56510de55e
Why: standardize session login/refresh/logout/me behavior for web clients behind thalos security boundaries. What: add canonical routes, cookie policy handling, grpc session calls, compatibility aliases, standardized auth errors, updated contracts, tests, and docs. Rule: keep BFF as edge adapter over service contracts and preserve identity ownership in thalos.
16 lines
604 B
Markdown
16 lines
604 B
Markdown
# Permission Enforcement Map
|
|
|
|
## Enforcement Points
|
|
|
|
- `identity.token.issue` evaluated via thalos-service policy contract before token issuance.
|
|
- Session refresh guarded by edge session validation policy.
|
|
|
|
## Guardrail
|
|
|
|
- Permission checks happen at BFF entrypoints using thalos-service policy responses.
|
|
- Authorization decisions are explicit and traceable at edge boundaries.
|
|
- Auth failure payload shape is standardized as `{ code, message, correlationId }`.
|
|
- HTTP semantics:
|
|
- `401`: no valid session or failed session issuance/refresh.
|
|
- `403`: authenticated but denied by permission policy.
|