GameCult/Bifrost
Watch
9
0
Fork
You've already forked Bifrost
 0
Code Issues 7 Pull requests Projects Releases Packages Wiki Activity Actions

Desk: bearer credential (OpenIddict validation, desk.read/desk.answer, audience bifrost-desk) and answerer masking #71

Merged
heimdall merged 5 commits from heimdall/desk-credential into main 2026-11-12 10:17:30 +00:00
Conversation 0 Commits 5 Files changed 15 +711 -30
heimdall commented 2026-11-11 17:48:25 +00:00
Member
Copy link

Production IDeskCredential and answerer masking (no deploy; no production Ratatoskr client is seeded).

  • OidcDeskCredential: OpenIddict local-server validation (OpenIddict.Validation.AspNetCore + ServerIntegration 7.7.1), not the default scheme. Authenticates only; audience, scope and per-request Active membership stay the desk's.
  • Issuer registers desk.read/desk.answer and stamps audience bifrost-desk. MAS cannot request them; its token and the session cookie are 401 on /api/desk/*. A Desk section without Oidc fails startup.
  • Notes: for non-deciders every note is nil (DeskRedaction). Bifrost masks no answerer id and no card.deciders: Huginn's door withholds both and returns counts (ruling eureka-substrate:ruling:desk-read-visibility-withheld-ids, Huginn #56 79d954c); Bifrost cannot mask what it cannot read (the card is opaque).
  • Consent gate: the training-notice receipt gates the chat token only; a desk token issues for a member with no receipt (test), a chat token is still sent to the consent page. Suspension still stops both.
  • Tests use real tokens from the test host's issuer. 1089 pass / 43 fail; the same 43 fail on f6a826b in this sandbox.

Steward answers applied: card.deciders leak is the door's (Huginn #56); consent gate chat-only; scheme name stays OpenIddict's fixed one (design note corrected in #69).

Textual overlap with the door PR (#70) in DeskReplay/test helpers; whichever merges second rebases.

🤖 Generated with Claude Code

Production IDeskCredential and answerer masking (no deploy; no production Ratatoskr client is seeded). - OidcDeskCredential: OpenIddict local-server validation (OpenIddict.Validation.AspNetCore + ServerIntegration 7.7.1), not the default scheme. Authenticates only; audience, scope and per-request Active membership stay the desk's. - Issuer registers desk.read/desk.answer and stamps audience bifrost-desk. MAS cannot request them; its token and the session cookie are 401 on /api/desk/*. A Desk section without Oidc fails startup. - Notes: for non-deciders every note is nil (DeskRedaction). Bifrost masks no answerer id and no card.deciders: Huginn's door withholds both and returns counts (ruling eureka-substrate:ruling:desk-read-visibility-withheld-ids, Huginn #56 79d954c); Bifrost cannot mask what it cannot read (the card is opaque). - Consent gate: the training-notice receipt gates the chat token only; a desk token issues for a member with no receipt (test), a chat token is still sent to the consent page. Suspension still stops both. - Tests use real tokens from the test host's issuer. 1089 pass / 43 fail; the same 43 fail on f6a826b in this sandbox. Steward answers applied: card.deciders leak is the door's (Huginn #56); consent gate chat-only; scheme name stays OpenIddict's fixed one (design note corrected in #69). Textual overlap with the door PR (#70) in DeskReplay/test helpers; whichever merges second rebases. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
DeskNotes becomes DeskRedaction: one function over entry and list that nils
every note and replaces every answerer with the fixed sentinel "masked" for a
caller who is not a decider of the Mind (X3). A decider keeps both. The
sentinel is not derived from the account id and is not a UUID.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
OidcDeskCredential authenticates a bearer through the validation scheme only
(never the default scheme; the cookie authenticates nothing on /api/desk and a
bearer authenticates no cookie page) and returns sub, audience and scopes. The
desk keeps judging audience, scope and per-request Active membership.

The issuer registers desk.read/desk.answer and stamps audience bifrost-desk on
tokens that carry one; client permissions are what limit scopes, so the MAS
client can neither ask for them nor use its chat token on the desk. A Desk
section without Bifrost:Oidc now fails startup in StartupConfigurationValidator.
Packages: OpenIddict.Validation.AspNetCore and .ServerIntegration 7.7.1.
No production Ratatoskr client is seeded.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
GameCult/Bifrost!71
No description provided.