Skip to content

Isolate tunnel publisher credentials on the runtime origin - #77

Draft
barfle wants to merge 2 commits into
codex/gateway-client-authfrom
codex/gateway-runtime-publisher
Draft

barfle wants to merge 2 commits into
codex/gateway-client-authfrom
codex/gateway-runtime-publisher

Conversation

@barfle

@barfle barfle commented Nov 5, 2026

Copy link
Copy Markdown
Contributor

Keep named-tunnel publisher credentials on the runtime origin while interactive CLI requests retain Gateway and their user-session lifecycle. Recognise known production/staging HTTPS aliases and standard ports; explicit custom authorities remain configured. Explicit Authorization overrides are case-insensitive and never borrow, refresh or erase the saved human session. Credential requests and refreshes reject redirects.

Validation:full210-test CLI suite passed, including publisher/user separation, rejected machine credentials, lowercase header overrides, custom authorities and redirect recovery.

Stacked on#76 to preserve its independent review. DRAFT / rollout dependency: hold merge and CLI release until dataplicity-prelude#3513 supplies runtime ingress and the combined staging backend/router passes real published Prelude and supported legacy-agent qualification. No release tag or production rollout is dispatched.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant