Report whether this server trusts anything beyond the official publisher - #24
Draft
lr00rl wants to merge 2 commits into
Draft
Report whether this server trusts anything beyond the official publisher#24lr00rl wants to merge 2 commits into
lr00rl wants to merge 2 commits into
Conversation
TASK-0012's server half, shaped by athena's proposal after she checked the thing that
would have broken: /api/plugin-contributions returns a BARE ARRAY and the dashboard
consumes PluginView[], so carrying a sibling field there would break every current
client. New read-only GET /api/plugin-trust instead, withAuth("") because the banner
must appear for whoever is looking at the screen, not only for admins.
Two properties she asked for explicitly, both now pinned by tests:
- names, never keys. The operator needs to know WHICH publisher is trusted, never
its value. Proved by breaking it: leaking the key makes the test print it.
- absence must never look like safety. The object is ALWAYS emitted, including
"non_official": false, so a banner gated on a field's presence cannot confuse
"trust is normal" with "the server never told me".
allow_unsigned_host_risk raises the condition on its own: disabling signature
enforcement is categorically worse than one extra trusted publisher.
The endpoint tells the dashboard; this tells a server nobody is looking at. Two independent surfaces for one condition, and the log follows the same rule as the payload: names only, never key material.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
TASK-0012 server half — the field athena needs for the trust banner.
Shape is hers, and she checked the thing that would have broken first:
/api/plugin-contributionsreturns a bare array consumed asPluginView[], so hanging a sibling field off it breaks every current client. New endpoint instead."non_official": falseincluded, so a banner gated on field presence cannot confuse "normal" with "never answered".allow_unsigned_host_riskraises the condition alone: turning off signature enforcement is worse than one extra publisher.Verified: gofmt clean, vet clean, 4/4 under
-race. Each guard was then broken deliberately to confirm the test fails — the naming test and the key-leak test both fired, and the leak test printed the material it caught.https://claude.ai/code/session_01CoVXeAw726rrKNf8tDLNk1