Desk: bearer credential (OpenIddict validation, desk.read/desk.answer, audience bifrost-desk) and answerer masking #71
2026-11-12
Desk credential: only an all-desk-scope token skips the consent receipt; comment says the door withholds ids
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-11-11
Desk: a bearer in the query string or a form body authenticates nothing (Soul)
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Desk: the training-notice receipt gates the chat token only; Bifrost no longer masks answerer ids (Huginn's door withholds them), notes stay stripped
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Desk: production IDeskCredential on OpenIddict validation against the local issuer
OidcDeskCredential authenticates a bearer through the validation scheme only (never the default scheme; the cookie authenticates nothing on /api/desk and a bearer authenticates no cookie page) and returns sub, audience and scopes. The desk keeps judging audience, scope and per-request Active membership. The issuer registers desk.read/desk.answer and stamps audience bifrost-desk on tokens that carry one; client permissions are what limit scopes, so the MAS client can neither ask for them nor use its chat token on the desk. A Desk section without Bifrost:Oidc now fails startup in StartupConfigurationValidator. Packages: OpenIddict.Validation.AspNetCore and .ServerIntegration 7.7.1. No production Ratatoskr client is seeded. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Desk: mask answerer ids for non-deciders where notes are already nilled
DeskNotes becomes DeskRedaction: one function over entry and list that nils every note and replaces every answerer with the fixed sentinel "masked" for a caller who is not a decider of the Mind (X3). A decider keeps both. The sentinel is not derived from the account id and is not a UUID. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>