프로젝트

일반

사용자정보

Actions
Copy link

이슈 #460

진행중
HP JL

이슈 #457: Stronger capability APIs — design spike (ADR-0010)

Stronger capability APIs — MR C: delegation (ADR-0013)

이슈 #460: Stronger capability APIs — MR C: delegation (ADR-0013)

Henry Park이(가) 약 5시간 전에 추가함.

상태:
해결
우선순위:
보통
담당자:
James Lee
목표버전:
6월 중간 버전
시작일:
2026/05/21
완료일:
진척도:

100%

추정시간:

설명

ADR-0010 MR C (마지막 슬라이스). capability session 간 delegation: issuer cap_session이 delegatee cap_session에게 attenuated scope 부여.

작업

  • capability_delegations 테이블 (migration v25): issuer/delegatee session(FK), issuer ns/app, scope_read/write(JSONB), status, expiry
  • store: Insert(INSERT...SELECT: issuer ns/app 도출 + 양쪽 세션 active 필수), GetActive(delegation+issuer+delegatee 모두 active = cascade), Get, Revoke
  • handler: scopeSubset(attenuation, prefix-glob), CreateDelegation(issuer manifest effective scope에 subset 검증), AuthorizeDelegatedAccess(both active + caller-bound delegatee + scope + manifest drift 재검증 → resolved target)
  • verified cap_session 기반으로만 생성/사용, raw ambient app identity 아님
  • ADR-0013 (Accepted), ADR-0010 → Accepted (3개 슬라이스 모두 landed)

관련

  • parent #457, follows #458(MR A), #459(MR B)
  • 후속: cross-app fs route / signing-payment provider
  • 코드/리뷰는 GitLab MR, 본 이슈는 링크/상태만 유지

HP Henry Park이(가) 5달 전에 변경 Actions
Copy link
 #1

  • 상태을(를) 신규에서 진행(으)로 변경되었습니다.

MR !10 (capability-session delegation, ADR-0013): open, in review.
https://git.alphea.io/Alphea-Dev/alphea-edge-core/-/merge_requests/10

capability_delegations table (v25) + store Insert/GetActive(cascade)/Revoke + handler scopeSubset(attenuation)/CreateDelegation/AuthorizeDelegatedAccess(use-time revalidation). ADR-0013 Accepted, ADR-0010 → Accepted. On merge → Resolved (and #457 parent can close once all children done).

Status → In Progress.

HP Henry Park이(가) 5달 전에 변경 Actions
Copy link
 #2

  • 상태을(를) 진행에서 해결(으)로 변경되었습니다.
  • 진척도을(를) 0에서 100(으)로 변경되었습니다.

MR !10 merged to main (merge 4220bd4). Re-review: no remaining findings (P2 on token-vs-manifest attenuation addressed in c901300 — create-time now bounds delegation by token ∩ manifest).
https://git.alphea.io/Alphea-Dev/alphea-edge-core/-/merge_requests/10

ADR-0013 (Accepted) in main: capability-session delegation (attenuating-only, use-time revalidated, session cascade). With MR A/B/C all landed, ADR-0010 is Accepted.

Status → Resolved.

Actions
Copy link

내보내기 PDF Atom