q792602257/agentic-mobile-control
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(cloud-auth): verify scoped bearer tokens

Browse Source
This commit is contained in:
q792602257
2026-07-12 17:45:31 +08:00
parent 4cb116f527
commit b916b394c7
4 changed files with 186 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
openspec/changes/cloud-control-plane-integration/tasks.md
+1 -1
View File
@@ -27,7 +27,7 @@
## 4. Authentication And Authorization
- [ ] 4.1 Extend authenticated principals with scopes and implement constant-time configured bearer-token verification without logging credentials.
- [x] 4.1 Extend authenticated principals with scopes and implement constant-time configured bearer-token verification without logging credentials.
- [ ] 4.2 Add public scopes for task submission/read, pool read, plugin read, and plugin administration and enforce them on every `/v1` route.
- [ ] 4.3 Add host principals bound to one `host_id` and reject cross-host heartbeat, claim, renewal, or result operations.
- [ ] 4.4 Make missing production credentials a startup/readiness failure and permit anonymous mode only through the explicit non-production override.