Access: one rule list for people and machines, and "can X reach Y" (D209, D210) #147

New issue

Open

opened 2026-10-09 16:46:46 +00:00 by kayg · 0 comments

kayg commented

2026-10-09 16:46:46 +00:00

Owner

D209/D210 backend for Settings → Access:

One read model over people grants (D154: who × role × hosts) and Mesh reach rules (D164 arrows), exposed as declared plugin actions (D16) so UI, CLI and MCP share it.
Filter by entity chips (user, group, tag, host): rows involving all of them.
explain(a, b): allowed or not, the rule(s) that allow it, the role for people, and the live state for machines (direct/relay + RTT, rule not yet received by the peer, peer offline since). Bounded, fast (target < 5 ms at 1,000 rules), and permission-checked: an answer never reveals rules or machines the asker cannot see.
Rule writes from the table and the Map go through the same action with the fresh-passkey check (D28, R10).
Starts on the integrated Mesh code once #108 merges.

D209/D210 backend for Settings → Access: - One read model over people grants (D154: who × role × hosts) and Mesh reach rules (D164 arrows), exposed as declared plugin actions (D16) so UI, CLI and MCP share it. - Filter by entity chips (user, group, tag, host): rows involving all of them. - `explain(a, b)`: allowed or not, the rule(s) that allow it, the role for people, and the live state for machines (direct/relay + RTT, rule not yet received by the peer, peer offline since). Bounded, fast (target < 5 ms at 1,000 rules), and permission-checked: an answer never reveals rules or machines the asker cannot see. - Rule writes from the table and the Map go through the same action with the fresh-passkey check (D28, R10). Starts on the integrated Mesh code once #108 merges.

kayg referenced this issue

2026-10-12 10:49:13 +00:00

Access rules: one sentence model (who can verb where), verified until foolproof across CLI, API, MCP, apps, WebMCP #186

kayg referenced this issue

2026-10-12 10:49:33 +00:00

Access rules: one sentence model (who can verb where), verified until foolproof across CLI, API, MCP, apps, WebMCP #186

kayg referenced this issue

2026-10-12 12:10:05 +00:00

Access rules: one sentence model (who can verb where), verified until foolproof across CLI, API, MCP, apps, WebMCP #186

kayg referenced this issue

2026-10-12 13:10:50 +00:00

Access rules: one sentence model (who can verb where), verified until foolproof across CLI, API, MCP, apps, WebMCP #186