nsaspy/quasar
1
0
Fork 0
Code Issues 19 Pull requests 6 Projects Releases Packages Wiki Activity Actions

RAGE #54: trusted delegated Auto-Dig session registration #55

Open
lost-rob0t wants to merge 4 commits from rage/54-trusted-delegated-session-registration into main
pull from: rage/54-trusted-delegated-session-registration
merge into: nsaspy:main
Conversation 1 Commits 4 Files changed 9 +551 -9
lost-rob0t commented 2026-08-26 07:28:28 +00:00 (Migrated from github.com)
Copy link

Tests-first owner-boundary slice for #54.

The RED contract requires a disabled-by-default trusted registration seam that can accept an already-authenticated StarIntel human principal/scopes/workspaces from an internal service adapter, register only canonical fixed Auto-Dig capabilities, and produce a short-lived WebSocket session without ever receiving a user OAuth bearer token.

Initial tests require:

  • explicit internal service authentication;
  • read-only scope narrowing;
  • no principal/session-token reflection in the response;
  • rejection of caller-supplied capability lists and wildcard workspaces;
  • duplicate session-token replay rejection;
  • expiry removal before WebSocket handshake.

No production registration endpoint or gateway enablement is included on this initial head. Expected state is RED.

Tests-first owner-boundary slice for #54. The RED contract requires a disabled-by-default trusted registration seam that can accept an already-authenticated StarIntel human principal/scopes/workspaces from an internal service adapter, register only canonical fixed Auto-Dig capabilities, and produce a short-lived WebSocket session without ever receiving a user OAuth bearer token. Initial tests require: - explicit internal service authentication; - read-only scope narrowing; - no principal/session-token reflection in the response; - rejection of caller-supplied capability lists and wildcard workspaces; - duplicate session-token replay rejection; - expiry removal before WebSocket handshake. No production registration endpoint or gateway enablement is included on this initial head. Expected state is RED.
nsaspy changed title from WIP: RAGE #54: trusted delegated Auto-Dig session registration to RAGE #54: trusted delegated Auto-Dig session registration 2026-08-27 19:50:35 +00:00
nsaspy force-pushed rage/54-trusted-delegated-session-registration from 663226ad82 to c38ebe003a 2026-09-05 01:29:27 +00:00 Compare
ci: add Forgejo Actions workflows ported from .github
Some checks failed
CI / Fresh Nix runtime + real startup (push) Failing after 7m22s
Details
CI / validate (push) Has been cancelled
Details
1fa125cea5
nsaspy commented 2026-09-05 01:47:28 +00:00
Owner
Copy link

Iteration 2 implemented and rebased onto current main (1fa125c).

Implementation (feat: trusted delegated Auto-Dig registration seam):

  • make-websocket-server gains :delegated-registration-secret (nil = seam disabled, 404 fail-closed).
  • handle-delegated-session-registration (quasar.ws): constant-time service-secret check after length equality, strict body allowlist (session_token, principal, workspaces, scopes, ttl_seconds), scopes mapped exclusively through delegated-autodig-capabilities, TTL clamped to <=60s, replay check + insert in one critical section under the server lock (409 on replay).
  • lookup-websocket-session sweeps expired sessions; the secure handshake path routes through it, so expired delegated sessions cannot complete a handshake.
  • validate-explicit-workspaces now rejects wildcard "*" for all Auto-Dig session kinds.
  • Responses never reflect the token, principal, or secret; audit keeps correlation internally.

TDD evidence: RED proven first (suite exit 1: registration handler/lookup absent), then GREEN. Full quasar-tests suite exit 0 in the canonical nix develop environment, no undefined-function warnings; check-control-plane-deps and LOAD_ONLY control-plane load gates exit 0.

Deferred to the enablement slice on this same issue (per design record): private HTTP route wiring, deployment secret provisioning for the trusted StarIntel caller (infra #72), and handshake-time one-time consumption policy.

Iteration 2 implemented and rebased onto current main (1fa125c). Implementation (feat: trusted delegated Auto-Dig registration seam): - make-websocket-server gains :delegated-registration-secret (nil = seam disabled, 404 fail-closed). - handle-delegated-session-registration (quasar.ws): constant-time service-secret check after length equality, strict body allowlist (session_token, principal, workspaces, scopes, ttl_seconds), scopes mapped exclusively through delegated-autodig-capabilities, TTL clamped to <=60s, replay check + insert in one critical section under the server lock (409 on replay). - lookup-websocket-session sweeps expired sessions; the secure handshake path routes through it, so expired delegated sessions cannot complete a handshake. - validate-explicit-workspaces now rejects wildcard "*" for all Auto-Dig session kinds. - Responses never reflect the token, principal, or secret; audit keeps correlation internally. TDD evidence: RED proven first (suite exit 1: registration handler/lookup absent), then GREEN. Full quasar-tests suite exit 0 in the canonical nix develop environment, no undefined-function warnings; check-control-plane-deps and LOAD_ONLY control-plane load gates exit 0. Deferred to the enablement slice on this same issue (per design record): private HTTP route wiring, deployment secret provisioning for the trusted StarIntel caller (infra #72), and handshake-time one-time consumption policy.
Some checks failed
CI / Fresh Nix runtime + real startup (push) Failing after 7m22s
Details
CI / validate (push) Has been cancelled
Details
This pull request can be merged automatically.
This branch is out-of-date with the base branch
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin rage/54-trusted-delegated-session-registration:rage/54-trusted-delegated-session-registration
git switch rage/54-trusted-delegated-session-registration

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main
git merge --no-ff rage/54-trusted-delegated-session-registration
git switch rage/54-trusted-delegated-session-registration
git rebase main
git switch main
git merge --ff-only rage/54-trusted-delegated-session-registration
git switch rage/54-trusted-delegated-session-registration
git rebase main
git switch main
git merge --no-ff rage/54-trusted-delegated-session-registration
git switch main
git merge --squash rage/54-trusted-delegated-session-registration
git switch main
git merge --ff-only rage/54-trusted-delegated-session-registration
git switch main
git merge rage/54-trusted-delegated-session-registration
git push origin main
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
bug
Something isn't working

  
documentation
Improvements or additions to documentation

  
duplicate
This issue or pull request already exists

  
enhancement
New feature or request

  
good first issue
Good for newcomers

  
help wanted
Extra attention is needed

  
invalid
This doesn't seem right

  
priority:P1
Highest priority work

  
question
Further information is requested

  
wontfix
This will not be worked on

No labels
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
priority:P1
question
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
nsaspy/quasar!55
No description provided.