hi! I've looked at the issue details and I love this kind of task. I'm confident I can handle it and deliver a well-tested PR on time. I'd be happy if you assign it to me!

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @AllysiadevOps to this issue.

  3. chukwujoshua242-prog commented on Oct 20, 2026

    @chukwujoshua242-prog
    chukwujoshua242-prog
    on Oct 20, 2026 – with Drips Wave

    @chukwujoshua242-prog has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

    hello maintainer, i will love to work on this issue, kindly assign it to me

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @chukwujoshua242-prog to this issue.

  4. Alhajichild commented on Oct 20, 2026

    @Alhajichild
    Alhajichild
    on Oct 20, 2026 – with Drips Wave

    @Alhajichild has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

    Hey would love to work on this

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @Alhajichild to this issue.

  5. ifnanabdulkhadir-hub commented on Oct 20, 2026

    @ifnanabdulkhadir-hub
    ifnanabdulkhadir-hub
    on Oct 20, 2026 – with Drips Wave

    @ifnanabdulkhadir-hub has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

    Hi! I'd like to work on this. I'm a full-stack developer with backend experience in Node/TypeScript APIs, including auth and role-based access middleware.

    My plan:

    • Add a co-creator permission middleware that runs before creator-action routes, following the server's existing middleware pattern
    • Resolve the caller's wallet; if it's the primary creator for the key, skip the co-creator check
    • Otherwise fetch the role from GET /keys/:key_id/co-creators/:wallet, cached for 60s per (key_id, wallet)
    • Central role-to-endpoint map: ADMIN → all creator actions, CONTENT → announcements only, REVENUE → royalties/revenue only
    • On denial, return 403 with { role_required, current_role }; a wallet with no co-creator role gets current_role: null
    • If the registry lookup fails, deny by default rather than letting the request through

    Testing:

    • Unit/integration tests for each acceptance criterion: ADMIN passes all, CONTENT and REVENUE blocked outside their endpoints, correct 403 body, primary creator bypass
    • Test the cache (second request within 60s doesn't re-fetch)

    I'll link the PR with Closes #1156. Before starting I'll confirm how the primary creator is identified and the exact list of creator-action routes, so the mapping matches the code.

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @ifnanabdulkhadir-hub to this issue.

  6. Moradeke242 commented on Oct 20, 2026

    @Moradeke242
    Moradeke242
    on Oct 20, 2026 – with Drips Wave

    @Moradeke242 has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

    Hi maintainer please I will appreciate it if I'm given this issue to work on. Please assign me I'm ready to get started
    Thank you

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @Moradeke242 to this issue.

  7. VeronicDev commented on Oct 20, 2026

    @VeronicDev
    VeronicDev
    on Oct 20, 2026 – with Drips Wave

    @VeronicDev has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

    Hello Maintainer, I can fix this please assign.

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @VeronicDev to this issue.

  8. tijanib141 commented on Oct 20, 2026

    @tijanib141
    tijanib141
    on Oct 20, 2026 – with Drips Wave

    @tijanib141 has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

    hi, please give me this, i can do this fast

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @tijanib141 to this issue.

  9. Wittig18 commented on Oct 20, 2026

    @Wittig18
    Wittig18
    on Oct 20, 2026 – with Drips Wave

    @Wittig18 has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

    hey maintainer, i would love to work on this

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @Wittig18 to this issue.

  10. moon-code12 commented on Oct 20, 2026

    @moon-code12
    moon-code12
    on Oct 20, 2026 – with Drips Wave

    @moon-code12 has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

    Hello Maintainers, I would like to express my interest in working on this issue. I have reviewed the issue description and understand the problem that needs to be addressed. My approach will be to investigate the existing codebase, identify the root cause, and implement a solution that follows the project's existing architecture and coding standards.

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @moon-code12 to this issue.

  11. Amksongs commented on Oct 20, 2026

    @Amksongs
    Amksongs
    on Oct 20, 2026 – with Drips Wave

    @Amksongs has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

    Hello maintainer, i would like to work on this issue

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @Amksongs to this issue.

  12. laykanolah commented on Oct 20, 2026

    @laykanolah
    laykanolah
    on Oct 20, 2026 – with Drips Wave

    @laykanolah has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

    Hi, i am capable of this, please kindly assign to me

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @laykanolah to this issue.

  13. Fabulouz34 commented on Oct 20, 2026

    @Fabulouz34
    Fabulouz34
    on Oct 20, 2026 – with Drips Wave

    @Fabulouz34 has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

    Hi maintainer please I will appreciate it if I'm given this issue to work on. Please assign me I'm ready to get started
    Thank you

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @Fabulouz34 to this issue.

  14. CollinsKRO commented on Oct 20, 2026

    @CollinsKRO
    CollinsKRO
    on Oct 20, 2026 – with Drips Wave

    @CollinsKRO has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

    Hi Maintainer, I can fix this pls assign. ETA 5hrs

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @CollinsKRO to this issue.

  15. Samuel-21-eng commented on Oct 20, 2026

    @Samuel-21-eng
    Samuel-21-eng
    on Oct 20, 2026 – with Drips Wave
    Contributor

    @Samuel-21-eng has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

    Hi maintainer, I would like to work on this

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @Samuel-21-eng to this issue.

  16. Chucks1093
    assigned
    Samuel-21-eng
    on Oct 20, 2026

  17. drips-wave commented on Oct 20, 2026

    @drips-wave
    drips-waveBot
    on Oct 20, 2026 – with Drips Wave

    Congratulations, @Samuel-21-eng! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on October 22, 2026.

    🧑‍💻 @Samuel-21-eng: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

    Warning

    When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

    🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

    🌊 Happy Wave 🌊

  18. Samuel-21-eng
    added a commit that references this issue on Oct 22, 2026

    feat(middleware): add key co-creator permission validation middleware (…

    a2b6284
  19. Chucks1093
    added a commit that references this issue on Oct 23, 2026

    Merge pull request #1206 from Samuel-21-eng/main

    30bb502
  20. Chucks1093
    closed this as completedin #1206on Oct 23, 2026

  21. grantfox-oss commented on Oct 23, 2026

    @grantfox-oss
    grantfox-ossBot
    on Oct 23, 2026 – with GrantFox OSS

    🎉 This issue has been marked as completed on GrantFox!

    @Samuel-21-eng's PR #1206 was approved and merged by @Chucks1093.

    🏆 @Samuel-21-eng: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (446 total points). Track your full progress on GrantFox.

    👏 Great work, @Samuel-21-eng! Keep contributing to accesslayerorg.

  22. drips-wave commented on Oct 23, 2026

    @drips-wave
    drips-waveBot
    on Oct 23, 2026 – with Drips Wave

    This issue has been completed by @Samuel-21-eng as part of the Stellar Wave Program's 10th Wave 🥳

    😎 @Samuel-21-eng: You earned 150 Points for completing this issue! Once the Wave's rewards are finalized, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here. You can also Leave a review to share your experience working on this issue.

    🧑‍💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

Stellar WaveIssues in the Stellar wave program

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions