coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
flex-auth/workplans/ADHOC-2026-08-23.md
tegwick c473f1971d
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 37s
Details
feat(authz): bind decisions to exact actions 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81
2026-08-23 13:18:26 +02:00

931 B
Raw Blame History

id type title domain repo status owner topic_slug created updated
ADHOC-2026-08-23 workplan Inbound caller-auth and deployment documentation corrections infotech flex-auth finished codex netkingdom 2026-08-23 2026-08-23

Classify rejected TokenReview credentials as unauthenticated

id: ADHOC-2026-08-23-T01
status: done
priority: medium

Treat a successful TokenReview response that rejects a bearer token as an authentication failure (HTTP 401), while retaining HTTP 503 for transport, HTTP, and response-decode failures. Regression coverage exercises the reviewer and authenticator seam.

Correct NetworkPolicy egress documentation

id: ADHOC-2026-08-23-T02
status: done
priority: low

Document that caller-authenticated pins permit TCP 443 and 6443 without a destination selector for Kubernetes TokenReview, while pins without caller authentication retain deny-all egress.