q792602257/agentic-mobile-control
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(cloud-auth): require production credentials

Browse Source
This commit is contained in:
q792602257
2026-07-12 18:02:49 +08:00
parent 82b66f74a2
commit 7d22b5234d
6 changed files with 161 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
openspec/changes/cloud-control-plane-integration/tasks.md
+1 -1
View File
@@ -30,7 +30,7 @@
- [x] 4.1 Extend authenticated principals with scopes and implement constant-time configured bearer-token verification without logging credentials.
- [x] 4.2 Add public scopes for task submission/read, pool read, plugin read, and plugin administration and enforce them on every `/v1` route.
- [x] 4.3 Add host principals bound to one `host_id` and reject cross-host heartbeat, claim, renewal, or result operations.
- [ ] 4.4 Make missing production credentials a startup/readiness failure and permit anonymous mode only through the explicit non-production override.
- [x] 4.4 Make missing production credentials a startup/readiness failure and permit anonymous mode only through the explicit non-production override.
- [ ] 4.5 Add authentication tests covering invalid tokens, missing scopes, host impersonation, plugin administration, and secret redaction.
## 5. Host Agent Internal API