* fix: credit the token owner instead of the token label in the audit trail
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: address review findings on token-owner audit attribution
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: carry token-label provenance explicitly instead of inferring it
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore: point ee-repo-ref at the companion branch
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: trust only non-forgeable token labels to name the acting entity
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: reject reserved system-token labels at token creation
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: narrow the token-label guard to server-minted namespaces
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: add the provenance field to the remaining ApiAuthed literals
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: stop trusting the email- label, which no mint produces
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(postgres-triggers): enforce resource-path scopes on slot/publication routes
The Postgres trigger ancillary routes (slot management, publication
management, version/logical-level checks, template script creation) relied
only on the route-level middleware, which validates the scope domain+action
but delegates resource-path enforcement to each handler. These handlers made
no check_scopes call, so a token scoped to one postgres resource path (e.g.
postgres_triggers:write:u/alice/*) could drive these endpoints against any
postgres resource in the workspace, including the destructive drop_slot_name
(pg_terminate_backend + pg_drop_replication_slot).
Add a check_scopes call at the top of each affected handler, before any
connection is opened, mirroring the generic trigger CRUD handlers. Read
endpoints require postgres_triggers:read:{path}; write endpoints require
postgres_triggers:write:{path}.
Fixes WIN-2213
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* docs: condense postgres_trigger_scope test module comment
Address Codex nit: state the durable constraint (mismatched scope must fail
before DB access) instead of narrating pre-fix behavior and change history.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Ruben Fiszel