Skip to content

feat(auth): Make AuthContext support an optional ObjectKey bound #428

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
lcian wants to merge 17 commits into
base: main
Choose a base branch
from
+294 −55
Draft

feat(auth): Make AuthContext support an optional ObjectKey bound #428

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
de2c936
refactor(auth): split context and object authorization
lcian Apr 13, 2026
9775aca
refactor(auth): store only bound object key
lcian Apr 13, 2026
c52163f
docs(auth): clarify object-bound auth fields
lcian Apr 13, 2026
df066cc
test(auth): cover scope-bound object authorization
lcian Apr 13, 2026
f2f43c5
refactor(extractors): keep path parsers in presign stack
lcian Apr 13, 2026
23b11b5
updates
lcian Apr 13, 2026
0b56035
fix(auth): enforce exact scope matching for object-bound auth
lcian Apr 13, 2026
419c008
update
lcian Apr 13, 2026
1c8a8c1
update
lcian Apr 13, 2026
35ce284
test(auth): cover object-bound auth with fewer scopes
lcian Apr 13, 2026
825ab3e
fix(auth): use ordered scope representation for strict matching
lcian Apr 13, 2026
7089f17
refactor(auth): make scope fields private on AuthContext
lcian Apr 13, 2026
baeea7c
cleanup
lcian Apr 13, 2026
2025bf7
fix(auth): reject wildcards in strict scope matching
lcian Apr 13, 2026
d23d143
fix(auth): remove intra-doc link to private field
lcian Apr 13, 2026
f08c80a
cleanup
lcian Apr 13, 2026
25496c5
fix(auth): fix doc comment indentation
lcian Apr 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 6 additions & 3 deletions objectstore-server/docs/architecture.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,9 +88,12 @@ limiting what any token signed by that key can do.
### Authorization Check

On every operation, [`AuthAwareService`](auth::AuthAwareService) verifies that
the token's scopes and permissions cover the requested
[`ObjectContext`](objectstore_service::id::ObjectContext) and operation type.
Scope values in the token can use wildcards to grant broad access.
the token's scopes and permissions cover the requested target and operation
type. Context-scoped operations are checked against an
[`ObjectContext`](objectstore_service::id::ObjectContext); object-scoped
operations are checked against an
[`ObjectId`](objectstore_service::id::ObjectId). Scope values in the token can
use wildcards to grant broad access.

## Configuration

Expand Down
Loading
Loading