Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Default Permissions Infra v0.1 #1038

Draft
wants to merge 16 commits into
base: main
Choose a base branch
from
Draft

Default Permissions Infra v0.1 #1038

wants to merge 16 commits into from

Conversation

cool-ant
Copy link
Member

@cool-ant cool-ant commented Feb 10, 2025

This is the first implementation of the "permissions OAuth" flow.
WASM doesn't support async calls yet, so this isn't as smooth as it eventually will be, but this gives us a version of this tech that works with some caveats and can easily be augmented when the async upgrades to WASM are completed.
Related issue (which I'm leaving open to include the eventual async work) #749.

Permissions OAuth works on a per-method-call basis. So Caller calling Callee.plugin's xxxxx method is verified as permitted by Callee via a new Permissions Plugin.

To see this in action,

  1. open any plugin in the plugin tester, e.g., http://branding.psibase.localhost:8079/common/plugin-tester and in the upper-most left text box that says "branding", change it to "auth-sig" and click "Load".

  2. We'll trigger an action that requests a permission check via Auth-Sig's plugin's setkey method.
    2a) Click the "Keyvault" tab, then click generate-keypair, then the "Execute" button. Copy the public key (everything in the Response textbox other than the enclosing double quotes).
    2b) Click the "Actions" tab, then click "set-key", and paste the pub key into the "publicKey" field.
    2c) Due to an encoding issue in the tester, click on the "Raw" tab, delete the "public-key" line, and then remove the first backslash of the double-escaped newline characters in the pub key (so it looks like what you pasted). There are 4 double-escaped newline characters that need attention.
    2d) Finally, click the "Execute" button.

  3. if a permissions setting hasn't already been saved (which would auto-approve/transparently-approve the request, a dialog will be displayed for the user to Approve/Disapprove the call (and the original call will fail with an instructional message in the browser console),

image
  1. if user approves, the approval is saved by Permissions to local storage (with a key clientdata:permissions:[callee]<-[caller] in the Supervisor's subdomain to enable auto-approve going forward,
image
  1. and finally repeating the original user action will now be autoapproved, since the approval is now stored in local storage, and you'll see a transaction happen in the console.
image

@James-Mart James-Mart linked an issue Feb 13, 2025 that may be closed by this pull request
2 tasks
@James-Mart James-Mart added the System app Related to system services and their apps/plugins label Feb 13, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
System app Related to system services and their apps/plugins
Projects
None yet
Development

Successfully merging this pull request may close these issues.

ψAuth - psibase oauth flow
2 participants