security(core): scope auth tokens with explicit CRUD permissions and server-assigned login (24.05) - #7964

Open

ar2rsawseen wants to merge 10 commits into

release.24.05from

security/token-permission-model-2405

Commits on Aug 18, 2026

security(core): scope auth tokens with explicit CRUD permissions and server-assigned login
claude
committed
dea603b

Commits on Aug 19, 2026

security(core): require a scoped token to state the permissions it grants

claude
authored and
ar2rsawseen
committed
31c72bd
fix(token-manager): lay out the create-token drawer correctly
claude
committed
651989d
test(core): cover token scoping on real data endpoints

claude
authored and
ar2rsawseen
committed
849ba14
test(core): cover every token shape, the login path and permissions changing under a token

claude
authored and
ar2rsawseen
committed
e68f639
test(core): keep the token scope cases deterministic wherever they run

claude
authored and
ar2rsawseen
committed
ad952c0
fix(core): keep the checklistbox option label a single text node
claude
committed
e39355f
test(core): give the probed handlers the parameters they need to reply

claude
authored and
ar2rsawseen
committed
409b343
test(core): remove the member created for the owner-permission case deterministically

claude
authored and
ar2rsawseen
committed
c2e41fe

Commits on Aug 20, 2026

security(core): require a full-permission credential for /o/render

ar2rsawseen
and
claude
committed
2e23a0d