Repository navigation
server: XID participant identity follows the request, the owner's list and the start - #3077
Merged
Merged
Conversation
…t and the start - A request whose xid differs from the xid bound to its participant token is treated as that xid's participant, with the conversation's XID gates applied to it, and receives a token bound to it; it no longer acts as the token's participant. An empty or blank xid is treated as absent. - An XID token issued for another conversation carries no user or participant into this one; its xid is resolved here like a first visit. - When the identity is an xid and the conversation uses the XID allow-list, the xid must be on the owner's list on every action (join, vote, comment, next statement, participation init), so removing it takes effect. The list is the owner's: an xid listed from any of the owner's conversations is admitted to each of them, and never-listed xids are refused. Replacing the list replaces the owner's list, and reading it returns the owner's list. - The allow-list setting is fixed once a conversation has started: changing it after anyone from outside the owner's site has joined is refused with 409 polis_err_xid_whitelist_fixed_after_start, and the update is not applied. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018NVGBuYCk4EZmiz4csUv9s
Delphi Coverage Report
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No schema change, no new route. Every change sits in participant identity resolution or the XID allow-list.
Observable changes
PUT /api/v3/conversationsthat would changeuse_xid_whitelist(either direction) after anyone from outside the owner's site has joined returns 409polis_err_xid_whitelist_fixed_after_start, and nothing in that update is applied. The owner's and the site's moderators' own seed statements don't count as a start. Before the start it can be set freely, and creation is unchanged.polis_err_xid_not_allowed); removing an xid stops it from its next action. Listing the same xid from a second conversation is accepted.replace_allreplaces the owner's list, andGET /api/v3/xidAllowList(and its CSV) return the owner's list.Participation path. Anonymous, invited (invite-tree), signed-in and owner or moderator participants are resolved exactly as before, and the tests prove each one. For a request whose identity is an xid, the added cost is one conversations primary-key read, plus one indexed allow-list read when the list is on: same pool, no lock, no outside call.
Tests. New
xid-identity-integrity.test.ts(21): the mismatch rule, empty xids, cross-owner tokens, per-owner listing and revocation, the setting freeze, and proofs for anonymous, own-token xid, fresh listed xid, invite-tree, owner and moderator participation. Locally the participation-path and conversation suites pass, apart from cases that need the DynamoDB/SES emulators, which fail identically on unchanged code.tsc --noEmit, eslint (0 errors) and prettier are clean, and the vote-sign lint reports 0 new sites.🤖 Generated with Claude Code