Add per-role HTTP method scoping to minted tokens #2

2026-08-30T14:31:26+10:00

unkin-agent commented

2026-08-30 14:31:26 +10:00

Why

Every token this engine mints is as powerful as the apps it can reach, so a read-only integration can still write to the *arr. arrproxy now accepts a method scope at mint time, and the engine has no way to ask for one.

How

Add an optional methods role field, uppercase-normalized and de-duplicated.
Reject a method outside GET/HEAD/POST/PUT/PATCH/DELETE/OPTIONS at role write.
Forward the role's scope on the arrproxy mint request and echo it in the creds response.
Omit the field when a role has no scope, so unscoped roles behave exactly as before.
Cover normalization, rejection, pass-through and the unscoped case.

Requires arrproxy >= v0.5.0 deployed.

## Why Every token this engine mints is as powerful as the apps it can reach, so a read-only integration can still write to the *arr. arrproxy now accepts a method scope at mint time, and the engine has no way to ask for one. ## How - Add an optional `methods` role field, uppercase-normalized and de-duplicated. - Reject a method outside GET/HEAD/POST/PUT/PATCH/DELETE/OPTIONS at role write. - Forward the role's scope on the arrproxy mint request and echo it in the creds response. - Omit the field when a role has no scope, so unscoped roles behave exactly as before. - Cover normalization, rejection, pass-through and the unscoped case. Requires arrproxy >= v0.5.0 deployed.

unkin-agent added 1 commit 2026-08-30 14:31:26 +10:00

Add per-role HTTP method scoping to minted tokens

ci/woodpecker/pr/build Pipeline was successful

Details

ci/woodpecker/pr/test Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

337c4ee3b1

Every token this engine mints is as powerful as the apps it can reach: a
read-only integration can still write to the *arr. arrproxy v0.5.0 accepts
a method scope at mint time, so let a role pin its tokens to it.

- Add an optional role field methods, uppercase-normalized, de-duplicated
  and validated against the known HTTP methods at role write.
- Forward the role's scope as methods on the arrproxy mint request and
  echo it in the creds response alongside apps/subject.
- Omit the field entirely when a role has no scope, so an arrproxy
  predating method scoping sees an unchanged request.
- Cover normalization, rejection, pass-through and the unscoped case.

benvin merged commit b1b11330a6 into main

2026-08-30 14:45:04 +10:00

benvin deleted branch benvin/role-methods

2026-08-30 14:45:05 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/vault-plugin-secrets-arrstack#2