This repository has no description
Use knot-scoped DPoP auth for Tangled merge
Woodrow Melling
(Jul 13, 2026, 10:57 PM -0600)
5fd3fb2f
96e9ab85
+4
-6
+1
-1
Sources/TangledXRPC/TangledAuthorization.swift
+1
-1
Sources/TangledXRPC/TangledAuthorization.swift
···
38
38
public static func mergeRequirement(knotHost: String) -> OAuth.AuthRequirement {
39
39
OAuth.AuthRequirement(
40
40
permissions: [
41
-
.rpc(TangledNSID.merge, audience: "*")
41
+
.rpc(TangledNSID.merge, audience: knotAudience(knotHost))
42
42
],
43
43
reason: "Merge Tangled pull requests through the target knot."
44
44
)
-1
Sources/TangledXRPC/TangledKnotRequests.swift
-1
Sources/TangledXRPC/TangledKnotRequests.swift
···
10
10
11
11
public static var nsid: ATProto.NSID { TangledNSID.merge }
12
12
public static var type: XRPC.RequestType { .procedure }
13
-
public static var authenticationMode: ATProto.OAuth.AuthenticationMode { .bearer }
14
13
15
14
public var input: TangledMergeInput
16
15
public var knotHost: ATProto.PDSHost
+3
-4
Tests/TangledXRPCTests/TangledXRPCTests.swift
+3
-4
Tests/TangledXRPCTests/TangledXRPCTests.swift
···
107
107
}
108
108
109
109
@Test
110
-
func mergeRequestTargetsKnotWithBroadServiceRPCPermissionAndBearerAuthentication() throws {
110
+
func mergeRequestTargetsKnotWithServiceRPCPermission() throws {
111
111
let owner = try #require(DID("did:plc:owner"))
112
112
let input = TangledMergeInput(
113
113
did: owner,
···
124
124
)
125
125
126
126
#expect(TangledMergeRequest.nsid == "sh.tangled.repo.merge")
127
-
#expect(request.authenticationMode == .bearer)
128
127
#expect(request.routing == .tangledKnot("knot.example"))
129
128
if case let .required(requirement) = request.authorizationPolicy {
130
-
#expect(requirement.permissions.contains(.rpc("sh.tangled.repo.merge", audience: "*")))
129
+
#expect(requirement.permissions.contains(.rpc("sh.tangled.repo.merge", audience: "did:web:knot.example")))
131
130
} else {
132
-
Issue.record("Merge requires a broad RPC authorization policy.")
131
+
Issue.record("Merge requires a knot-scoped RPC authorization policy.")
133
132
}
134
133
}
135
134