q792602257/agentic-mobile-control
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(cloud-auth): enforce public scopes

Browse Source
This commit is contained in:
q792602257
2026-07-12 17:56:14 +08:00
parent b916b394c7
commit 71f0a892e3
4 changed files with 113 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
openspec/changes/cloud-control-plane-integration/tasks.md
+1 -1
View File
@@ -28,7 +28,7 @@
## 4. Authentication And Authorization
- [x] 4.1 Extend authenticated principals with scopes and implement constant-time configured bearer-token verification without logging credentials.
- [ ] 4.2 Add public scopes for task submission/read, pool read, plugin read, and plugin administration and enforce them on every `/v1` route.
- [x] 4.2 Add public scopes for task submission/read, pool read, plugin read, and plugin administration and enforce them on every `/v1` route.
- [ ] 4.3 Add host principals bound to one `host_id` and reject cross-host heartbeat, claim, renewal, or result operations.
- [ ] 4.4 Make missing production credentials a startup/readiness failure and permit anonymous mode only through the explicit non-production override.
- [ ] 4.5 Add authentication tests covering invalid tokens, missing scopes, host impersonation, plugin administration, and secret redaction.