a4d8cc52
authn: remove the local agent-token plane
The agent_token table and everything that minted, verified, listed or revoked it. Agent credentials are tokens.sr.ht working tokens now: signed, expiring, owned by a meta.sr.ht account and carrying grants, verified locally by sr-ht-ecore's bearer package. One door, and nothing behind it — a credential the instance plane refuses is refused, where it used to be offered to a second store that might say yes. DEPLOY GATE: do not deploy this until every agent configured with the shared secret holds a tokens.sr.ht token with spec:propose (spec:read to read). Migration 0005 drops the table, migrate-on-upgrade runs it on deploy, and deploying early locks out every agent at once — including the SSH push path. hooks/ no longer reads agent_token directly. The push path goes through the same authn.Resolver the HTTP surfaces use and demands spec:propose, because a push by an agent is a proposal by another transport. The refs rule and the provenance requirement are untouched on both counts: a universal grant is still only an agent to the receive path, and X-Agent / X-Agent-Session are still mandatory on every agent write. bearer.ErrNotOurs is now a permanent refusal. A meta.sr.ht PAT used to fall through to the local store and miss there; with no store to fall through to it earns a 401 rather than the 503 an unclassified error would. [tokens.sr.ht] origin becomes a required config key: with no issuer there is no credential to check, so the daemon fails startup instead of serving reads and refusing every agent write one request at a time. /tokens redirects to the daemon that issues (tokens SPEC ch. 7).
Eugene Blikh <bigbes@gmail.com> — 2026-08-08 17:29:19 UTC
Commit a4d8cc52e917cf1db07c876e8b36654dcf28741b —
view raw patch
Parent(s):
c7477607
| File | Status | + | − |
|---|---|---|---|
api/api_test.go
|
M | +3 | -9 |
api/bearer_test.go
|
M | +25 | -65 |
authn/authn_test.go
|
M | -56 | |
authn/bearer.go
|
M | +31 | -41 |
authn/bearer_test.go
|
M | +126 | -105 |
authn/doc.go
|
M | +49 | -56 |
authn/principal.go
|
M | +29 | -30 |
authn/resolver.go
|
M | +63 | -55 |
authn/resolver_test.go
|
M | +44 | -79 |
authn/token.go
|
M | +2 | -120 |
authn/token_test.go
|
M | -131 | |
cmd/specsrht-migrate/main_test.go
|
M | +7 | -1 |
cmd/specsrht/doc.go
|
M | +5 | -3 |
cmd/specsrht/main.go
|
M | +16 | -14 |
cmd/specsrht/token.go
|
D | -136 | |
cmd/specsrht/token_test.go
|
D | -70 | |
db/store.go
|
M | +8 | -12 |
db/token.go
|
D | -201 | |
db/token_test.go
|
D | -118 | |
db/unit_test.go
|
M | +77 | -57 |
docs/DESIGN.md
|
M | +82 | -30 |
graph/grant_test.go
|
M | +5 | -2 |
graph/graph_test.go
|
M | +43 | -21 |
hooks/doc.go
|
M | +6 | -3 |
hooks/e2e_test.go
|
M | +87 | -1 |
hooks/fixture_test.go
|
M | +65 | -29 |
hooks/hook_test.go
|
M | +8 | -8 |
hooks/server.go
|
M | +41 | -29 |
hooks/server_test.go
|
M | +115 | -77 |
mcpsrv/grant_internal_test.go
|
M | +14 | -16 |
migrations/0005_drop_agent_token.sql
|
A | +30 | |
schema.sql
|
M | +5 | -9 |
service/bearer.go
|
M | +18 | -17 |
service/bearer_test.go
|
M | +52 | -49 |
service/service.go
|
M | +10 | -15 |
service/service_test.go
|
M | +2 | -65 |
service/token.go
|
D | -197 | |
service/token_acl_test.go
|
D | -107 | |
web/grant_test.go
|
M | +9 | -10 |
web/reader.go
|
M | +3 | -22 |
web/router.go
|
M | +4 | -4 |
web/server.go
|
M | +18 | -4 |
web/templates.go
|
M | +1 | -1 |
web/templates/index.html
|
M | +1 | -1 |
web/templates/tokens.html
|
D | -68 | |
web/tokens.go
|
M | +32 | -135 |
web/tokens_test.go
|
M | +56 | -143 |
web/web_test.go
|
M | +48 | -57 |