security(core): scope auth tokens with explicit CRUD permissions and server-assigned login - #7963

Open

ar2rsawseen wants to merge 10 commits into

security/token-permission-model

Commits on Aug 18, 2026

security(core): scope auth tokens with explicit CRUD permissions and server-assigned login
claude
committed
94a0b4d

Commits on Aug 19, 2026

security(core): require a scoped token to state the permissions it grants
claude
committed
7d70a17
fix(token-manager): lay out the create-token drawer correctly
claude
committed
3c81f38
test(core): cover token scoping on real data endpoints
claude
committed
ce2fa9d
test(core): cover every token shape, the login path and permissions changing under a token
claude
committed
150563d
test(core): keep the token scope cases deterministic wherever they run
claude
committed
b467847
fix(core): keep the checklistbox option label a single text node
claude
committed
7543ce3
test(core): give the probed handlers the parameters they need to reply
claude
committed
9062ee6
test(core): remove the member created for the owner-permission case deterministically
claude
committed
db4e2c0

Commits on Aug 20, 2026

security(core): require a full-permission credential for /o/render

ar2rsawseen
and
claude
committed
382f3e0