326a757cdb
* Peer- and session-scoped JWTs were effectively workspace-scoped: auth() walked the route's declared scope and fell through to a workspace match, so a {w: ws-a, p: alice} token could act on any peer in ws-a.
* feat: peer keys can read sessions they belong to; require workspace on scoped keys
* fix: authorize JWTs by narrowest scope and gate member reads
Follow-up hardening on the narrowest-claim auth fix:
- Scope get_peer_config member-read to the caller's own peer; a session
member could previously read a co-member's per-session config.
- Enforce session membership on POST /peers/{id}/chat: the session_id
arrives in the body (invisible to require_auth), so a peer key could
read any session's injected message history. Check is_peer_in_session
in the handler before the dialectic runs.
- Consolidate the workspace-match check in auth() to a single hoisted
guard so no branch can silently re-open cross-workspace access.
- Normalize empty-string scope claims to None in verify_jwt so a blank
workspace can't satisfy the peer/session token-shape invariant.
- Extract scope_requires_workspace(), shared by verify_jwt and the keys
API so the creation-time guard and verification invariant can't drift.
route requires auth) and CLAUDE.md auth-scoping guidance.
- docs: describe narrow-scope key semantics in the platform reference.
---------
Co-authored-by: Vineeth Voruganti <13438633+VVoruganti@users.noreply.github.com>
|
||
|---|---|---|
| .. | ||
| changelog | ||
| images | ||
| logo | ||
| snippets | ||
| v1 | ||
| v2 | ||
| v3 | ||
| README.md | ||
| bun.lock | ||
| docs.json | ||
| favicon.svg | ||
| package.json | ||
README.md
Honcho Docs
These docs are built using Next.js via mintlify.
Setting Up Honcho's Docs Locally
- Clone the repository:
git clone git@github.com:plastic-labs/honcho.git
- Navigate into the
docsfolder:
cd honcho/docs/
The docs folder contains the markdown files that make up the documentation. The majority of the files are in the pages directory. Some notable files in this folder include:
- Verify that you have Node.js and npm installed in your system. You can check by running:
node --version
npm --version
-
If not installed, download Node.js and npm from the respective official websites.
-
Once you have Node.js and npm running, proceed to install
pnpm- another package manager that helps to manage project dependencies:
npm install -g pnpm
- Install the project dependencies using pnpm:
pnpm i
- After the successful installation of the project dependencies, start the local server:
pnpm dev
Now, you should be able to view the docs on your local environment by visiting http://localhost:3000. You can explore the different markdown files and make changes as you see fit.