Allow pre-hook for restrictions on capability calls and secrets#411
Conversation
* Added Pharos Atlantic support * Auto-fix: buf format, gofmt, go generate, go mod tidy --------- Co-authored-by: app-token-issuer-engops[bot] <144731339+app-token-issuer-engops[bot]@users.noreply.github.com>
* aptos proto: add ledger_version to ViewRequest * Auto-fix: buf format, gofmt, go generate, go mod tidy --------- Co-authored-by: app-token-issuer-engops[bot] <144731339+app-token-issuer-engops[bot]@users.noreply.github.com>
…tnet support (#308) * Added xlayer megaeth cronos mantle tac unichain scroll sonic support * Auto-fix: buf format, gofmt, go generate, go mod tidy * Added celo sepolia * Auto-fix: buf format, gofmt, go generate, go mod tidy * Added gnosis chiado * Auto-fix: buf format, gofmt, go generate, go mod tidy * Removed celo sepolia * Auto-fix: buf format, gofmt, go generate, go mod tidy * Removed gnosis chiado * Auto-fix: buf format, gofmt, go generate, go mod tidy --------- Co-authored-by: app-token-issuer-engops[bot] <144731339+app-token-issuer-engops[bot]@users.noreply.github.com>
* Added andesite chain * Auto-fix: buf format, gofmt, go generate, go mod tidy --------- Co-authored-by: app-token-issuer-engops[bot] <144731339+app-token-issuer-engops[bot]@users.noreply.github.com>
* Added new mainnet chains to client proto * Auto-fix: buf format, gofmt, go generate, go mod tidy --------- Co-authored-by: app-token-issuer-engops[bot] <144731339+app-token-issuer-engops[bot]@users.noreply.github.com>
* remove aptos * Auto-fix: buf format, gofmt, go generate, go mod tidy --------- Co-authored-by: app-token-issuer-engops[bot] <144731339+app-token-issuer-engops[bot]@users.noreply.github.com>
Adds workflow-level context to the app-specific proto rather than the generic ComputeRequest type, per vreff's feedback on CC PR #277. The enclave app reads these from the deserialized WorkflowExecution for runtime secret fetching from VaultDON via the relay DON.
* Added hyperliquid mainnet to client proto * Auto-fix: buf format, gofmt, go generate, go mod tidy --------- Co-authored-by: app-token-issuer-engops[bot] <144731339+app-token-issuer-engops[bot]@users.noreply.github.com>
* Added gnosis chiado to client proto * Auto-fix: buf format, gofmt, go generate, go mod tidy --------- Co-authored-by: app-token-issuer-engops[bot] <144731339+app-token-issuer-engops[bot]@users.noreply.github.com>
* add WorkflowUserMetric * fix metric suffix * bot: regenerate protobuf files * add USER_METRIC_TYPE_UNSPECIFIED * bot: regenerate protobuf files * update WorkflowUserMetric value to double * drop histogram support * bot: regenerate protobuf files --------- Co-authored-by: app-token-issuer-engops[bot] <144731339+app-token-issuer-engops[bot]@users.noreply.github.com>
* Add capability-development branch protection ci * Upgraded checkout action to major version tag * Updated validation to only occur when target branch is main * Addressed feedback
* beholder: publish workflows/v2/workflow_user_metric.proto * remove entry from deprecated files
…gger, subscriptions need to be outside the TEE
… that would stream results
|
product-security-plaid-production
Bot
requested review from
Krish-vemula and
vyzaldysanchez
|
The latest Buf updates on your PR. Results from workflow Regenerate Protobuf Files / buf (pull_request).
|
| } | ||
|
|
||
| message SecretPrefixRestriction { | ||
| string prefix = 1; |
There was a problem hiding this comment.
Are there any use cases where prefix is a better restriction than namespace? The Vault lets you define as many namespaces as you want so it might simplify things if we only restrict on namespace
There was a problem hiding this comment.
The prefix has namespace in it. If you want to allow the whole namespace you can use the empty prefix.
IIUC, namespaces can restrict which workflows/owners can access a secret (or at least can in future). This is more locked down, as it's per execution. Essentially, the vault can say "Don't let the workflow/owner access anything outside these namespace" and the execution can then say "for this run, only these secrets.
Depending on how people group namespaces, they could make a lot of them and achieve the same but it might be harder to track.
Eg: Namespace 1 is for workflows 1, 2, and 3. Within that, when running a workflow triggered by user X, I can only get keys for user X (prefixed with USER_X_) or groups they belong to (GROUP_Y_ prefix).
nolag
force-pushed
the
rtinianov_teeAndRestrictions
branch
from
e4cc86d to
e31af15
Compare
nolag
force-pushed
the
rtinianov_teeAndRestrictions
branch
from
7f2423c to
0d91d7e
Compare
10 participants
No description provided.