feat(auth): add scoped temporary credentials - #5

Merged

acking-you merged 74 commits into

feat/temporary-credential-auth

Aug 21, 2026

Commits on Aug 21, 2026

Add scoped temporary credential authentication
acking-you
committed
8062933
Make codec test configuration-independent
acking-you
committed
1884717
Harden temporary credential authentication
acking-you
committed
2fa4c46
Document module boundaries
acking-you
committed
781637f
Reject conflicting auth configuration
acking-you
committed
93b501f
Distinguish invalid administrator keys
acking-you
committed
5cec089
Bound timing wheel catch-up work
acking-you
committed
13c5df2
Warn on invalid auth limits
acking-you
committed
8e3a54c
Expire overdue timing wheel entries promptly
acking-you
committed
6a5857a
Harden auth lifecycle cleanup
acking-you
committed
866d200
Persist temporary key tombstone times
acking-you
committed
aa69499
Remove implicit credential authentication
acking-you
committed
5d485f3
Defend against conflicting server key modes
acking-you
committed
86c2a1c
Migrate missing tombstone timestamps safely
acking-you
committed
a3b1c4b
Fix authentication review findings
acking-you
committed
7466b4c
Fix remaining authentication review findings
acking-you
committed
03799cd
Fix remaining isolated-relay, replay, and key-lifecycle review findings
acking-you
committed
91e9e7e
Share auth and protocol helpers for later reuse
acking-you
committed
460c540
Harden key initialization, slot generations, WAL, and stream auth
acking-you
committed
4d68a2c
Deny legacy framing in safe mode and cap legacy first flights
acking-you
committed
e07aa5c
Document WAL rollback retryable contract
acking-you
committed
e5801bb
Harden safe-mode compaction, WAL durability, and first-flight admission
acking-you
committed
e3d4b3f
Persist first-flight replay and close remaining auth gaps
acking-you
committed
d3b23d7
Surface the exhausted salt-replay error on the second admin attempt
acking-you
committed
ba02af7
Harden the durable replay log and exclusive auth-state ownership
acking-you
committed
df7dcf5
Recover interrupted root rotation and release auth locks on shutdown
acking-you
committed
b8a1e5d
Gate the embedded relay administrator key behind an explicit reveal
acking-you
committed
60b7582
Recover interrupted resets and lock before first-start key creation
acking-you
committed
9ab8f0a
Discard leftover WAL when recovering an interrupted reset
acking-you
committed
f85bbb0
Flush the parent directory after Windows auth-state replacements
acking-you
committed
47b84ea
Discard leftover WAL when recovering an interrupted root rotation
acking-you
committed
0042cf4
Wait for aborted connections and flush Windows dirs with write access
acking-you
committed
d54a053
Return temporary_key_rotated after root rotation or reset
acking-you
committed
90c2b35
Fail closed on replay rollback and keep auth.lock in the actor
acking-you
committed
2026801
Refuse replacing live admin.key while encrypted state exists
acking-you
committed
a81fa13
Keep rotated errors after slot reuse and abort timed-out UI shutdown
acking-you
committed
a142d0f
Harden replay recovery and stop accumulating wheel owners
acking-you
committed
82d9b0b
Retain admin replay claims from server acceptance time
acking-you
committed
45458e7
Harden replay I/O and keep previous root for rotated errors
acking-you
committed
3873d69
Skip machine-key reinit and pin running client credentials
acking-you
committed
e0be4d2
Pin registration workers and replace canceled renew leases
acking-you
committed
0d78941
Bind tunneled checksums and finish actor/UI credential shutdown
acking-you
committed
8bd5224
Bind local tunneled frames to the pinned credential key
acking-you
committed
33c8811
Cover high-slot keys and unread first-flight errors
acking-you
committed
566b213
Keep lease cancel causes and bound first-flight load
acking-you
committed
b71bf55
Wait for actor abort and avoid replay GCM reuse
acking-you
committed
80730a0
Retry admin commands only before they are sent
acking-you
committed
5914473
Keep replay nonces unique and stream quotas live
acking-you
committed
717edae
Admit first flights under one blocking lock
acking-you
committed
ec32d78
Claim limited and stale-root first flights
acking-you
committed
baddd54
Bound denial claims and verify container keys
acking-you
committed
9ef2dde
Claim auth errors and schedule high-slot expiry
acking-you
committed
ec52ab4
Bound actor abort and fail register/status
acking-you
committed
22ae9d7
Abort pooled workers and keep Compose keys
acking-you
committed
f113b3d
Reap connections and batch tombstones
acking-you
committed
86e4c2b
Simplify auth expiry, first-flight, and UI pinning
acking-you
committed
71b99cd
Split auth persistence and first-flight modules
acking-you
committed
8281780
Pin tunnel credentials once and share first-flight IO
acking-you
committed
d25c448
Gate the Linux auth state dir helper by platform

acking-you
and
cursoragent
committed
6af7d24
Drive credential cleanup from timing-wheel callbacks

acking-you
and
claude
committed
bc2d708
Separate the timing wheel from what it schedules

acking-you
and
claude
committed
b8a61d4
Rebuild the timer wheel around nested routes; move to parking_lot

acking-you
and
claude
committed
d3d6ac4
Teach the CI path filter about crates/

acking-you
and
claude
committed
06542ba
Drop dead code left over from earlier refactors

acking-you
and
claude
committed
c31eb3b
Move to Rust 1.98.0, still on edition 2021

acking-you
and
claude
committed
cadcb5e
Move DNS resolution to hickory-resolver

acking-you
and
claude
committed
6c763ba
Upgrade the remaining dependencies

acking-you
and
claude
committed
9d9f65f
Migrate to edition 2024

acking-you
and
claude
committed
601bb9e
Extract pb-mapper-core

acking-you
and
claude
committed
9351bfa
Extract pb-mapper-auth

acking-you
and
claude
committed
cbffba4
Extract pb-mapper-protocol

acking-you
and
claude
committed
c064b46
Split out server, client, and the CLI; root becomes virtual

acking-you
and
claude
committed
96a627e
Deny unwrap and expect across the workspace

acking-you
and
claude
committed
1611554
Correct the documentation for the split, and the drift it uncovered

acking-you
and
claude
committed
7b7cebe