fe913656
feat(authn): unified-login identity, agent token validation, provenance trailers
Cookie identity is fail-open to anonymous: a missing, tampered or foreign-key cookie yields no user rather than an error, so anonymous browsing never breaks on a bad cookie. Agent tokens are the opposite. A bad bearer is a permanent 401, a store outage a transient 503, and revoked rows are returned so operators can distinguish a killed token from one that never existed. TokenStore is declared here rather than imported from db/, so the two packages can be built in parallel and service/ wires them together.
bigbes <bigbes@gmail.com> — 2026-07-22 08:14:04 UTC
Commit fe9136564fce231f2b4d9e4c2613856ad7796761 —
view raw patch
Parent(s):
ba61af74
| File | Status | + | − |
|---|---|---|---|
authn/authn_test.go
|
A | +186 | |
authn/cookie.go
|
A | +72 | |
authn/cookie_test.go
|
A | +92 | |
authn/doc.go
|
A | +104 | |
authn/principal.go
|
A | +145 | |
authn/provenance.go
|
A | +312 | |
authn/provenance_test.go
|
A | +277 | |
authn/resolver.go
|
A | +115 | |
authn/resolver_test.go
|
A | +330 | |
authn/token.go
|
A | +158 | |
authn/token_test.go
|
A | +161 |