Repository navigation
Grant the trace-forward capability from an operator allowlist, not a self-declared role - #9
Open
sumerjohal wants to merge 1 commit into
Open
sumerjohal wants to merge 1 commit into
sumerjohal wants to merge 1 commit into
Conversation
…ot a self-declared role generate_jwt wrote capabilities=["trace-forward"] whenever role == "authority", and role is free text the user types at open registration (user_schemas.py). The node still demanded a verified grant or authority credential before disclosing anything, so nothing leaked on the role alone; but a permission anyone can give themselves is not a permission. Capabilities now come only from HUB_AUTHORITY_ACCOUNTS, a comma-separated allowlist of account emails set by the operator. role stays a descriptive field. generate_jwt keeps its signature; the role argument is not consulted. tests/test_capabilities.py is the first suite in this repository; test_generate_jwt_ignores_the_role_argument fails against the previous code. A CI workflow runs the suite on push and pull request. Review finding: agstack review H1 (geoid comparison markup, 2026-10-08).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
generate_jwtwrotecapabilities=["trace-forward"]into the hub token wheneverrole == "authority".roleis a free-text field the user types at open registration (user_schemas.pyl.20), so the capability was self-assigned.The node still demands a verified grant or an authority credential (Gate B) before it discloses anything, so no data leaked on the role alone. But a permission anyone can give themselves is not a permission, and a reader of the token could not tell an accredited authority from a user who typed the word.
Change
capabilities.py: capabilities come only fromHUB_AUTHORITY_ACCOUNTS, a comma-separated allowlist of account emails set by the operator. Unset means no account carries the capability.generate_jwtkeeps its signature; theroleargument is no longer consulted.roleremains a descriptive field.Tests
First test suite in this repository, with a CI workflow.
test_generate_jwt_ignores_the_role_argumentis the control: it callsgenerate_jwt(..., role="authority")exactly as the login routes do and requires nocapabilitiesclaim. It fails against the previous code.test_the_capability_check_can_fireproves the same decode path sees a capability when one is present, so the control cannot pass vacuously.Run:
python -m pytest tests -q(8 passed).Operator action on deploy
Set
HUB_AUTHORITY_ACCOUNTSto the accredited account emails, or no account will holdtrace-forwardafter this merges. That is the intended default.Review finding H1, agstack review of 2026-10-08.
Made with Cursor