Repository navigation
feat: narrow the onboarding API's IssuerService scopes, bump platform - #45
Merged
Merged
Conversation
The DECADE-X onboarding API registered holders and sent credential offers with a token exchanged under the platform's sudo mapping for issuer-admin-api:admin, which bypasses the IssuerService's ownership checks. It now exchanges its token under the issuer's own participant context, whose sub owns every path it addresses, and requests only issuer-admin-api:holders:read and :holders:write for the holder registration and :credentials:write for the offer. The chart's jwtlet mapping is narrowed to the same. Bumps core-platform-distribution to 0.0.41, which runs CFM 0.0.8 (the CFM agents also call the IssuerService under the issuer's context now) and seeds their issuer mapping, and the certo agent to 0.0.8. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
jimmarino
approved these changes
Nov 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The dx-onboarding-api registered holders and sent credential offers with
issuer-admin-api:admin, exchanged under the platform'ssudomapping. That scope bypasses the IssuerService's ownership checks.dx-onboarding-api
issuer-service.token-resource: issuer). Itssubowns every/v1/participants/issuer/...path the app calls, so the resource scopes suffice.issuer-admin-api:holders:readand:holders:write; the credential offer requests:credentials:write.sudo/issuer-admin-api:admintoissuerwith exactly those three scopes.Platform
core-platform-distribution0.0.38 → 0.0.41 incharts/cx-veandvendor-stack/chart. It runs CFM 0.0.8, whose agents also call the IssuerService under the issuer's context (feat: narrow the CFM agents' IssuerService scopes eclipse-cfm/cfm#234), and seeds their issuer mapping (feat: seed a narrow issuer-context mapping for the CFM agents eclipse-cfm/core-platform-distribution#45).tenant-manager-api:admin/provision-manager-api:adminto change cells, dataspace profiles and definitions. cx-ve's seed jobs and vendor-stack scripts requestcfm-write, which includes those scopes.issuer, so it owns the tenants it creates. Tenants created before the upgrade have no owner and are admin-only, so a full redeploy is needed.certoagent0.0.6 → 0.0.8. It needs no config change: it runs in debug mode with NKey NATS auth, and none of its config keys changed.🤖 Generated with Claude Code