Wanderland Core: Authorization

Scope-based authorization. The capability model with two axes: roles (ceiling) and scopes (floor).

The Model

Roles are the ceiling — the maximum set of capabilities an identity could be granted. Defined on the identity by the IDP.
Scopes are the floor — the minimum set of capabilities required to perform a specific operation. Defined on the boundary.
At token issuance (IDP#issue), requested scopes are validated against roles. You cannot request a scope your roles don't permit.
At authorization time (here), held scopes are checked against required scopes. You cannot proceed without the scopes the operation demands.

The Check

required.all? { |s| held.include?(s) }

The caller must hold every required scope. Having :read but missing :sign when both are required is a denial. Any gap raises Authorization::Denied with both lists for audit.

Every authorization check — granted or denied — is recorded on the active trace span.

Unattributed requests (Reference)

The engine marks each routed request. Peek and poke set the principal of the request from the verified identity. A boundary that reads or writes storage itself, outside peek and poke, runs with no principal. This document calls such a request an unattributed request.

Caller	`:pki:` and `:identities:`	Every other tree
A request with a principal.	The registry refuses each read and write.	The access entry of the address applies.
An unattributed request.	A read finds nothing, and a write raises `StorageAccess::Denied`.	The registry does not check access.
Code under `Principal.system`.	The registry does not check access.	The registry does not check access.
Code outside a request, such as boot or a schedule.	The registry does not check access.	The registry does not check access.

Code that needs a key or an identity during a request runs that read under Principal.system. A list read in an unattributed request drops each row under :pki: or :identities:.

Access entries (Reference)

A storage mount declares its access: one level for the whole mount, or a map from an address key to a level. The registry finds the entry for an address with access_for. The store checks each read and each write that a request makes against that entry.

Level	Who reads or writes
`restricted`	No request. Only the process itself.
`authenticated`	A request with a verified identity. An entry can also name the `groups` that the identity must hold.
`open`	Any request.

Rule	Meaning
A key is a prefix	The key `:plans:` reaches every address that starts with `:plans:`.
A `*` segment	A `` in a key stands for exactly one address segment, with no colon. The key `:plans::runs:*:cancel` reaches the cancel record of every run, and no other record of a run.
The longest key wins	When more than one key reaches an address, the entry of the longest key applies.
The `*` key	The key `*` alone is the default of the map. It applies when no other key reaches the address.
Always restricted	The registry restricts `:pki:` and `:identities:`, whatever a mount declares.
No access declared	A mount with no `access` is open.

Source File

wanderland-core/lib/wanderland/authorization.rb

Site Audit

wanderland.dev

oculus-view: fence: Fence execute bit is disabled. Use force=true to override.