From 8e3270d4796aa8d01c5fbc2bf7fb53be7c2430f4 Mon Sep 17 00:00:00 2001 From: Lilleman auf Larv Date: Mon, 9 Nov 2026 00:14:53 +0100 Subject: [PATCH] =?UTF-8?q?Answer=20prose=20round=201:=200=20=F0=9F=94=B4,?= =?UTF-8?q?=205=20=F0=9F=9F=A1=20(0=20misread);=20cut=20the=20duplicated?= =?UTF-8?q?=20specificity=20line=20and=20reflow?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- compose.yml | 5 +++-- examples/plugins/auth-admin/admin-groups.ts | 3 ++- examples/plugins/scheduling/plugin.ts | 2 +- public/css/styles.css | 9 +++++---- src/auth/jwt.ts | 5 ++--- src/auth/login.ts | 4 ++-- src/plugin-host/router.ts | 2 -- 7 files changed, 15 insertions(+), 15 deletions(-) diff --git a/compose.yml b/compose.yml index 93a5b3e..9565337 100644 --- a/compose.yml +++ b/compose.yml @@ -165,8 +165,9 @@ services: # Ory Hydra — OAuth2/OIDC provider (other apps log in *through* plainpages; README). # DSN is its own `hydra` DB (init.sql); config in ory/hydra/hydra.yml. web implements the - # login challenge at /oauth2/login and the consent challenge at /oauth2/consent. Dev permits the http issuer via --dev - # (compose.override.yml); prod sets an https issuer via env (URLS_SELF_ISSUER). + # login challenge at /oauth2/login and the consent challenge at /oauth2/consent. Dev permits the + # http issuer via --dev (compose.override.yml); prod sets an https issuer via env + # (URLS_SELF_ISSUER). hydra-migrate: image: oryd/hydra:v26.2.0 depends_on: diff --git a/examples/plugins/auth-admin/admin-groups.ts b/examples/plugins/auth-admin/admin-groups.ts index 9e255db..9cec05c 100644 --- a/examples/plugins/auth-admin/admin-groups.ts +++ b/examples/plugins/auth-admin/admin-groups.ts @@ -15,7 +15,8 @@ const GROUP_NS = "Group"; const MEMBERS = "members"; const DEFAULT_PAGE_SIZE = 25; const PAGE_SIZES = [25, 50, 100]; -// One Kratos `listIdentities` page of candidate users is fetched for the member pickers (mirrors admin-users). +// One Kratos `listIdentities` page of candidate users is fetched for the member pickers (mirrors +// admin-users). const LIST_FETCH_SIZE = 250; const GROUP_NAME = /^[a-z0-9][a-z0-9_-]*$/; // URL-safe; doubles as the path segment const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i; // a Kratos identity id diff --git a/examples/plugins/scheduling/plugin.ts b/examples/plugins/scheduling/plugin.ts index 29f6a8a..573618b 100644 --- a/examples/plugins/scheduling/plugin.ts +++ b/examples/plugins/scheduling/plugin.ts @@ -34,7 +34,7 @@ export default definePlugin({ public: true, // the header gates nothing; each child names its own gate, and an empty header is dropped }], - // Permissions this plugin declares (docs + Keto seeding), named `:`. + // Permissions this plugin declares: the admin picker offers them and bootstrap grants them to the demo admin. permissions: [ { description: "View shifts", name: READ }, { description: "Create and edit shifts", name: WRITE }, diff --git a/public/css/styles.css b/public/css/styles.css index c123361..eaccaca 100644 --- a/public/css/styles.css +++ b/public/css/styles.css @@ -20,10 +20,11 @@ resolution is unreliable across engines. color-scheme is still set as a hint for native widgets (date picker, scrollbars, selects). - Footgun: a token value a floor engine can't parse (a function or unit it lacks) - is invalid at computed-value time, so every declaration reading it through - var() computes as `unset`; a fallback declared before it doesn't help. - src/test-tooling/stylesheet-floor.ts fails its test on one. + Footgun: a token value an engine of the oldest browser floor can't parse (a + function or unit it lacks) is invalid at computed-value time, so every + declaration reading it through var() computes as `unset`; a fallback declared + before it doesn't help. The test in src/test-tooling/stylesheet-floor.ts + fails on such a value. ------------------------------------------------------------- */ :root { /* ---- raw LIGHT palette ---- */ diff --git a/src/auth/jwt.ts b/src/auth/jwt.ts index 0583f0d..cc227e0 100644 --- a/src/auth/jwt.ts +++ b/src/auth/jwt.ts @@ -4,9 +4,8 @@ import type { JsonWebKey } from "./jwks.ts"; // JWS signature verification with the Node stdlib — no `jose`/JWT dep: // `createPublicKey({format:"jwk"})` imports a JWK and verifies the RS*/ES* signatures -// the Kratos tokenizer produces (see AGENTS.md). Signature only: the caller -// (`jwt-middleware.ts`) adds claim checks (exp/iss/aud, clock skew) and picks the key by `kid` -// from the cached JWKS (`jwks.ts` fetches and rotates it). +// the Kratos tokenizer produces. Signature only: `jwt-middleware.ts` +// picks the key by `kid` and checks the claims. // JOSE `alg` → Node verify parameters. ES* signatures are raw r‖s (IEEE P1363), not DER. // Extend this map to widen support. Security invariant: never add `HS*`/`none` — this map diff --git a/src/auth/login.ts b/src/auth/login.ts index 623d15c..847be26 100644 --- a/src/auth/login.ts +++ b/src/auth/login.ts @@ -40,8 +40,8 @@ export interface CompletedLogin { // The coarse permissions a user holds — directly (`Permission:#granted@user:`) or transitively via a // group granted the permission. Enumerates the defined permissions (the distinct objects in the Permission // namespace) and asks Keto to check each grant, so a permission granted to a group reaches the JWT — -// matching the OPL model. At login/refresh only, never per -// request; permission count is small, so the per-permission checks are cheap and run in parallel. +// matching the OPL model. At login/refresh only, never per request; permission count is small, so the +// per-permission checks are cheap and run in parallel. export async function readPermissions(keto: KetoClient, userId: string): Promise { const subject_id = `user:${userId}`; const names = new Set(); diff --git a/src/plugin-host/router.ts b/src/plugin-host/router.ts index 5ad681e..d3446d9 100644 --- a/src/plugin-host/router.ts +++ b/src/plugin-host/router.ts @@ -1,8 +1,6 @@ // Router: pure core mapping method + pathname → a discovered plugin route. I/O-free; // app.ts is the shell (build context, gate, call handler, render RouteResult). A route mounts at // `/` + its path (fullPath, shared with conflict detection); `:name` segments → path params. -// Specificity: the route with fewer `:param` segments wins (/users/new beats /users/:id). A tie, such -// as /a/:x/b against /a/b/:y, falls to discovery order. import { fullPath, type Plugin, type Route } from "./plugin.ts";