feat(auth): add explicit delegation with legacy compatibility - #6155
Open
pandemicsyn wants to merge 1 commit into
Open
feat(auth): add explicit delegation with legacy compatibility#6155pandemicsyn wants to merge 1 commit into
pandemicsyn wants to merge 1 commit into
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add explicit, short-lived resource-token issuance for API, gateway, organization attribution, and HTML deployment. Personal requests use
/api/auth/resource-token; organization requests opt in with aresourcefield on/api/organizations/[id]/user-tokens. Resource tokens use an exact audience and expire within 15 minutes and the source credential's remaining lifetime.Preserve the existing organization-token response for valid browser sessions and unrestricted legacy bearers without resource negotiation, including one-hour and five-year credentials. Restricted and audience-bound credentials cannot obtain broad legacy tokens. Organization permissions and audit logging remain enforced; personal attribution is rejected.
Extracted from #5976, originating in #5857. This PR targets main independently of mobile and Chat.
Verification
No manual deployed-client smoke tests were run. Automated route tests exercise real JWT verification, database authorization, issuance, and legacy compatibility; browser-session results are substituted in the test environment.
Visual Changes
N/A
Reviewer Notes
DELEGATED_RESOURCE_TOKENS_ENABLEDfalseSHARED_RESOURCE_TOKENS_ENABLEDNew resource issuance requires both Web variables to be exactly
true. No flag needs enabling at merge. Existing no-resource legacy issuance remains available with the family gate off or on. Restricted credentials are denied legacy minting in either state; this restriction is active on deployment. Disabling issuance does not revoke previously issued tokens.Automated validation: 119 tests across 5 suites passed, plus Web typecheck, changed-file lint, formatting, and diff checks. Coverage includes legacy token lifetimes and device sessions, both flag states, organization roles and audit records, invalid/revoked credentials, restricted-token denial, and attribution route/receiver agreement.