eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add resource-scoped bearer access metadata

Browse source
This commit is contained in:
Eric Wendland 2026-05-17 02:58:58 +02:00
commit d072843cac
10 changed files with 344 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

6
docs/architecture.md
View file

@ -140,8 +140,10 @@ for CLI/control output, but it is not the signed representation.
The payload access plane is `geth-secrets`: resource master secrets, epochs,
key envelopes, bearer secrets, and rotation. Revocation for private data is
modeled initially as secret epoch rotation. The daemon persists resource secret
epoch metadata through `secret create/rotate/status`, but it does not yet store
payload key material, encrypt resource data, or distribute key envelopes.
epoch metadata through `secret create/rotate/status`. Bearer access is recorded
as resource-scoped auth operations and rejects trust-mutation capabilities such
as `auth.delegate`, `auth.revoke`, and `node.enroll`. The daemon does not yet
store payload key material, encrypt resource data, or distribute key envelopes.
## Multi-User Direction