novox/mesh-controller
13
0
Fork 0
Code Issues Pull Requests 5 Releases Wiki Activity

Let the generic command verb only read, and keep keys and tokens at the terminal

Browse Source 
Review found a chain through the command verb: set the operator's key to one
the caller holds, rotate secrets so they are sealed to it too, read the sealed
copies, open them. Whoever may call a verb includes agents (hq ADR 0266), so
command now runs an allow list of reading forms, and operator, identity,
token, broker, api, licence and every secret command but rotate are refused
through any verb.
This commit is contained in:
jochen
2026-10-09 10:12:05 +02:00
parent 528951319c
commit 20d4f1ae71
7 changed files with 188 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/mesh-controller/seatverbs_schema_test.go
-1
View File
@@ -271,7 +271,6 @@ var accountedFlags = map[string]map[string]string{
"builds": {"n": "=limit"},
"plans": {"n": "=limit", "what-if": "=repository"},
// The machine's tunnel key, named as the verb's other arguments are (novox/hq ADR 0169).
"token issue": {"overlay-key": "=overlay_key"},
"durations": {
"json": "set by the verb: the answer is data",
"all": "withheld: every measurement of a fortnight is more than a call should carry; `command` reaches it",