Repository navigation
Add pkg/objectstore/actorauthz so out-of-tree object-store providers can run the actor checks - #3358
Draft
Anish Ramasekar (aramase) wants to merge 3 commits into
Draft
Anish Ramasekar (aramase) wants to merge 3 commits into
Anish Ramasekar (aramase) wants to merge 3 commits into
Conversation
Collaborator
Author
ILLUM1N0X
reviewed
Oct 28, 2026
ILLUM1N0X
reviewed
Oct 28, 2026
Anish Ramasekar (aramase)
force-pushed
the
aramase/f/pkg_actorauthz
branch
2 times, most recently
from
October 28, 2026 16:05
a88e650 to
3691d0b
Compare
…authz NewVerifier reads the JWK set once and returns a verifier for Audience with Substrate's claims. The objectstore-plugin exchange calls it, so an exchange outside cmd/ can check tokens the same way. Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
Anish Ramasekar (aramase)
force-pushed
the
aramase/f/pkg_actorauthz
branch
from
October 29, 2026 15:48
3691d0b to
d153f6f
Compare
Anish Ramasekar (aramase)
marked this pull request as ready for review
October 29, 2026 16:16
2 tasks done
Anish Ramasekar (aramase)
marked this pull request as draft
October 29, 2026 16:25
Dmitry Berkovich (dberkov)
requested a review
from Max Thompson (thompsonmax)
October 29, 2026 17:10
2 tasks done
…viders A provider outside this repository cannot import the exchange's actor checks under internal/. The new package wraps them: New builds the JWT verifier and the ate-api-server lookup, and Authorize returns the actor UID and its grants, each prefix a URI ending in "/". New rejects an issuer that is not https://<host>, as ate-setup does. Audience exports the JWT audience, so a provider can mint test tokens without copying the string. package-deps.sh holds the package to the same banned imports as the in-tree actorauthz. Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
…ernal/ Go allows a pkg/ package to import internal/ and an outside module to import that package. The script builds such packages from an outside module and checks the same module cannot import internal/ directly. Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
Anish Ramasekar (aramase)
force-pushed
the
aramase/f/pkg_actorauthz
branch
from
October 30, 2026 06:11
d153f6f to
83f8736
Compare
Collaborator
|
Anish Ramasekar (@aramase) is this meant to be a draft still? |
Collaborator
Author
|
Benjamin Elder (@BenTheElder) yes, until #3447 merges. It removes |
Collaborator
The #3447 was not approved for RC2 yet. We did not discuss it during grooming meeting yesterday. |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Step 2 of #3095. A provider in its own repository cannot import the actor checks under
internal/. Draft until #3447 merges and removesConfig.JWKSFile.actorauthz.NewVerifierininternal/objectstoreplugin/actorauthzbuilds the JWT verifier for both the in-tree exchange and this package.New(ctx, Config)builds the verifier forAudienceand the ate-api-server lookup. A missing field, an issuer that is nothttps://<host>, or a bad JWKS file fails at start.Audienceis theactor_jwtaudience. Providers can use it to mint test tokens. A test keeps it equal to the in-tree value.Authorize(ctx, jwt)returns aDecisionwithActorUIDandGrants. Errors are gRPC status errors.Grant.Prefixends in/, so a prefix match cannot reach a sibling actor.hack/verify/package-deps.shbans cloud SDK imports, andhack/verify/pkg-external-import.shbuilds the package from an outside module.Tested on macOS with
hack/verify-all.sh, which passes, andgo test -race ./.... Onlycmd/atenet/internal/routerandcmd/ateworker-microvm/internal/childfail, and they fail the same way on main. I did not run e2e.