Repository navigation
auth: the mint ceiling binds the self-serve mint (X-1001) - #945
Merged
Merged
Conversation
POST /auth/token and the browser login minted at self_key_ttl through resolve_exchange alone; MintPolicy::check_mint ran only on the admin POST /keys mint (busbar-core-admin/src/keys.rs:701). The mint ceiling is a kernel valve (BUSBAR-1.6.0.md:157), so an identity an admin could not issue a key past the ceiling minted itself one at the self-serve default. admit_self_mint is the one door both self-serve paths pass: resolve_exchange, then check_mint over the principal's roles, the bindings' pool union and the self-serve default lifetime. The default is clamped to the ceiling (never an explicit ask); pools over a role ceiling refuse 403. With no auth.policy the mint is unchanged (1.5.5 had no auth.policy). RED: self_keys_tests the_block_ttl_ceiling_clamps_the_self_serve_key, a_role_ttl_ceiling_clamps_the_self_serve_key, a_role_pool_ceiling_refuses_a_self_serve_key_over_it; control no_policy_mints_at_the_self_serve_default_and_self_mint_off_still_refuses
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
TODO X-1001 (docs/design/1.6.0-TODO.md:4021): the mint ceiling bound only the admin mint.
check_mintran only atcrates/busbar-core-admin/src/keys.rs:701;crates/busbar-kernel/src/auth/exchange.rs:71andauth/token.rs:616passed onlyself_mintand minted atself_key_ttl_secs.Fix:
admit_self_mint(crates/busbar-kernel/src/auth/self_keys.rs) is the one door both self-serve paths pass:resolve_exchange, thenMintPolicy::check_mintover the principal's roles, the bindings' pool union and the self-serve default lifetime. The default is CLAMPED to the effective ceiling (it is not an explicit ask,apply_mint_ttl_ceiling's default arm); a pool union over a role ceiling refuses 403 (ExchangeError::OverCeiling), as on the admin path. The browser flow shows a "Key not permitted" page.Authority: the mint ceiling is a kernel valve (
docs/design/BUSBAR-1.6.0.md:157,:4285); coordinator ruling 2026-10-14 (core owns the per-office mint ceiling). 1.5.5: had noauth.policyand no ceiling (crates/busbar/src/auth/exchange.rs:62-80@v1.5.5 mints atself_key_ttl_secs). With noauth.policyconfigured this path is unchanged, so no oracle cell diverges and no accepted-difference entry is owed (an entry must match cells; none exercise a 1.6.0-onlyauth.policy).RED (
crates/busbar-kernel/src/auth/tests/self_keys_tests.rs): block max_ttl clamps the self-serve key; a role max_ttl clamps it; a role pool ceiling refuses it. Control: no policy mints at the default;self_mint: falsestill refuses first.File overlap:
auth/token.rsis also edited by #863 (hunks l.232-300); this PR's hunks are l.36-38 and l.600-650 (rule 20, disjoint).