Python GSAP broker reference implementation
782f5654ac
C-4: MCP endpoint requires verified bearer token. Unauthenticated
requests rejected. _extract_principal() replaced by verified
AuthResult from middleware.
C-8: All delegation endpoints require verified bearer token.
X-Delegator-DID header removed — identity from token only.
delegator_ac_id validated to belong to authenticated principal.
Only delegators can revoke. Only delegator/delegate can view.
H-6: SQLite file permissions restricted to 0o600 (owner-only).
Umask set before creation. WAL/SHM files also restricted.
H-7: Delegation depth tracked and enforced against max_delegation_depth.
Sub-delegations increment depth. Exceeded depth → 403.
Shared TokenAuthenticator auto-detects identity driver from JWT
issuer claim (Keycloak or Entra). verify_bearer FastAPI dependency
for all protected endpoints. Health endpoint remains public.
ALL 10 critical findings CLOSED. ALL 10 high findings CLOSED.
Signed-off-by: Tyler King <tking@guildhouse.dev>
|
||
|---|---|---|
| ansible_collection/guildhouse/bastion | ||
| gsap_broker | ||
| tests | ||
| .gitignore | ||
| Dockerfile | ||
| INTUNE.md | ||
| pyproject.toml | ||
| README.md | ||
| requirements.txt | ||
| ROADMAP.md | ||
| uv.lock | ||
fastapi-gsap
Lightweight FastAPI reference implementation of the GSAP broker (GCAP-SPEC-SHELLBOUND-BROKER-0001)