Repository navigation
feat(auth): non-JWT admin/bootstrap API key for direct operator access #240
Description
Activity
🔗 Related PRs
#172 - feat(rbac)!: fail-closed authorization + default_role public access [merged]
📝 Issue Planner
Check the box below or use the
@coderabbitai plancommand to generate an implementation plan and prompts that you can use with your favorite coding assistant.- Create Plan
🧪 Issue enrichment is currently in open beta.
You can configure auto-planning by selecting labels in the issue_enrichment configuration.
To disable automatic issue enrichment, add the following to your
.coderabbit.yaml:issue_enrichment: auto_enrich: enabled: false
💬 Have feedback or questions? Drop into our discord!
- added a commit that references this issue
on Jul 7, 2026
Area: auth · ops — gap (operability) · from Eric's notes
Expected: the devops person running WaveHouse has a simple, role-free credential (an admin API key) for bootstrapping and direct admin access — setting policies, schema ops, DLQ — without minting a JWT.
Actual: all elevated access goes through a JWT whose role claim matches
admin_role. There's no static admin key / bootstrap credential, so even initial setup and break-glass operator access require the JWT plumbing.Scope: a configured admin API key (header/bearer) that grants admin without a role claim, for bootstrap + operator/break-glass use. This is effectively an admin secret — pairs with the key→role-binding and revocation thinking in #228.
Related: auth-hardening epic #228; policy bootstrap seed-vs-SoT #229.
From Eric's notes scratchpad; triaged 2026-06-04.