hanzoai/gateway
2
0
Fork 0
mirror of https://github.com/hanzoai/gateway.git synced 2026-11-02 23:52:23 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
edge/auth-dedup-kms-seal
gateway/tests/fixtures/policy/canon_gating.json
T
zeekayandHanzo Dev c07944817d auth: gate the lux node-control routes, freeze the drift baseline 
POST /v1/keystore and GET /v1/metrics reach the node's key management and its
internals. Both were public by inheritance — open because nothing on canon said
otherwise — and neither is a route anyone meant to leave open: keystore is
absent from every live ConfigMap, and nothing scrapes the gateway's routed
/v1/metrics. They join POST /v1/admin as stated false. The completeness check
requires every route stated either way, so this is a decision now, not an
omission.

The drift test read its baseline from canon/main, which worked only until this
change merged: after that the ref returns this very config and the check
compares it against itself. The pre-migration gating is now a frozen fixture, so
the property is guarded the same way in review, in CI with no remotes, and on
main tomorrow. The test fails rather than skips when the baseline cannot be
read.

Co-authored-by: Hanzo Dev <[email protected]>
2026-08-21 07:01:13 -07:00

243 lines
9.0 KiB
JSON
Raw Permalink Blame History

{
"_comment": "Pre-migration credential gating of configs/hanzo/gateway.json, captured from the canonical main before auth/validator was replaced by auth/public. Keys are routes in the router's normalized form ({param} rendered :param); value is whether the route was auth/validator-gated. The shipped config must state auth/public:false on exactly the true entries and true on the false ones; TestShippedConfigMatchesTheGatingItReplaced holds it to that. A frozen baseline, not a moving ref, so the property is guarded the same way after this change merges.",
"routes": {
"GET /": false,
"GET /agents/:path": true,
"POST /agents/:path": true,
"GET /ai/:path": false,
"POST /ai/:path": false,
"GET /analytics/:path": true,
"POST /analytics/:path": true,
"DELETE /auth/:path": true,
"GET /auth/:path": true,
"PATCH /auth/:path": true,
"POST /auth/:path": true,
"PUT /auth/:path": true,
"GET /base/:path": true,
"POST /base/:path": true,
"GET /bot/:path": true,
"POST /bot/:path": true,
"GET /bot/health": false,
"GET /bot/ws": true,
"GET /chat/:path": true,
"POST /chat/:path": true,
"DELETE /cloud/:path": true,
"GET /cloud/:path": true,
"PATCH /cloud/:path": true,
"POST /cloud/:path": true,
"GET /console/:path": true,
"POST /console/:path": true,
"GET /functions/:path": true,
"POST /functions/:path": true,
"GET /health": false,
"GET /infra/:path": true,
"POST /infra/:path": true,
"DELETE /kms/:path": true,
"GET /kms/:path": true,
"PATCH /kms/:path": true,
"POST /kms/:path": true,
"GET /operative/:path": true,
"POST /operative/:path": true,
"GET /platform/:path": true,
"POST /platform/:path": true,
"GET /pricing": true,
"GET /pricing/:path": true,
"POST /pricing/:path": true,
"GET /pricing/model/:name": true,
"GET /pubsub/connz": true,
"GET /pubsub/healthz": false,
"GET /pubsub/jsz": true,
"GET /pubsub/subsz": true,
"GET /pubsub/varz": true,
"GET /search/:path": true,
"POST /search/:path": true,
"GET /team/_accounts/:path": true,
"POST /team/_accounts/:path": true,
"GET /team/_collaborator/:path": true,
"POST /team/_rekoni/:path": true,
"GET /team/_transactor/:path": true,
"GET /v1/agents/:path": true,
"POST /v1/agents/:path": true,
"GET /v1/ai/:path": false,
"POST /v1/ai/:path": false,
"GET /v1/ai/providers": false,
"POST /v1/ai/providers": true,
"GET /v1/ai/providers/:owner/:name": false,
"PATCH /v1/ai/providers/:owner/:name": true,
"GET /v1/ai/providers/global": true,
"GET /v1/analytics/:path": true,
"POST /v1/analytics/:path": true,
"GET /v1/analytics/heartbeat": false,
"POST /v1/async-invoke": true,
"GET /v1/async-invoke/:request_id": true,
"GET /v1/async-invoke/:request_id/status": true,
"POST /v1/audio/speech": true,
"POST /v1/audio/transcriptions": true,
"GET /v1/audit": true,
"POST /v1/audit": true,
"GET /v1/auth/:path": true,
"POST /v1/auth/:path": true,
"GET /v1/base/:path": true,
"POST /v1/base/:path": true,
"GET /v1/billing/accounts": true,
"POST /v1/billing/accounts": true,
"GET /v1/billing/accounts/:id": true,
"GET /v1/billing/accounts/:id/members": true,
"POST /v1/billing/accounts/:id/members": true,
"DELETE /v1/billing/accounts/:id/members/:mid": true,
"PATCH /v1/billing/accounts/:id/members/:mid": true,
"GET /v1/billing/balance": true,
"POST /v1/billing/credit": true,
"GET /v1/billing/credit-balance": true,
"GET /v1/billing/credit-grants": true,
"POST /v1/billing/customers/:id/default-payment-method": true,
"POST /v1/billing/deposit": true,
"GET /v1/billing/discount/validate": true,
"GET /v1/billing/invoices": true,
"GET /v1/billing/me/balance": true,
"POST /v1/billing/me/welcome": true,
"GET /v1/billing/meter-events/summary": true,
"GET /v1/billing/meters": true,
"POST /v1/billing/payment": true,
"GET /v1/billing/payment-methods": true,
"POST /v1/billing/payment-methods": true,
"DELETE /v1/billing/payment-methods/:id": true,
"POST /v1/billing/payment-methods/:id/default": true,
"GET /v1/billing/plans": true,
"GET /v1/billing/plans/:id": true,
"GET /v1/billing/portal/overview": true,
"GET /v1/billing/spend-alerts": true,
"POST /v1/billing/spend-alerts": true,
"DELETE /v1/billing/spend-alerts/:id": true,
"PATCH /v1/billing/spend-alerts/:id": true,
"GET /v1/billing/subscriptions": true,
"POST /v1/billing/subscriptions": true,
"DELETE /v1/billing/subscriptions/:id": true,
"GET /v1/billing/subscriptions/:id": true,
"PATCH /v1/billing/subscriptions/:id": true,
"POST /v1/billing/subscriptions/:id/promotion": true,
"POST /v1/billing/topup": true,
"POST /v1/billing/topup/token": true,
"GET /v1/billing/transactions": true,
"GET /v1/billing/usage": true,
"GET /v1/bot/:path": true,
"POST /v1/bot/:path": true,
"GET /v1/bot/health": false,
"GET /v1/bot/ws": true,
"POST /v1/chat": false,
"GET /v1/chat/:path": true,
"POST /v1/chat/:path": true,
"POST /v1/chat/completions": false,
"GET /v1/cloud": true,
"DELETE /v1/cloud/:path": true,
"GET /v1/cloud/:path": true,
"PATCH /v1/cloud/:path": true,
"POST /v1/cloud/:path": true,
"GET /v1/commerce/:path": true,
"POST /v1/commerce/:path": true,
"POST /v1/completions": false,
"GET /v1/console/:path": true,
"POST /v1/console/:path": true,
"DELETE /v1/dns/:path": true,
"GET /v1/dns/:path": true,
"PATCH /v1/dns/:path": true,
"POST /v1/dns/:path": true,
"POST /v1/embeddings": true,
"GET /v1/evals/:path": true,
"POST /v1/evals/:path": true,
"GET /v1/functions/:path": true,
"POST /v1/functions/:path": true,
"GET /v1/gpu": true,
"POST /v1/images/generations": true,
"GET /v1/infra/:path": true,
"POST /v1/infra/:path": true,
"GET /v1/insights/:path": true,
"POST /v1/insights/:path": true,
"DELETE /v1/kms/:path": true,
"GET /v1/kms/:path": true,
"PATCH /v1/kms/:path": true,
"POST /v1/kms/:path": true,
"GET /v1/kms/orgs/:org/secrets": true,
"POST /v1/kms/orgs/:org/secrets": true,
"DELETE /v1/kms/orgs/:org/secrets/:name": true,
"GET /v1/kms/orgs/:org/secrets/:name": true,
"PATCH /v1/kms/orgs/:org/secrets/:name": true,
"POST /v1/kms/orgs/:org/secrets/:name": true,
"GET /v1/licensing/:path": true,
"POST /v1/licensing/:path": true,
"GET /v1/memory/:action": true,
"POST /v1/memory/:action": true,
"POST /v1/messages": false,
"GET /v1/ml/health": false,
"GET /v1/ml/models": true,
"POST /v1/ml/models": true,
"DELETE /v1/ml/models/:name": true,
"GET /v1/ml/models/:name": true,
"PATCH /v1/ml/models/:name": true,
"POST /v1/ml/models/:name/predict": true,
"GET /v1/models": false,
"GET /v1/mpc/:path": true,
"POST /v1/mpc/:path": true,
"GET /v1/o11y/:path": true,
"POST /v1/o11y/:path": true,
"GET /v1/operative/:path": true,
"POST /v1/operative/:path": true,
"GET /v1/plans": true,
"GET /v1/platform/:path": true,
"POST /v1/platform/:path": true,
"GET /v1/pricing": true,
"GET /v1/pricing-policy": false,
"GET /v1/pricing/:path": true,
"POST /v1/pricing/:path": true,
"GET /v1/pricing/model/:name": true,
"GET /v1/product/:path": true,
"POST /v1/product/:path": true,
"GET /v1/provisioning/:path": true,
"POST /v1/provisioning/:path": true,
"GET /v1/pubsub/connz": true,
"GET /v1/pubsub/healthz": false,
"GET /v1/pubsub/jsz": true,
"GET /v1/pubsub/subsz": true,
"GET /v1/pubsub/varz": true,
"GET /v1/search/:path": true,
"POST /v1/search/:path": true,
"GET /v1/tasks/:path": true,
"POST /v1/tasks/:path": true,
"GET /v1/team/_accounts/:path": true,
"POST /v1/team/_accounts/:path": true,
"GET /v1/team/_collaborator/:path": true,
"POST /v1/team/_rekoni/:path": true,
"GET /v1/team/_transactor/:path": true,
"GET /v1/tools": true,
"GET /v1/train/experiments": true,
"POST /v1/train/experiments": true,
"DELETE /v1/train/experiments/:name": true,
"GET /v1/train/experiments/:name": true,
"GET /v1/train/experiments/:name/trials": true,
"GET /v1/train/health": false,
"GET /v1/train/jobs": true,
"POST /v1/train/jobs": true,
"DELETE /v1/train/jobs/:name": true,
"GET /v1/train/jobs/:name": true,
"GET /v1/usage/:path": true,
"POST /v1/usage/:path": true,
"GET /v1/vector/:path": true,
"POST /v1/vector/:path": true,
"DELETE /v1/web3/:path": true,
"GET /v1/web3/:path": true,
"PATCH /v1/web3/:path": true,
"POST /v1/web3/:path": true,
"DELETE /v1/world/:path": true,
"GET /v1/world/:path": true,
"PATCH /v1/world/:path": true,
"POST /v1/world/:path": true,
"PUT /v1/world/:path": true,
"GET /vector/:path": true,
"POST /vector/:path": true,
"DELETE /web3/:path": true,
"GET /web3/:path": true,
"PATCH /web3/:path": true,
"POST /web3/:path": true
}
}
Reference in New Issue View Git Blame Copy Permalink