d-bis/CurrenciCombo
4
0
Fork 0
Code Issues Pull Requests 9 Actions Packages Projects Releases Wiki Activity

PR M: API-key role binding (req.actorRole) #17

Open
nsatoshi wants to merge 1 commits from devin/1776881763-pr-m-role-binding into main
pull from: devin/1776881763-pr-m-role-binding
merge into: d-bis:main
Conversation 0 Commits 1 Files Changed 2 +252 -17
nsatoshi commented 2026-04-22 18:17:21 +00:00
Owner
Copy Link

Closes gap-analysis v2 §7.7.

What

  • API_KEYS entries now accept key:role (back-compat: bare keys default to operator). Known roles come from ActorRole in transactionState.ts (coordinator / approver / releaser / validator / exception_manager / operator).
  • apiKeyAuth + optionalApiKeyAuth inject req.actorRole alongside req.apiKey, so SoD enforcement in the state machine can consult the authenticated role directly.
  • New requireRole(...roles) guard for per-route role gating.
  • Fail-closed: unknown roles are skipped during parsing, not silently promoted to operator. Cache auto-invalidates when API_KEYS changes.
  • 9 unit tests.

Why

The middleware previously only validated that a key was present and registered — it never attached a role to the request, so the SoD layer in the state machine had to fall back on user-agent heuristics. Binding the role at the authentication layer closes that hole.

Closes gap-analysis v2 §7.7. ## What - `API_KEYS` entries now accept `key:role` (back-compat: bare keys default to `operator`). Known roles come from `ActorRole` in `transactionState.ts` (coordinator / approver / releaser / validator / exception_manager / operator). - `apiKeyAuth` + `optionalApiKeyAuth` inject `req.actorRole` alongside `req.apiKey`, so SoD enforcement in the state machine can consult the authenticated role directly. - New `requireRole(...roles)` guard for per-route role gating. - **Fail-closed**: unknown roles are skipped during parsing, not silently promoted to `operator`. Cache auto-invalidates when `API_KEYS` changes. - 9 unit tests. ## Why The middleware previously only validated that a key was present and registered — it never attached a role to the request, so the SoD layer in the state machine had to fall back on user-agent heuristics. Binding the role at the authentication layer closes that hole.
nsatoshi added 1 commit 2026-04-22 18:17:22 +00:00
API-key role binding: inject req.actorRole
Some checks failed
CI / Frontend Lint (pull_request) Failing after 6s
Details
CI / Frontend Type Check (pull_request) Failing after 6s
Details
CI / Frontend Build (pull_request) Failing after 8s
Details
CI / Frontend E2E Tests (pull_request) Failing after 8s
Details
CI / Orchestrator Build (pull_request) Failing after 7s
Details
CI / Contracts Compile (pull_request) Failing after 5s
Details
CI / Contracts Test (pull_request) Failing after 5s
Details
Code Quality / SonarQube Analysis (pull_request) Failing after 18s
Details
Code Quality / Code Quality Checks (pull_request) Failing after 4s
Details
Security Scan / Dependency Vulnerability Scan (pull_request) Failing after 5s
Details
Security Scan / OWASP ZAP Scan (pull_request) Failing after 4s
Details
5a66cf87c8 
Closes gap-analysis v2 §7.7.

- API_KEYS entries now accept the form key:role (back-compat: bare keys
  default to role=operator). Known roles come from ActorRole in
  transactionState.ts (coordinator / approver / releaser / validator /
  exception_manager / operator).
- apiKeyAuth + optionalApiKeyAuth inject req.actorRole alongside
  req.apiKey so the SoD enforcement in the state machine can consult
  the authenticated role directly.
- New requireRole(...roles) guard for per-route role gating.
- Fail-closed: unknown roles are skipped during parsing, not silently
  promoted to operator. Cache auto-invalidates when API_KEYS changes.
- 9 unit tests.
Some checks failed
CI / Frontend Lint (pull_request) Failing after 6s
Details
CI / Frontend Type Check (pull_request) Failing after 6s
Details
CI / Frontend Build (pull_request) Failing after 8s
Details
CI / Frontend E2E Tests (pull_request) Failing after 8s
Details
CI / Orchestrator Build (pull_request) Failing after 7s
Details
CI / Contracts Compile (pull_request) Failing after 5s
Details
CI / Contracts Test (pull_request) Failing after 5s
Details
Code Quality / SonarQube Analysis (pull_request) Failing after 18s
Details
Code Quality / Code Quality Checks (pull_request) Failing after 4s
Details
Security Scan / Dependency Vulnerability Scan (pull_request) Failing after 5s
Details
Security Scan / OWASP ZAP Scan (pull_request) Failing after 4s
Details
This pull request can be merged automatically.
This branch is out-of-date with the base branch
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin devin/1776881763-pr-m-role-binding:devin/1776881763-pr-m-role-binding
git checkout devin/1776881763-pr-m-role-binding
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
70rn4710n A.r.yavari SEG nsatoshi
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: d-bis/CurrenciCombo#17
Delete Branch "devin/1776881763-pr-m-role-binding"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?