feat(sharing): authorize identity-owned device invites#1360
Conversation
This stack of pull requests is managed by Graphite. Learn more about stacking. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ab64d8d239
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| reviewed_preview_digest: reviewedPreviewDigest, | ||
| reviewed_intent: opts.reviewedIntent, | ||
| }; | ||
| const url = `${stripTrailingSlashes(remote)}/v1/invites/add-device`; |
There was a problem hiding this comment.
For a scheme-less coordinator configuration such as coord.example:7337, regular coordinator presence and peer lookup work because coordinator-runtime.ts passes syncCoordinatorUrl through buildBaseUrl, but this new path constructs coord.example:7337/v1/invites/add-device directly. buildAuthHeaders consequently parses coord.example: as a non-HTTP scheme and fetch fails with an unknown-scheme error, so non-admin add-device invitations fail for an otherwise working coordinator configuration. Build the request URL from buildBaseUrl(remote) before signing and sending it.
Useful? React with 👍 / 👎.
Merge activity
|
1 participant
Description
Allow an enrolled device to create an add-device invitation for its own coordinator-bound Identity without possessing the coordinator admin secret.
The new fixed-purpose signed endpoint derives the target Identity exclusively from the active enrollment binding, verifies the reviewed intent and digest against that Identity, rejects authority fields supplied by the client, and uses existing signature/nonce replay protection. Team invitation creation remains admin-only. An explicitly admin-configured initial owner continues to select admin issuance up front because initial owner enrollment intentionally remains unbound; signed failures never fall back to admin authorization.
This prevents a teammate from selecting another Identity or using a broad admin credential merely to add one of their own devices.
Type of Change
Testing
pnpm run tsc,pnpm run lint,pnpm run test)Additional validation:
pnpm --filter @codemem/cloudflare-coordinator-worker test:workerChecklist
pnpm run lintpasses for touched files)