mirror of
https://github.com/trustgraph-ai/trustgraph.git
synced 2026-06-25 22:58:06 +02:00
16f8cfd972
The mux was extracting the authorisation resource workspace from the inner request body via registry extractors. But workspace-scoped services (config, flow, librarian, etc.) receive workspace from the queue identity, not the message body — the inner workspace field is a dead field that no service handler reads. This caused access-denied errors when the inner body's workspace (e.g. CLI default "default") disagreed with the caller's assigned workspace, even though the envelope workspace was correct. Fix: resolve workspace from the envelope only. Split the non-flow authorisation path by resource level — WORKSPACE ops use the envelope workspace directly; SYSTEM ops (IAM) still use registry extractors since they legitimately read operation-specific body fields. |
||
|---|---|---|
| .. | ||
| trustgraph | ||
| pyproject.toml | ||
| README.md | ||