mirror of
https://github.com/hanzoai/base.git
synced 2026-10-21 03:41:50 +00:00
zeekayandHanzo Dev
89adc2a014
A rule that decides what a credential may reach and a door that resolves it agree only if they read the same bytes. Three readers each accepted a different subset of the spellings: the rule read `Bearer ` case-sensitively from one header, the auth door matched the scheme without regard to case across three headers and accepted a bare token, bootnode read X-API-Key first. Past the /v1/iam and /v1/idv mounts — which forward headers and query verbatim with the key doors unbound — the rule is the only thing standing, so a spelling it did not read was a key the issuer authenticated. apis.Credential is that one reader: the Bearer scheme matched without regard to case and separated by spaces or tabs, a bare token, the four headers in order, then the `key` query parameter. A value naming another scheme presents no token, so a Basic blob is not compared against key prefixes. The query is split on `;` as well as `&`, because this answer decides what gets forwarded and the far side may split either way. bootnode classifies by the credential rather than by which header carried it — the same token was a JWT under one header and unsupported under another — and a shape it does not recognise is IAM's to judge. Co-authored-by: Hanzo Dev <[email protected]>