Zayin/Ekklesia
3
0
Fork 0
Code Issues 1 Pull Requests 3 Actions Packages Projects Releases 8 Wiki Activity

feat: add authorization bootstrap and HTTP enforcement

Browse Source 
Wires Core's identity and authorization domains into apps/api over one
shared, validated PostgreSQL pool; adds an explicit, single-use,
concurrency-safe platform-owner bootstrap CLI; adds a smallest-possible
immutable permission registry with one Core-owned restricted permission
(core.authorization.grants.manage); and adds reusable Hono authorization
enforcement plus a narrowly scoped /api/v1/grants HTTP API for managing
explicit grants only, gated by an exact trusted Origin on every mutation.
This commit is contained in:
ekklesia
2026-07-23 11:16:32 -05:00
parent 72e082ff2f
commit 1363608552
33 changed files with 2962 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+17 -6
View File
@@ -6,8 +6,8 @@ surfaces.
## Current status
Phase 3 is complete, and Phase 4A (Core identity foundation) and Phase 4B (identity HTTP
transport) have landed. The repository includes
Phase 3 is complete, Phase 4A (Core identity foundation) and Phase 4B (identity HTTP transport)
have landed, and Phase 4C (Core authorization) is in progress. The repository includes
public module contracts, independently versioned capabilities, static module manifests,
deterministic automatic discovery, compiled server loading, a staged capability registry,
dependency-ordered lifecycle with rollback, module-owned Drizzle table contracts, deterministic
@@ -35,10 +35,20 @@ still cannot reach any of this. Public email/password registration is intentiona
receives identical lowest-privilege baseline status and signup order never grants elevation. See
[API](docs/development/api.md) and
[ADR 0011](docs/architecture/decisions/0011-identity-http-transport-and-public-enrollment.md).
**No email verification, password recovery, Dashboard, or role/permission model exists yet** —
that, along with production approval-provider composition, jobs, physical storage provisioning,
surfaces, and feature modules, remains later vertical slices. Public registration is not yet ready
for a real public launch.
**No email verification, password recovery, or Dashboard exists yet** — that, along with
production approval-provider composition, jobs, physical storage provisioning, surfaces, and
feature modules, remains later vertical slices. Public registration is not yet ready for a real
public launch.
Phase 4C (in progress) adds Core's authorization foundation on top of identity: a schema,
evaluator, and store for platform owners, explicit grants, and relationship-derived grants; a
smallest-possible immutable permission registry; an explicit, single-use, concurrency-safe
platform-owner bootstrap command (`pnpm authorization:bootstrap-owner`, never HTTP-exposed, never
inferred from signup order); and, in `apps/api`, reusable Hono authorization enforcement plus a
narrowly scoped `/api/v1/grants` HTTP API for managing *explicit* grants only, requiring an exact
trusted `Origin` on every mutation. Roles/groups/teams/tenants, an owner-management HTTP endpoint,
service accounts/API tokens, and module-permission registration remain later work. See
[Authorization](docs/development/authorization.md).
## Quick start
@@ -146,6 +156,7 @@ environment.
- [Testing](docs/development/testing.md)
- [Identity](docs/development/identity.md)
- [API](docs/development/api.md)
- [Authorization](docs/development/authorization.md)
- [Module development](docs/module-development/README.md)
- [Architecture decisions](docs/architecture/decisions/README.md)