Repository navigation
fix(auth): local authz adapter picks up tuples written by other processes - #154
Merged
Merged
Conversation
…sses The index was built once at startup, so CLI-created users/grants (and revokes) did not apply to a running server until restart. Rescan data/permissions/ at most once a second. Closes #153 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…ons dir Files that fail HMAC verification are still retried on every rescan so authz:sign can pick them up, but are only logged again when their content changes. A missing data/permissions/ is treated as all files gone. Adds tests for sign-later, invalid HMAC, log-once and the missing directory, and documents the in-process delete race. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #153.
AuthzLocalAdapterrescansdata/permissions/at most once per second (configurable viarefreshIntervalMs), adding new tuple files and dropping removed ones. Previously rejected files (e.g. unsigned under strict HMAC) are retried, soauthz:signagainst a live server works too.users-create.ts; docs PR in dune-docs.Not covered: the DB-backed authz adapter (already shared across processes).
🤖 Generated with Claude Code