Every token this engine mints is as powerful as the apps it can reach: a
read-only integration can still write to the *arr. arrproxy v0.5.0 accepts
a method scope at mint time, so let a role pin its tokens to it.
- Add an optional role field methods, uppercase-normalized, de-duplicated
and validated against the known HTTP methods at role write.
- Forward the role's scope as methods on the arrproxy mint request and
echo it in the creds response alongside apps/subject.
- Omit the field entirely when a role has no scope, so an arrproxy
predating method scoping sees an unchanged request.
- Cover normalization, rejection, pass-through and the unscoped case.
unkin-agent