GameCult/Heimdall
Watch
9
0
Fork
You've already forked Heimdall
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

Claims: facts are the one owner of a capability-free claim

Browse source 
Every shared capability needs a non-empty anyOf, so an empty fact set already
yields no capabilities; the explicit empty list beside it was a second owner
no test could tell apart from the first.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Meta Vens 2026-10-19 13:34:41 +02:00
commit a911da93d8
1 changed files with 7 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

14
src/claims.ts
View file

@ -90,13 +90,13 @@ export async function issueAccessClaim(options: {
const facts = withoutCapabilities const facts = withoutCapabilities
? [] ? []
: normalizeFacts(options.input.accountId, options.input.linkedIdentities, options.input.facts); : normalizeFacts(options.input.accountId, options.input.linkedIdentities, options.input.facts);
const sharedCapabilities = withoutCapabilities // Every shared capability needs a non-empty anyOf (capability-rules), so an
? [] // empty fact set yields no capabilities: facts are the one owner of that.
: evaluateSharedCapabilities(profile, { const sharedCapabilities = evaluateSharedCapabilities(profile, {
accountId: options.input.accountId, accountId: options.input.accountId,
facts: new Set(facts), facts: new Set(facts),
identities: options.input.linkedIdentities, identities: options.input.linkedIdentities,
}); });
const issuedAt = nowEpochSeconds(); const issuedAt = nowEpochSeconds();
const ttlSeconds = clampTtlSeconds( const ttlSeconds = clampTtlSeconds(