statecraft.
Catalog/rahi

038-native-clients-and-bearer-revocation

Native clients and bearer revocation: the CSRF exemption wired, a public client for a CLI declared in the manifest, token lifetimes set, and a token that can be revoked

Lifecycle approvedImplementation completeVerification unknownQualification unknown

A hosted control plane built as a cell and a command-line client that logs in to it need four things the chassis does not yet give. The CSRF layer exempts only /auth/*, so a POST with a bearer token is refused 403 csrf (025 B-11 promised the exemption; D-6 left the wiring). No public client exists: the one client first boot creates is confidential, and a rauthy client defaults to EdDSA with no audience binding, so no CLI token passes the resource server without an admin's hand. Token lifetime is rauthy's default, 1800 seconds, not the fifteen minutes 025 B-5 states. And nothing writes the jti deny-list, so a bearer token cannot be revoked before it expires. This spec wires the exemption, declares native clients in the manifest and provisions them at boot bound to RS256 and the cell's audience, sets lifetimes explicitly, adds revocation by token and by subject, reports the bound in preflight, and gives hello-cell a scope-gated bearer route and a device-code login in its end-to-end test.

Read the full pinned specification ↗

Relationships

Claimed units

  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-idp/src/native.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-idp/src/revoke.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-idp/tests/native.rs"
}
  • extends
    {
  "nature": "additive",
  "spec": "020-edge-server",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-edge/src/middleware/csrf.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "020-edge-server",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-edge/src/router.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "020-edge-server",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-edge/src/lib.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "020-edge-server",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-edge/tests/middleware.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "025-api-tokens-and-resource-server",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-idp/src/bearer.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "025-api-tokens-and-resource-server",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-idp/tests/bearer.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "021-idp-proxy-and-discovery",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-idp/src/lib.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "021-idp-proxy-and-discovery",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-idp/src/bootstrap.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "015-kernel-manifest-and-adjudication",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-kernel/src/manifest.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "015-kernel-manifest-and-adjudication",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-kernel/src/lib.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "015-kernel-manifest-and-adjudication",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-kernel/tests/manifest.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "030-operational-verbs",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-cli/src/serve.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "030-operational-verbs",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-cli/src/cell.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "030-operational-verbs",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-cli/src/lib.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "031-single-container-packaging",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-ops/src/rauthy_env.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "033-dev-substrate-and-harness",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-harness/src/rauthy.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "033-dev-substrate-and-harness",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-harness/src/lib.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "034-hello-cell",
  "unit": {
    "kind": "file",
    "path": "apps/hello-cell/src/cell.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "030-operational-verbs",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-ops/src/preflight.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "031-single-container-packaging",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-ops/src/supervise.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "034-hello-cell",
  "unit": {
    "kind": "file",
    "path": "apps/hello-cell/manifest.toml"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "034-hello-cell",
  "unit": {
    "kind": "file",
    "path": "apps/hello-cell/src/notes.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "034-hello-cell",
  "unit": {
    "kind": "file",
    "path": "apps/hello-cell/tests/e2e.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "034-hello-cell",
  "unit": {
    "kind": "file",
    "path": "apps/hello-cell/README.md"
  }
}

Source headings

  1. 038: Native clients and bearer revocation
  2. 1. Purpose
  3. 2. Territory
  4. 3. Behavior
  5. 4. Functional requirements
  6. 5. Acceptance criteria
  7. 6. Out of scope
  8. 7. Resolved decisions
  9. Evidence and proposals (2026-09-12)
  10. Verification

Frozen anchors

No frozen anchors declared.