mirror of
https://github.com/hanzoai/compute.git
synced 2026-10-30 14:50:41 +00:00
zooqueenandHanzo Dev
ea3627bb21
Hanzo IAM is original clean-room work — it is not, and never was, a fork of that identity server. The Casdoor-derived one was iam-v1, retired. So: - comments now say "IAM owner" / "upstream default keypair" — same fact, no vendor name - the app.conf legacy-key fallback is dead: conf/app.conf, k8s/configmap.yaml and the README all set iamEndpoint/iamOrganization/iamApplication, and nothing anywhere sets the old keys. With the fallback gone the cfg() variadic degenerates to conf.GetConfigString, so it goes too — one way to read config - swagger schema renamed to iam.Permission, matching this repo's import alias go build ./... clean. Co-authored-by: Hanzo Dev <[email protected]>
11 lines
628 B
Plaintext
11 lines
628 B
Plaintext
# Intentionally NOT a valid certificate.
|
|
#
|
|
# The JWT verification cert MUST be supplied at runtime via KMS-synced config
|
|
# (jwtPublicKeyBase64 / jwtPublicKey in app.conf) — see controllers/account.go
|
|
# InitAuthConfig. This placeholder is the embedded fallback: it is deliberately
|
|
# not a parseable PEM, so if the config cert is ever missing, signature
|
|
# verification FAILS CLOSED (rejects every token) instead of trusting a shipped
|
|
# key. The previous embedded value was an upstream default keypair whose private
|
|
# key is published — trusting it on missing config was a fail-open auth bypass.
|
|
# Do not put a real cert here.
|