Add KV prefix capability matching

This commit is contained in:
Eric Wendland 2026-05-17 18:26:30 +02:00
commit 02444a7cfd
5 changed files with 116 additions and 6 deletions

View file

@ -225,7 +225,10 @@ authorization and durable-state boundaries clear.
Acceptance criteria:
- `[x]` `geth kv create/set/get` works against a named local KV resource.
- `[x]` KV metadata and entries are durable in the local SQLite store.
- `[ ]` Prefix-scoped capabilities can allow or deny writes.
- `[x]` The auth evaluator allows `kv.write_prefix:<prefix>` grants to
satisfy matching `kv.write_key:<key>` requests.
- `[x]` Tests cover allowed and denied prefix-scoped KV write explanations.
- `[ ]` `geth kv set` enforces local capability decisions for the caller.
- `[ ]` KV metadata is replicated through Iroh Documents.
- `[~]` Iroh-gossip pubsub integration.