Enforce local KV write capabilities

This commit is contained in:
Eric Wendland 2026-05-18 04:06:41 +02:00
commit 5751748458
8 changed files with 118 additions and 10 deletions

View file

@ -237,7 +237,8 @@ authorization and durable-state boundaries clear.
- `[x]` The auth evaluator allows `kv.write_prefix:<prefix>` grants to
satisfy matching `kv.write_key:<key>` requests.
- `[x]` Tests cover allowed and denied prefix-scoped KV write explanations.
- `[ ]` `geth kv set` enforces local capability decisions for the caller.
- `[x]` `geth kv set --subject <principal>` enforces local capability
decisions for non-local test callers.
- `[ ]` KV metadata is replicated through Iroh Documents.
- `[~]` Iroh-gossip pubsub integration.