Gate a route or nav node on a session, not only a permission #103

2026-09-02T09:00:14+02:00

lilleman commented

2026-09-02 09:00:14 +02:00

Adds a third coarse gate to the plugin contract: session: true takes any signed-in user, with no
grant to hold. src/auth/gate.ts is the one home of the rule the plugin router, the host's own
route table, the menu and discovery all read.

Every route and nav node now names exactly one gate, spelled true: discovery refuses a
declaration that names none, names two, or spells a flag anything but true, so a forgotten gate
fails the boot instead of publishing a page.

HOST_API_VERSION goes to 0.4.0. A host built before this reads session as no gate at all and
would serve the page to anonymous visitors, so the minor is what makes it refuse the plugin instead.

The reference plugin gains /scheduling/mine, scoped at the upstream by the visitor's identity id
rather than their email, and re-filtered in the handler so a backend that ignores the scope cannot
leak through the page.

Adds a third coarse gate to the plugin contract: `session: true` takes any signed-in user, with no grant to hold. `src/auth/gate.ts` is the one home of the rule the plugin router, the host's own route table, the menu and discovery all read. Every route and nav node now names **exactly one** gate, spelled `true`: discovery refuses a declaration that names none, names two, or spells a flag anything but `true`, so a forgotten gate fails the boot instead of publishing a page. `HOST_API_VERSION` goes to 0.4.0. A host built before this reads `session` as no gate at all and would serve the page to anonymous visitors, so the minor is what makes it refuse the plugin instead. The reference plugin gains `/scheduling/mine`, scoped at the upstream by the visitor's identity id rather than their email, and re-filtered in the handler so a backend that ignores the scope cannot leak through the page.

lilleman added 5 commits 2026-09-02 09:00:15 +02:00

Gate a route or nav node on a session, not only a permission

CI / full-gate (push) Successful in 3m6s

Details

8da75b4ca7

Scope My shifts at the upstream, and give Route and NavNode one gate declaration

CI / full-gate (push) Successful in 2m56s

Details

c7e6d66750

Say gate where the code now gates, in the two contracts that still said permission

CI / full-gate (push) Failing after 2m38s

Details