GameCult/Heimdall
Watch
9
0
Fork
You've already forked Heimdall
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions
Heimdall/docs/app-profiles/ghostlight.md
Meta Vens 9065dfa43b Bind Ghostlight logout to exact session custody
2026-08-22 01:53:21 +02:00

1.5 KiB
Raw Blame History

Ghostlight Dungeon Access Profile

Ghostlight Dungeon uses Heimdall's private CultNet authentication commands and the gamecult.heimdall.access Eve plugin. Heimdall owns provider OAuth, persistent attempts, local account identity, entitlement evaluation, signed access claims, completion redemption, refresh, and exact-session revocation. Ghostlight verifies claims locally and owns app sessions, campaigns, campaign membership, current campaign selection, and every world mutation.

App identity

  • app_slug: ghostlight
  • public URL: https://yggdrasil.gamecult.org/ghostlight/
  • identity provider: Discord
  • access rule: Ghostlight supplies its configured KLTST Discord-role policy on the app-authenticated private boundary; Heimdall evaluates the policy and grants app_access only when it succeeds

Capabilities

  • app_access: shared capability granting entry to the demo
  • campaign_play: hybrid capability; Ghostlight must also prove that the authenticated account owns the selected campaign

The browser never carries provider tokens or a completion code. The access plugin stores only an opaque attempt handle. Ghostlight redeems that handle over the encrypted loopback command plane, verifies the resulting aud=ghostlight claim against Heimdall JWKS, and establishes app-local campaign authority. Short-lived local access continues without a Heimdall round trip. Scheduled refresh re-evaluates the Ghostlight-owned KLTST role policy; explicit logout revokes both Ghostlight's local session and the matching Heimdall refresh custody record.