eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add KV prefix capability matching

Browse source
This commit is contained in:
Eric Wendland 2026-05-17 18:26:30 +02:00
commit 02444a7cfd
5 changed files with 116 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

5
docs/architecture.md
View file

@ -138,6 +138,11 @@ grant/revoke operations and `geth auth explain` evaluates that local operation
log. Signature validation, replication, and module enforcement are still future
work.
Capability evaluation supports exact matches plus explicit scoped forms. For KV,
`kv.write_prefix:<prefix>` grants writes requested as `kv.write_key:<key>` only
when the key is under that prefix; `kv.write` remains the broad write
capability. Command-level KV enforcement is still future work.
Both keychain and auth operations use `geth-codec` canonical envelopes for
signature payloads. The envelope includes a version, an explicit signature
namespace, and the operation payload encoded with postcard. JSON remains useful