Repository navigation
docs: audit & fill the consumer-facing Security & Auth Model #231
Description
Activity
🔗 Related PRs
#123 - fix(api): drop CORS credentials + skip same-origin decoration [merged]
#172 - feat(rbac)!: fail-closed authorization + default_role public access [merged]
#187 - docs: prep docs for publishing [merged]
📝 Issue Planner
Check the box below or use the
@coderabbitai plancommand to generate an implementation plan and prompts that you can use with your favorite coding assistant.- Create Plan
🧪 Issue enrichment is currently in open beta.
You can configure auto-planning by selecting labels in the issue_enrichment configuration.
To disable automatic issue enrichment, add the following to your
.coderabbit.yaml:issue_enrichment: auto_enrich: enabled: false
💬 Have feedback or questions? Drop into our discord!
Area: docs — discoverability (DX) · found via WaveHouse-Stats dogfooding
Expected: build a correct auth/ingest integration from the docs alone.
Actual:
access-control.mdis already strong on the authorization model (fail-closed, roles, default_role/admin_role, eval flow), but several load-bearing behaviors are still source-only — each shaped the Stats integration and required a code dive:expis not required (never-expiring tokens validate).Impact (Stats): fine for us (we read the code); a real barrier for external adopters.
Scope: audit
access-control.md/api.md#authentication/configuration.mdand fill the gaps above — verifier modes + alg pinning, theexp/revocation stance, policy evaluation order, and the dedupe contract. (PR #193's docs pass doesn't touch these pages.)Related: the auth-hardening epic #228, policy seed-vs-SoT #229, and async-ingest #230 are the behaviors to document.
From
WAVEHOUSE-FEEDBACK.md(WaveHouse-Stats dogfooding); validated by code-read against0f8826con 2026-06-04.