mirror of
https://github.com/hanzoai/team.git
synced 2026-09-30 01:57:35 +00:00
zeekayandHanzo Dev
efad81ca3b
Roles were a local fact. The Hanzo provider mapped a person's claims onto a user
and never touched Roles, CreateUser then wrote system_user unconditionally, and
the store reverts Roles on any untrusted update — so authority was set once, at
account creation, and nothing ever revisited it. An operator granted the reserved
org in IAM stayed an ordinary user here, and, worse in the other direction, one
demoted in IAM kept administering this server forever. A grant that cannot be
revoked at the issuer is a second authority model, which is the thing there is
supposed to be exactly one of.
The predicate is authz.Claims.PlatformSudo rather than a comparison written here.
Platform authority is MEMBERSHIP of the reserved org, held at any position in the
set, which is not the same question as which org someone is anchored in: an
operator is anchored where they do ordinary work and holds the reserved org
alongside it, so reading `owner` grants nothing to every real operator. That is a
mistake this fabric has already made once; importing the issuer's own predicate is
how it is not made a second time, and it also keeps the verbatim org comparison,
without which any org a customer can name themselves ("Admin") is the reserved one.
Applied beside the org claim in LoginByOAuth, which already re-reads that claim on
every sign-in and covers both a new account and a returning one. A provider that
states no roles leaves the stored value alone, so this is inert for every provider
but ours, and an identity carrying no membership set is not an operator — so it
fails closed and can ship before or after IAM starts sending the claim.
Co-authored-by: Hanzo Dev <[email protected]>
7 lines
32 B
Plaintext
7 lines
32 B
Plaintext
go 1.26.5
|
|
|
|
use (
|
|
.
|
|
./public
|
|
)
|