fix(core): admit org-less endpoints under Bedrock identity enforcement - #145
Open
minekube-ai-engineer[bot] wants to merge 1 commit into
Open
fix(core): admit org-less endpoints under Bedrock identity enforcement#145minekube-ai-engineer[bot] wants to merge 1 commit into
minekube-ai-engineer[bot] wants to merge 1 commit into
Conversation
An endpoint without an organization parent is a first-class endpoint-scoped identity scope: the envelope binds to the endpoint itself and the org dimension is optional (moxy GeyserMC#544, support case: gurtville scope_unavailable). - BedrockIdentityVerifier no longer requires a non-empty org_id in the envelope endpoint scope, and treats an empty configured org as no org constraint (optionalNullOrEmpty) instead of throwing. - BedrockIdentityEnforcer only requires the endpoint id for scope completeness; a missing org no longer rejects under require-mode enforcement. - TDD: org-less envelope verify + require-mode enforcer tests failed on the unfixed code (orgId is required / allowed=false) and pass after.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The Connect Java plugin's Bedrock identity enforcement still requires an organization on the identity scope, reproducing the same gap moxy #544 removes on the edge side.
An endpoint without an organization parent is a first-class endpoint-scoped identity scope: the signed envelope binds to the endpoint itself (globally unique id), and the org dimension is optional. Requiring an org meant:
BedrockIdentityVerifier.validaterejected envelopes with an emptyorg_id("identity envelope endpoint scope is incomplete").IllegalArgumentException: orgId is requiredwhen configured with an empty org (.orgId("")).BedrockIdentityEnforcerrejected org-less endpoints underenforcement: require("authenticated endpoint scope is incomplete") — the default iswarn, so today it only logs, but strict-mode users were blocked.Support case:
gurtville— a Connect-plugin user with an org-less endpoint gotscope_unavailableon Bedrock join. The owner should never need to claim/import the endpoint into a dashboard organization just to enable Bedrock.Change
BedrockIdentityVerifier: the envelope endpoint scope requires onlyid+name;org_idmay be empty. The configured org is now optional-empty (optionalNullOrEmpty) — an empty value means "no org constraint", matching the scope check that already only compared org when non-null.BedrockIdentityEnforcer: the scope-completeness pre-check requires only the endpoint id; a missing org no longer rejects underrequiremode.Verification (TDD)
verifiesEndpointScopedBedrockXuidEnvelopeWithoutOrgfailed withorgId is required(builder throw);requireModeAllowsOrglessEndpointScopefailed withallowed=false(enforcer reject).:core:test :api:testsuite green (340+ tests; the one pre-existing environmental failure —ReleaseAssetVerificationTestneedingjq— passes once jq is present).