ms2k/remora
SHA256
Watch
0
Code Releases Activity

Define authorization and outbound boundaries

Browse source
This commit is contained in:
ms2k 2026-07-13 14:41:11 +09:00
commit 0b2b026283
1 changed files with 20 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

20
docs/spec/architecture.md
View file

@ -130,6 +130,26 @@ flowchart TD
- Physical deletion is asynchronous and recoverable across worker loss and transient target failures. It does not depend on client request lifetime or reconstruct work by listing a target prefix.
- A permanent minimal tombstone retains job identity, owner, terminal outcome, deletion identity, and audit timing. Retention of more detailed job metadata is deployment policy and never restores result visibility after hard deletion begins.
## Authorization and Credentials
- Submission canonicalizes a concrete target and authorizes it against the caller's current scopes. The accepted job stores an immutable execution grant containing the owner subject, target-store identity, bucket, prefix segments, policy version, and opaque credential references. It stores neither raw roles nor access tokens.
- A bucket is 3–63 lowercase ASCII letters, digits, dots, or hyphens, begins and ends with a letter or digit, and contains no adjacent dots. Bucket and target-store equality are exact and case-sensitive.
- A target prefix is represented as NFC-normalized, case-sensitive Unicode segments separated by `/`. Empty prefix means the complete bucket, and one trailing separator is insignificant. Leading or doubled separators, dot segments, backslashes, Unicode category-C characters, and deployment-reserved internal segments are invalid.
- A storage scope contains one target-store identity, bucket, and prefix segment tuple. It covers a target only when store and bucket match exactly and its segments are a complete prefix of the target segments; textual prefix coincidence is insufficient.
- An owner may list, read, cancel, soft-delete, restore, or hard-delete a job only while current authorization still covers its concrete target. Administrators may manage all jobs and tombstones. List operations apply the same rule as a filter and never reveal unauthorized job existence.
- Workers execute an accepted job from its immutable grant without consulting current identity roles. Failure to establish current authorization fails new submission, reads, and management closed but does not reinterpret accepted execution authority.
- An administrator may explicitly and idempotently revoke an accepted execution grant. Revocation records durable cancellation intent through `JobProtocol`; it does not add an identity-provider lookup to workers or rewrite a terminal outcome.
- Source credentials are server-side opaque references resolved only by the worker component that needs them. Secret values never appear in job configuration, API data, events, logs, or structured failures. Target credentials remain internal to `StorageAdapter`.
## Outbound Source Policy
- The default HTTP-style source policy permits HTTPS on port 443. Deployments may add explicit scheme and port pairs; userinfo, fragments, malformed hosts, and non-canonical numeric IP forms are rejected.
- Every new connection parses and canonicalizes its URL, resolves its hostname once through the policy resolver, and validates the complete returned address set. If any address is denied, the connection is denied.
- Unspecified, loopback, private, shared, link-local, documentation, multicast, reserved, and other non-global addresses are denied by default for both IPv4 and IPv6, including IPv4-mapped IPv6. Deployments may explicitly allow required private networks, but cloud metadata endpoints remain denied.
- The transport connects to one approved resolved address without a second name resolution while retaining the canonical hostname for the HTTP authority, TLS SNI, and certificate verification. Connection-pool reuse must retain the same approved address and policy identity.
- Redirects are bounded to five by default. Every hop repeats URL, scheme/port, DNS, and address validation before dialing. HTTPS-to-HTTP downgrade is denied, and credentials and cookies are removed when the origin changes.
- Ambient proxy environment variables are ignored. An outbound proxy is disabled unless configured as a trusted enforcement boundary that provides the same hostname, resolution, address, redirect, and credential controls. Infrastructure egress policy remains defense in depth.
## Requirements
### Functional Requirements