이슈 #458
진행중이슈 #457: Stronger capability APIs — design spike (ADR-0010)
Stronger capability APIs — MR A: capability session / rotation (ADR-0011)
설명
ADR-0010 MR A. 서버 추적 capability session을 도입해 capability grant를 TTL 전에 rotate/revoke 가능하게.
작업¶
- capability_sessions 테이블 (migration v23): id, principal/ns/app, status(active/rotated/revoked), created/rotated/revoked/expires
- store: Insert/Get/Revoke/Rotate/Classify (+ cap_ id, ErrCapabilitySessionNotFound)
- capability JWT에 cap_session claim 바인딩; 쿠키 발급 시 세션 생성 (fail-closed)
- gateway use-time lookup, active만 통과 (rotated/revoked/expired/missing 거부; empty=legacy unbound)
- ADR-0011 (Accepted), ADR-0010 MR A landed 링크
관련¶
- parent #457 (ADR-0010 design spike)
- 후속: MR B (approval envelope), MR C (delegation)
- 코드/리뷰는 GitLab MR, 본 이슈는 링크/상태만 유지
HP Henry Park이(가) 5달 전에 변경
- 상태을(를) 신규에서 진행(으)로 변경되었습니다.
MR !8 (capability session + rotation/revocation, ADR-0011): open, in review.
https://git.alphea.io/Alphea-Dev/alphea-edge-core/-/merge_requests/8
capability_sessions table (v23) + store CRUD/rotate + JWT cap_session binding + gateway use-time enforcement. On merge → Resolved.
Status → In Progress.
HP Henry Park이(가) 5달 전에 변경
- 상태을(를) 진행에서 해결(으)로 변경되었습니다.
- 진척도을(를) 0에서 100(으)로 변경되었습니다.
MR !8 merged to main (merge 2effd1f). Re-review: no remaining findings (two P2s on rotation-of-expired and gateway grant-binding addressed in cf5795c).
https://git.alphea.io/Alphea-Dev/alphea-edge-core/-/merge_requests/8
ADR-0011 (Accepted) in main: capability_sessions + rotation/revocation + gateway use-time enforcement. ADR-0010 MR A done; remaining MR B (approval envelope), MR C (delegation).
Status → Resolved.