main · last commit
18 hours ago ·
8tmadfpi
spec-ejq.3 Web: owner-only /tokens page for minting and revoking agent tokens
Lined Up
bd update spec-ejq.3 --claim
bd close spec-ejq.3
| Created by | Eugene Blikh |
| Owner | bigbes@gmail.com |
| Created | 2026-08-05T03:41:50Z |
| Updated | 2026-08-05T03:41:50Z |
Agent tokens can only be issued on the host (db.Store, and now specsrht token create). That makes the remote agent write plane unusable from anywhere without SSH: to hand an agent a credential the owner must be at the machine. Add an owner-only /tokens page — list, mint (plaintext shown once), revoke — going through service/, so the CLI and the page share one implementation of the ACL and the mint.
service.IssueAgentToken/ListAgentTokens/RevokeAgentToken are owner-only and refuse an agent with ErrForbidden; GET /tokens lists tokens for the owner and 403s everyone else; POST mints and shows the plaintext exactly once; POST revoke stamps it; both writes carry the same-origin CSRF guard as approve/reject; specsrht token create goes through the same service methods
spec-ejq
— spec.sr.ht — reviewable document storage for humans and agents
parent-child
open
Nothing depends on this issue.
| id | spec-ejq.3 |
| content_hash | d5e91d9dd2041fbb4e9356037da24d7fdcb5a8456af3220d1a915b49e9eff878 |
| title | Web: owner-only /tokens page for minting and revoking agent tokens |
| description | Agent tokens can only be issued on the host (db.Store, and now specsrht token create). That makes the remote agent write plane unusable from anywhere without SSH: to hand an agent a credential the owner must be at the machine. Add an owner-only /tokens page — list, mint (plaintext shown once), revoke — going through service/, so the CLI and the page share one implementation of the ACL and the mint. |
| design | |
| acceptance_criteria | service.IssueAgentToken/ListAgentTokens/RevokeAgentToken are owner-only and refuse an agent with ErrForbidden; GET /tokens lists tokens for the owner and 403s everyone else; POST mints and shows the plaintext exactly once; POST revoke stamps it; both writes carry the same-origin CSRF guard as approve/reject; specsrht token create goes through the same service methods |
| notes | |
| status | open |
| priority | 2 |
| issue_type | feature |
| assignee | NULL |
| estimated_minutes | NULL |
| created_at | 2026-08-05T03:41:50Z |
| created_by | Eugene Blikh |
| owner | bigbes@gmail.com |
| updated_at | 2026-08-05T03:41:50Z |
| closed_at | NULL |
| closed_by_session | |
| external_ref | NULL |
| spec_id | |
| compaction_level | 0 |
| compacted_at | NULL |
| compacted_at_commit | NULL |
| original_size | NULL |
| sender | |
| ephemeral | 0 |
| wisp_type | |
| pinned | 0 |
| is_template | 0 |
| mol_type | |
| work_type | |
| source_system | |
| metadata | �{} |
| source_repo | |
| close_reason | |
| event_kind | |
| actor | |
| target | |
| payload | |
| await_type | |
| await_id | |
| timeout_ns | 0 |
| waiters | |
| hook_bead | |
| role_bead | |
| agent_state | |
| last_activity | NULL |
| role_type | |
| rig | |
| due_at | NULL |
| defer_until | NULL |
| no_history | 0 |
| started_at | NULL |
| is_blocked | 0 |
| id | 306bf8b6-9049-5f2f-85a2-4348acdda8de |
| issue_id | spec-ejq.3 |
| type | parent-child |
| created_at | 2026-08-05T06:41:49Z |
| created_by | Eugene Blikh |
| metadata | �{} |
| thread_id | |
| depends_on_issue_id | spec-ejq |
| depends_on_wisp_id | NULL |
| depends_on_external | NULL |
| id | 019fd003-5f06-7cb2-bce6-6226878c13e7 |
| issue_id | spec-ejq.3 |
| event_type | created |
| actor | Eugene Blikh |
| old_value | |
| new_value | |
| comment | NULL |
| created_at | 2026-08-05T06:41:49Z |
No comments.