Repository navigation
Conversation
A firehose principal event names a tenant and a userId, not a delegation CID, so the revoker needs a way from that pair to the access keys it covers. KeyProofs.Bind records the pair for a key and InvalidatePrincipal drops every store bound to it; Revoker.InvalidatePrincipal clears the verification key and tenant alongside, sharing the helper with Revoke. The index has its own mutex. go-cache runs the store eviction hook synchronously from Delete, and InvalidateHolders deletes while holding the registry mutex, so a hook reusing it would deadlock. Nothing binds keys yet; the authorize path does that once hilt reports the principal. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
pyropy
force-pushed
the
srdjan/feat/iam-enforce-actions
branch
from
September 11, 2026 12:42
c756269 to
a2a886d
Compare
pyropy
force-pushed
the
srdjan/feat/iam-principal-index
branch
from
September 11, 2026 12:42
c7aeaa3 to
76b5ec3
Compare
Contributor
Author
|
Superseded by the per-key marker design in fil-one/RFC#30 (f61f474): no principal invalidation record; markers are revoked through the existing /ucan/revoke. Branch kept. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
A firehose principal revocation names a tenant and a principal rather than a delegation CID, so the revoker needs a way from that pair to the access keys it covers.
KeyProofs.Bindrecords the pair for a key andInvalidatePrincipaldrops every store bound to it. Nothing binds keys yet. Part of the Forge S3 tenant IAM work (RFC).Change log
PrincipalRef,Bind,InvalidatePrincipal, eviction-driven unbind onKeyProofsRevoker.InvalidatePrincipal;clearKeysshared withRevoke🤖 Generated with Claude Code