aiolabs/nsecbunkerd
8
0
Fork 0
Code Issues 12 Pull requests Projects Releases Packages Wiki Activity Actions

fix(acl): enforce token grant lifecycle live at sign time (#24, #25) #27

Merged
padreug merged 6 commits from issue-25-live-grant-lifecycle into dev 2026-06-19 16:05:19 +00:00
Conversation 4 Commits 6 Files changed 9 +4 -28
1 changed files with 4 additions and 28 deletions
Download patch file Download diff file Expand all files Collapse all files
Showing only changes of commit 7dcf97a296 - Show all commits

refactor(acl)(#27 review): remove dead reject-all sentinel
Some checks failed
Docker image / build-and-push-image (push) Has been cancelled
Details

Prev Next 
PR #27 review finding #3: step 3a queried SigningCondition method='*'
and the docstring attributed it to rejectAllRequestsFromKey — but that
function writes method=null (never '*') and has zero callers, so the
'reject all' branch could never match. Subject-level reject is already
KeyUser.revokedAt (step 2, via the revoke_user admin command).

Drop the dead step-3a branch and the orphaned rejectAllRequestsFromKey
so the code matches reality. Per-(method,kind) denies (step 3, written
by add_signing_condition) are unaffected.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Padreug 2026-06-19 16:02:13 +02:00
commit 7dcf97a296

32
src/daemon/lib/acl/index.ts
View file

@ -13,7 +13,6 @@ export { grantIsLive } from './lifecycle.js';
* 1. fetch KeyUser; if missing → undefined (no binding exists) * 1. fetch KeyUser; if missing → undefined (no binding exists)
* 2. KeyUser.revokedAt set → false (subject-level ban beats everything) * 2. KeyUser.revokedAt set → false (subject-level ban beats everything)
* 3. manual-override layer (LIVE SigningConditions only): * 3. manual-override layer (LIVE SigningConditions only):
* - live explicit reject (method='*', allowed=false) → false
* - live matching per-(method,kind) deny → false * - live matching per-(method,kind) deny → false
* - live matching per-(method,kind) grant → true * - live matching per-(method,kind) grant → true
* 4. live token grant: a redeemed Token bound to this KeyUser that is * 4. live token grant: a redeemed Token bound to this KeyUser that is
@ -56,16 +55,10 @@ export async function checkIfPubkeyAllowed(
const live = liveWhere(now); const live = liveWhere(now);
// Step 3a: live explicit reject. // Step 3: live matching per-(method, kind) override — deny beats grant.
const explicitReject = await prisma.signingCondition.findFirst({ // (Subject-level "reject all from this user" is KeyUser.revokedAt, applied
where: { keyUserId: keyUser.id, method: '*', allowed: false, ...live }, // at step 2 via the revoke_user admin command. There is no method='*'
}); // SigningCondition sentinel — nothing writes one.)
if (explicitReject) {
return false;
}
// Step 3b: live matching per-(method, kind) override — deny beats grant.
const signingConditionQuery = requestToSigningConditionQuery(method, payload); const signingConditionQuery = requestToSigningConditionQuery(method, payload);
const liveDeny = await prisma.signingCondition.findFirst({ const liveDeny = await prisma.signingCondition.findFirst({
@ -223,20 +216,3 @@ export async function allowAllRequestsFromKey(
console.log('allowAllRequestsFromKey', e); console.log('allowAllRequestsFromKey', e);
} }
} }
export async function rejectAllRequestsFromKey(remotePubkey: string, keyName: string): Promise<void> {
// Upsert the KeyUser with the given remotePubkey
const upsertedUser = await prisma.keyUser.upsert({
where: { unique_key_user: { keyName, userPubkey: remotePubkey } },
update: { },
create: { keyName, userPubkey: remotePubkey },
});
// Create a new SigningCondition for the given KeyUser and set allowed to false
await prisma.signingCondition.create({
data: {
allowed: false,
keyUserId: upsertedUser.id,
},
});
}