Conversation
dq now checks the access tokens dauth's /exchange mints for the delegation model (did-directory plan §6 step 7, spec §11.4). No backwards compatibility (spec §19 decision 17). DQClaim embeds the new tokenclaims.Token and is validated on the way in; the audience is TOKEN_AUDIENCE, default dq. Every authenticated HTTP request must carry a DPoP proof for its method and URL with ath over the token, signed by the key cnf.jkt names (PUBLIC_BASE_URL gives the htu origin behind a proxy). @requiresVehicleToken finds the grants for the query's subject and, on a field with from/to, clamps the range to the union of the subject's windows: nothing covered is refused, and a range that straddles a gap is refused naming the covered pieces so the caller splits the query (the spec asks for merged segments; v1 refuses rather than interpolates). The privilege directives check each required ability for the subject in scope over the range in scope, or at the current time when there is no range. The Privilege enum keeps model-garage's names and maps to abilities; VEHICLE_CURRENT_LOCATION, VEHICLE_COMMANDS and VEHICLE_VIN_CREDENTIAL leave the enum because gqlgen forbids two values sharing one string. Cloud-event reads take raw:read with after/before clamped the same way. The gRPC fetch port keeps bearer validation, takes raw:read over each requested subject and clamps its bounds; it does not check DPoP, with the NetworkPolicy as the compensating control. Deleted: the identity-api device-to-vehicle link and IDENTITY_API_URL; the requested subject must be a grant subject. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011mDMpJffFJ4BmUyZPtb6j2
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011mDMpJffFJ4BmUyZPtb6j2
Writes dimo.status events carrying a speed signal into lake.raw_events in din's shape and decodes them once, so dq boots over a catalog that already has signals. did-directory's scripts/demo.sh uses it. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
- @requiresVehicleToken puts the subject's windows in the request context (internal/coverage) and refuses a token with no data window for the subject; a commands-only token reads no data. - The privilege directives clamp a field's own range before checking it, so on events, segments and dailyActivity (where gqlgen runs them before the vehicle check) a wide range is clamped rather than refused. - signalsLatest and signalsSnapshot drop readings outside the windows; dataSummary is refused unless the windows cover all time. - segments reports a trip already under way from the window's start and summarises it from there; dailyActivity clips its days to the window; location gap-fill never reads before the window's start. - ListCloudEventsFromIndex checks the fetched events' times against the windows, since the index header is the caller's to write. - Bumps dauth to the commit whose token validation requires exp, cnf.jkt and windows on historical grants. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Step 7 of the did-directory org host plan, dq's share (spec §11.4). No backwards compatibility (spec §19 decision 17).
DQClaimembeds dauth's newtokenclaims.Token(cnf,grants[{subject, abilities, windows?, chain}]), validated on entry. Audience isTOKEN_AUDIENCE(defaultdq).DPoPproof for its method and URL withathover the token, matched tocnf.jkt(PUBLIC_BASE_URLgives thehtuorigin behind a proxy). Token accepted under theDPoPorBearerscheme.@requiresVehicleTokenclampsfrom/toto the union of the subject's windows; nothing covered is refused, and a range straddling a gap is refused with the covered pieces named, so the caller splits it (the spec's merged segments are left for later). Privilege directives then check each ability over the range in scope, or at the current time for latest/snapshot/summary reads. Cloud-eventafter/beforeand the gRPC fetch bounds are clamped the same way.VEHICLE_NON_LOCATION_DATA→telemetry:read,VEHICLE_ALL_TIME_LOCATION→location:precise,VEHICLE_APPROXIMATE_LOCATION→location:approximate,VEHICLE_RAW_DATA→raw:read.VEHICLE_CURRENT_LOCATION,VEHICLE_COMMANDSandVEHICLE_VIN_CREDENTIALleave the enum (unused in the schema; gqlgen forbids two values mapping to one string).IDENTITY_API_URL; the requested subject must be a grant subject. The gRPC fetch port keeps bearer-only validation withraw:read; no DPoP there, the NetworkPolicy stays the compensating control.Pins
dauthat DIMO-Network/dauth#24's commit, whose go.mod requires the private did-directory module, so loading this module graph now needsGOPRIVATE/SSH access to it in CI.🤖 Generated with Claude Code
https://claude.ai/code/session_011mDMpJffFJ4BmUyZPtb6j2