chadtmiller.com/knotless

Switch repository

Loading…

What changes

The login names knotless's own space types. oauth::SCOPE asks for space:dev.knotless.space?authority=*&… and space:dev.knotless.orgSpace?authority=*&…, each with the collections its lexicon lists (read from lexicons/ at build time, space_scope) and manage=create&manage=update&manage=delete, in place of space:*?authority=*&collection=*. A knotless login no longer reaches other apps' spaces.

So does a gateway's grant. gateway::SCOPE names the same two types, authority=self: a private repository's space with the records a push writes and orgMember, and an organization's space with orgMember and orgAcceptance, still manage=create&manage=update alone.

Older logins and grants. Both still work, as space:* covers the named types. behind() compares the scope as asked, so each is behind and asked for again: LOGIN_BEHIND on the command line and the pages, GRANT_BEHIND for a gateway's grant. sessions_behind_what_is_asked now covers a broad login and a broad gateway grant.

The test harness. harness/pds.mjs puts every space lexicon under lexicons/ into the alpha PDS's lexicon store before any account logs in. That is the account database's lexicon table, which the provider's LexiconGetter reads, marked as resolved and fresh for good. The alpha resolves lexicons through DNS and its own PLC, so it cannot reach the published ones. This covers test, e2e and the shots' worlds, which all start the PDS through it.

The move out of dev.knotless.org spaces goes. A login or grant that names the types alone cannot read a space of the old type, and no scope can name it, as its lexicon is no space. So the move from the pull before (moved, move_space, App::move_org_spaces), and every reader of the old space (admit_as, join, leave, remove_as, delete_as, the index's org_roster_with, orgs_of, keep_org, resync, from_authority), could only ever be refused from here on. They are taken out, with their test and log lines, and docs/design/gateway.md loses its "Moving out of the old space" section. Prod's log after that pull deployed said org spaces moved count 1, failed 0, and org joins in old spaces count 0: nothing is left in an old space for any of it to read.

Why

space:* gave every knotless login every app's spaces, which the space lexicon pull, The space type private repositories are has a lexicon, dev.knotless.space, left for this one.

The alpha's authorization page resolves the lexicon of each space type a scope names and refuses the login if one fails. So this lands only after both lexicons were published: dev.knotless.space with that pull, dev.knotless.orgSpace with An organization's space has a type of its own, dev.knotless.orgSpace, and publish-lexicons passed on main after each.

How it was checked

oauth::tests pass here. With the alpha's dev-env, harness/pds.mjs's store makes lexiconManager.getSpacesFromScope answer both types, and buildTokenScope keep them. dev.knotless.org still fails, as it should. The Rust tests and e2e log in over OAuth against that PDS, so CI runs every login through the narrowed scope.

Shortcomings

• An organization's old space is left on its PDS, empty of knotless's records. A narrowed login cannot delete it, and nothing reads it.
• An organization that never had its gateway start after the pull before landed would keep its invitations in an old space no one reads. Prod's log says there is none.

🤖 Generated with Claude Code

This pull narrows the login scope and the gateway grant from space:* to the two named types, dev.knotless.space and dev.knotless.orgSpace. The collections come from the lexicons at build time. It also seeds the alpha PDS's lexicon store in the test harness.

I read the diff and found no bugs.

• The scope builder, the updated behind() tests and the harness seeding look right.
• Both design docs and the change file are updated with it, as AGENTS.md asks.
• The harness throws if it finds fewer than two space lexicons, so a bad path can't pass silently.
• The old-type (dev.knotless.org) gap is already listed under Shortcomings, with the migration order that avoids it.

The test, e2e, check and docs checks were still queued when I looked. Those are the ones that exercise the narrowed scope against the alpha PDS, so wait for them to pass before merging.

Round 2. Since my approval the pull has added one commit, d9e61e8, and merged main. The commit removes the whole move out of the old dev.knotless.org organization spaces. That includes move_org_spaces, org::moved and OLD_SPACE_TYPE. It also removes the dual-space reads in the index, admit_as, join and leave, plus the telemetry, the gateway test and the design section.

I found one thing to fix and one to confirm.

1. Wrong doc line. In docs/design/access.md:163 the organization's member-list space is now at://<org>/space/dev.knotless.org/self. The code still uses SPACE_TYPE = "dev.knotless.orgSpace" and the same pull's scope names that type. The line looks like an over-eager revert to the pre-move wording. It should say dev.knotless.orgSpace.
2. The description is out of date. Its Shortcomings still say the earlier pull moves organizations under the old grants and that its log says what is left. They also say the appview syncs an old space and keeps a hidden member's join record counted. After this commit none of that exists: nothing moves, nothing reads or logs an old space, and a hidden member whose join record is still in an old space is simply not a member.
   • Please reword the description to say that.
   • Confirm that prod has already moved every organization (org spaces moved with failed 0). Confirm too that you accept losing the org joins in old spaces count, because this deploy strands anything left.

I could not read the rest of the diff against main in full, so this review covers the new commit only.

The test, e2e, check and docs checks were still queued when I looked. They exercise the narrowed scope against the alpha PDS, so wait for them to pass before merging.

Fixed access.md:163 in the next commit. The description was rewritten with that commit: its Shortcomings now say the old space is left, empty, and read by nothing. Prod's log after the move deployed: org spaces moved count 1, failed 0, and org joins in old spaces count 0, so nothing is stranded. Losing that count is accepted: with the narrowed grant nothing could read an old space to count it.

Round 3. The new commit 346b9ed fixes docs/design/access.md:163, which now says at://<org>/space/dev.knotless.orgSpace/self, matching org::SPACE_TYPE. A search of the branch finds no other mention of space/dev.knotless.org. The description was rewritten as I asked. Your reply gives the prod log counts: org spaces moved 1 with failed 0, and org joins in old spaces 0. You accept losing that count. I have nothing further to ask for. The pull is queued, so the check and test pre-flight runs will exercise the narrowed scope against the alpha PDS before it lands.