eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Improve auth explain diagnostics

Browse source
This commit is contained in:
Eric Wendland 2026-05-22 14:28:44 +02:00
commit ee80ff780c
7 changed files with 516 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

29
docs/architecture.md
View file

@ -59,11 +59,13 @@ endpoint candidates, timestamp, signing public key, and an Ed25519 signature
over a canonical payload. Imported and ping-discovered peer cards are stored as
untrusted metadata in `peer_cards`; trust reduction is future work. `auth
explain` reports when a subject is only a discovered peer candidate and denies
access. The peer ping path authenticates the Iroh endpoint and peer-card
signature, but it does not authorize any resource module. Protected peer
control requests must also prove that the signed peer card binds the observed
Iroh EndpointID, then reduce resource auth ops; an EndpointID alone is not
accepted as a resource principal.
access. It also reports whether a trusted node has no endpoint binding, whether
the discovered peer card has no endpoint bound to that node, or whether a peer
card endpoint matches the reduced keychain view. The peer ping path
authenticates the Iroh endpoint and peer-card signature, but it does not
authorize any resource module. Protected peer control requests must also prove
that the signed peer card binds the observed Iroh EndpointID, then reduce
resource auth ops; an EndpointID alone is not accepted as a resource principal.
The daemon starts this endpoint during `geth daemon run` and keeps it alive for
the daemon lifetime. When endpoint startup succeeds, the Iroh EndpointID is
@ -309,13 +311,16 @@ both signed logs so the new node can see its approved identity and permissions.
The authorization plane is `geth-auth`: resource-local signed operation logs,
grants, revocations, groups, and `auth explain`. Auth operations reduce into a
current permission view for resources, grants, groups, and bearer access. The
library can explain direct and group grants. The daemon persists local auth
grant/revoke operations and `geth auth explain` evaluates that local operation
log. `geth node grant`, `geth node revoke-grant`, `geth auth grant`, and `geth
auth revoke` require `--signing-key` in the CLI and store OpenSSH-signed auth
operations. Enrollment approval uses the same signed auth operation path. Auth
sync imports only auth operations signed by currently trusted admin keys.
Broader delegated authority and module enforcement are still future work.
library can explain direct grants, group grants, missing grants, revoked grants,
and bearer-secret access. The daemon persists local auth grant/revoke operations
and `geth auth explain` enriches the reducer result with keychain and discovery
diagnostics, including discovered-only peers and endpoint-binding state. Human
output prints those diagnostics and JSON output exposes them as structured
strings for scripts. `geth node grant`, `geth node revoke-grant`, `geth auth
grant`, and `geth auth revoke` require `--signing-key` in the CLI and store
OpenSSH-signed auth operations. Enrollment approval uses the same signed auth
operation path. Auth sync imports only auth operations signed by currently
trusted admin keys. Broader delegated authority is still future work.
Capability evaluation supports exact matches plus explicit scoped forms. For KV,
`kv.write_prefix:<prefix>` grants writes requested as `kv.write_key:<key>` only