eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Wire auth explain to local auth ops

Browse source
This commit is contained in:
Eric Wendland 2026-05-16 16:32:03 +02:00
commit f54920bb65
9 changed files with 299 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

12
docs/roadmap.md
View file

@ -159,11 +159,15 @@ resource-scoped capability decisions.
`kv.write_prefix:apps/foo/`.
- Tests cover grant, revoke, group membership, and denied access.
- `[ ]` `auth explain` real decision path.
- `[~]` `auth explain` real decision path.
Acceptance criteria:
- `geth auth explain <subject> <resource> <capability>` reports allowed/denied.
- Output includes the operation chain or missing grant that caused the result.
- JSON output is stable enough for tests and scripts.
- `[x]` `geth auth grant` and `geth auth revoke` persist local auth ops.
- `[x]` `geth auth explain <subject> <resource> <capability>` reports
allowed/denied from the local auth-op reducer when local ops exist.
- `[x]` Output includes the grant ID or missing grant that caused the result.
- `[x]` JSON output is stable enough for tests and scripts.
- `[ ]` Future completion requires signed-op validation before accepting
replicated auth ops.
- `[ ]` Resource secrets and bearer invites.
Acceptance criteria: