PR M: API-key role binding (req.actorRole) #17

2026-04-22T11:17:21-07:00

nsatoshi commented

2026-04-22 11:17:21 -07:00

Closes gap-analysis v2 §7.7.

What

API_KEYS entries now accept key:role (back-compat: bare keys default to operator). Known roles come from ActorRole in transactionState.ts (coordinator / approver / releaser / validator / exception_manager / operator).
apiKeyAuth + optionalApiKeyAuth inject req.actorRole alongside req.apiKey, so SoD enforcement in the state machine can consult the authenticated role directly.
New requireRole(...roles) guard for per-route role gating.
Fail-closed: unknown roles are skipped during parsing, not silently promoted to operator. Cache auto-invalidates when API_KEYS changes.
9 unit tests.

Why

The middleware previously only validated that a key was present and registered — it never attached a role to the request, so the SoD layer in the state machine had to fall back on user-agent heuristics. Binding the role at the authentication layer closes that hole.

Closes gap-analysis v2 §7.7. ## What - `API_KEYS` entries now accept `key:role` (back-compat: bare keys default to `operator`). Known roles come from `ActorRole` in `transactionState.ts` (coordinator / approver / releaser / validator / exception_manager / operator). - `apiKeyAuth` + `optionalApiKeyAuth` inject `req.actorRole` alongside `req.apiKey`, so SoD enforcement in the state machine can consult the authenticated role directly. - New `requireRole(...roles)` guard for per-route role gating. - **Fail-closed**: unknown roles are skipped during parsing, not silently promoted to `operator`. Cache auto-invalidates when `API_KEYS` changes. - 9 unit tests. ## Why The middleware previously only validated that a key was present and registered — it never attached a role to the request, so the SoD layer in the state machine had to fall back on user-agent heuristics. Binding the role at the authentication layer closes that hole.

nsatoshi added 1 commit 2026-04-22 11:17:22 -07:00

API-key role binding: inject req.actorRole

CI / Frontend Lint (pull_request) Failing after 6s

Details

CI / Frontend Type Check (pull_request) Failing after 6s

Details

CI / Frontend Build (pull_request) Failing after 8s

Details

CI / Frontend E2E Tests (pull_request) Failing after 8s

Details

CI / Orchestrator Build (pull_request) Failing after 7s

Details

CI / Contracts Compile (pull_request) Failing after 5s

Details

CI / Contracts Test (pull_request) Failing after 5s

Details

Code Quality / SonarQube Analysis (pull_request) Failing after 18s

Details

Code Quality / Code Quality Checks (pull_request) Failing after 4s

Details

Security Scan / Dependency Vulnerability Scan (pull_request) Failing after 5s

Details

Security Scan / OWASP ZAP Scan (pull_request) Failing after 4s

Details

5a66cf87c8

Closes gap-analysis v2 §7.7.

- API_KEYS entries now accept the form key:role (back-compat: bare keys
  default to role=operator). Known roles come from ActorRole in
  transactionState.ts (coordinator / approver / releaser / validator /
  exception_manager / operator).
- apiKeyAuth + optionalApiKeyAuth inject req.actorRole alongside
  req.apiKey so the SoD enforcement in the state machine can consult
  the authenticated role directly.
- New requireRole(...roles) guard for per-route role gating.
- Fail-closed: unknown roles are skipped during parsing, not silently
  promoted to operator. Cache auto-invalidates when API_KEYS changes.
- 9 unit tests.

This pull request is broken due to missing fork information.

This pull request can be merged automatically.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin devin/1776881763-pr-m-role-binding:devin/1776881763-pr-m-role-binding

git checkout devin/1776881763-pr-m-role-binding

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: d-bis/CurrenciCombo#17