Repository navigation
feat(identity): keys from a key source, a person without an org acts in their own, a key set given - #301
Merged
Conversation
… configured list today The authenticator asks an ApiKeySource, keyOf(id), for the entry of the id a presented key names, on every request, and compares the digests in constant time as before. The list the operator configured, configuredApiKeys, is the one source, and the server composes it; a source that keeps its keys elsewhere admits a key it issues and refuses one it revokes while the server runs. The configured list alone still decides the access mode, and no source is asked in local mode or in a closed server. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…se id is their subject A session or an access token that holds neither o nor org_id names no org, as the token of a person signed in with no organization of their own does, and was refused for a missing o or org_id claim. It now acts in the org whose id is its sub, and in no other, and the dispatcher's rules hold there as in any org; a sub that is not an org id other than local is refused, naming the sub claim. A token that holds the org claim of the other form without its own is refused as before, so the API's tests of a refused org claim now give the token that claim. The openIdConnect scheme of the OpenAPI document, the kept document, the security guide and the terminology say the new rule. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…Y_JWKS or at IDENTITY_JWKS_URL The verifier takes its signing keys from an IssuerKeySource of the identity package: discovery through the issuer's metadata, the default as before; a URL, read in place of the metadata's jwks_uri and kept for ten minutes as a key set found through it is; or a key set given, which is read from nowhere. The server reads IDENTITY_JWKS, the JSON of a key set that holds a key, and IDENTITY_JWKS_URL, an https URL, beside IDENTITY_ISSUER, refuses both at once, and composes the source they name, so a server whose issuer publishes its keys another way, or that should read nothing of the issuer at start, still signs people in. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
rami-hatoum
pushed a commit
that referenced
this pull request
Oct 23, 2026
🤖 I have created a release *beep* *boop* --- ## [0.18.0](v0.17.0...v0.18.0) (2026-10-23) ### Features * **identity:** keys from a key source, a person without an org acts in their own, a key set given ([#301](#301)) ([ca6f754](ca6f754)) * **server:** the npm package carries every package as a subpath, with its testing entry ([#304](#304)) ([caf2e36](caf2e36)) ### Bug Fixes * **coordination:** the workflow spec SDK compiles a validator on first use, not when imported ([#308](#308)) ([0dcd0df](0dcd0df)) * **workflow-host:** the follower notes each unreadable record, and a first follow misses nothing ([#302](#302)) ([7c5588c](7c5588c)) * **workflow-host:** the waiting measurement names the run of each record it writes ([#299](#299)) ([69ad59f](69ad59f)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: beonautobot[bot] <298957281+beonautobot[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this changes
Three things the identity package decided from configuration alone.
abk_<id>_<secret>key up in the list the operator configured. The lookup is now a port,ApiKeySource, whose one implementation is that configured list; the constant-time check is unchanged, and the configured list alone still decides the access mode, so a server with no keys and no sign-in stays closed. A test revokes a key mid-run through a fake source and sees it refused.localis refused in words. The authentication reference, the security guide, the OpenAPI document and the terminology say the rule; the API's tests show the subject's org answering and another org refused.IDENTITY_JWKS_URLfor a key set read at a URL and kept ten minutes, orIDENTITY_JWKSfor the key set itself; setting both stops the start, and a malformed key set is refused with its place named.Tests
pnpm checkpasses on each commit.