eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Separate bearer ids from private tokens

Browse source
This commit is contained in:
Eric Wendland 2026-05-20 13:10:34 +02:00
commit 460acab67b
9 changed files with 198 additions and 62 deletions
Download patch file Download diff file Expand all files Collapse all files

5
crates/geth-auth/src/lib.rs
View file

@ -48,6 +48,7 @@ pub enum AuthOpKind {
},
BearerAccessCreate {
secret: SecretId,
token_hash: Option<String>,
capabilities: Vec<Capability>,
expires_at: Option<UnixMillis>,
},
@ -99,6 +100,7 @@ pub struct GroupRecord {
#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
pub struct BearerAccessRecord {
pub secret: SecretId,
pub token_hash: Option<String>,
pub resource: ResourceId,
pub capabilities: Vec<Capability>,
pub expires_at: Option<UnixMillis>,
@ -150,6 +152,7 @@ pub fn reduce_auth_ops(ops: &[AuthOp]) -> AuthView {
}
AuthOpKind::BearerAccessCreate {
secret,
token_hash,
capabilities,
expires_at,
} => {
@ -160,6 +163,7 @@ pub fn reduce_auth_ops(ops: &[AuthOp]) -> AuthView {
secret.clone(),
BearerAccessRecord {
secret: secret.clone(),
token_hash: token_hash.clone(),
resource: op.resource.clone(),
capabilities,
expires_at: *expires_at,
@ -542,6 +546,7 @@ mod tests {
4,
AuthOpKind::BearerAccessCreate {
secret: "secret:invite".into(),
token_hash: Some("token-hash".to_owned()),
capabilities: vec!["pipe.connect".into()],
expires_at: Some(UnixMillis(100)),
},