mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-08-20 07:13:05 +00:00
Anso
78a742fb44
Proxied requests authenticated to a remote node previously ran as admin regardless of the originating user's role, so a non-admin using the UI against a remote node could reach admin-only handlers there. The forwarding primary now asserts the user's role on a trusted header that the remote honors only for node_proxy/pilot_tunnel bearers (the same trust model as the license tier header), and the gateway overwrites the header on every proxied request so a client cannot smuggle it. An absent header keeps admin for direct instance-to-instance and background service calls; an unrecognized role fails closed to read-only.
19 lines
870 B
TypeScript
19 lines
870 B
TypeScript
/**
|
|
* HTTP header names used for Distributed License Enforcement between
|
|
* Sencho instances. A primary instance proxies tier-gated requests to
|
|
* its remote fleet nodes and asserts the license state via these
|
|
* headers; the remote node trusts the headers when the request is
|
|
* authenticated as a node_proxy bearer.
|
|
*/
|
|
export const PROXY_TIER_HEADER = 'x-sencho-tier';
|
|
|
|
/**
|
|
* Carries the signed-in user's role from the forwarding primary to the remote
|
|
* node, so the remote enforces that user's RBAC instead of treating every
|
|
* proxied request as admin. Trusted under the same rule as PROXY_TIER_HEADER:
|
|
* only a request authenticated as a node_proxy/pilot_tunnel bearer may set it,
|
|
* and the gateway overwrites it on every proxied request so a browser or API
|
|
* client cannot smuggle a role through.
|
|
*/
|
|
export const PROXY_ROLE_HEADER = 'x-sencho-actor-role';
|