fix(server): single source of truth for RPC authorization scopes

[patroza]

Summary

• Runtime WS auth was reading a second scope table (RPC_REQUIRED_SCOPE Map in ws.ts) while the typed single source of truth lives in auth/RpcAuthorization.ts (RPC_REQUIRED_SCOPES / requiredScopeForRpcMethod).
• Identity RPCs (identity.getSessionClaim, etc.) were registered only in the typed table, so clients failed with: Could not load identity — RPC method identity.getSessionClaim has no declared authorization scope.
• The Map also drifted elsewhere (e.g. cloudGetRelayClientStatus was AuthRelayWriteScope in the Map vs AuthRelayReadScope in the typed table).
• Fix: delete the Map; route all observeRpc* authorization through requiredScopeForRpcMethod. Add a test that every WsRpcGroup method resolves via that helper.

Why this was easy to re-break

Identity overlay already imported requiredScopeForRpcMethod but never used it — the runtime path stayed on the stale Map.

Deploy note

After merge into fork/changes, Compose should auto-rebase fork/identity (which already has identity scopes in RPC_REQUIRED_SCOPES). Once integration picks up the rebased tip, the identity claim UI error goes away.

Test plan

• vp test run apps/server/src/auth/RpcAuthorization.test.ts
• vp check
• full monorepo typecheck
• After merge + compose + deploy: open web client → identity claim loads without the authorization-scope error
• Spot-check relay status still works with read scope (no install requirement for status alone)

---

opened by Patrick Roza in chat thread Discord · 🔀 Add Thread Source Attribution Filters · T3

[patroza]

Summary

• Runtime WS auth was reading a second scope table (RPC_REQUIRED_SCOPE Map in ws.ts) while the typed single source of truth lives in auth/RpcAuthorization.ts (RPC_REQUIRED_SCOPES / requiredScopeForRpcMethod).
• Identity RPCs (identity.getSessionClaim, etc.) were registered only in the typed table, so clients failed with: Could not load identity — RPC method identity.getSessionClaim has no declared authorization scope.
• The Map also drifted elsewhere (e.g. cloudGetRelayClientStatus was AuthRelayWriteScope in the Map vs AuthRelayReadScope in the typed table).
• Fix: delete the Map; route all observeRpc* authorization through requiredScopeForRpcMethod. Add a test that every WsRpcGroup method resolves via that helper.

Why this was easy to re-break

Identity overlay already imported requiredScopeForRpcMethod but never used it — the runtime path stayed on the stale Map.

Deploy note

After merge into fork/changes, Compose should auto-rebase fork/identity (which already has identity scopes in RPC_REQUIRED_SCOPES). Once integration picks up the rebased tip, the identity claim UI error goes away.

Test plan

• vp test run apps/server/src/auth/RpcAuthorization.test.ts
• vp check
• full monorepo typecheck
• After merge + compose + deploy: open web client → identity claim loads without the authorization-scope error
• Spot-check relay status still works with read scope (no install requirement for status alone)

---

opened by Patrick Roza in chat thread Discord · 🔀 Add Thread Source Attribution Filters · T3

[patroza]

Summary

• Runtime WS auth was reading a second scope table (RPC_REQUIRED_SCOPE Map in ws.ts) while the typed single source of truth lives in auth/RpcAuthorization.ts (RPC_REQUIRED_SCOPES / requiredScopeForRpcMethod).
• Identity RPCs (identity.getSessionClaim, etc.) were registered only in the typed table, so clients failed with: Could not load identity — RPC method identity.getSessionClaim has no declared authorization scope.
• The Map also drifted elsewhere (e.g. cloudGetRelayClientStatus was AuthRelayWriteScope in the Map vs AuthRelayReadScope in the typed table).
• Fix: delete the Map; route all observeRpc* authorization through requiredScopeForRpcMethod. Add a test that every WsRpcGroup method resolves via that helper.

Why this was easy to re-break

Identity overlay already imported requiredScopeForRpcMethod but never used it — the runtime path stayed on the stale Map.

Deploy note

After merge into fork/changes, Compose should auto-rebase fork/identity (which already has identity scopes in RPC_REQUIRED_SCOPES). Once integration picks up the rebased tip, the identity claim UI error goes away.

Test plan

• vp test run apps/server/src/auth/RpcAuthorization.test.ts
• vp check
• full monorepo typecheck
• After merge + compose + deploy: open web client → identity claim loads without the authorization-scope error
• Spot-check relay status still works with read scope (no install requirement for status alone)

---

opened by Patrick Roza in chat thread Discord · 🔀 Add Thread Source Attribution Filters · T3

[patroza]

Summary

• Runtime WS auth was reading a second scope table (RPC_REQUIRED_SCOPE Map in ws.ts) while the typed single source of truth lives in auth/RpcAuthorization.ts (RPC_REQUIRED_SCOPES / requiredScopeForRpcMethod).
• Identity RPCs (identity.getSessionClaim, etc.) were registered only in the typed table, so clients failed with: Could not load identity — RPC method identity.getSessionClaim has no declared authorization scope.
• The Map also drifted elsewhere (e.g. cloudGetRelayClientStatus was AuthRelayWriteScope in the Map vs AuthRelayReadScope in the typed table).
• Fix: delete the Map; route all observeRpc* authorization through requiredScopeForRpcMethod. Add a test that every WsRpcGroup method resolves via that helper.

Why this was easy to re-break

Identity overlay already imported requiredScopeForRpcMethod but never used it — the runtime path stayed on the stale Map.

Deploy note

After merge into fork/changes, Compose should auto-rebase fork/identity (which already has identity scopes in RPC_REQUIRED_SCOPES). Once integration picks up the rebased tip, the identity claim UI error goes away.

Test plan

• vp test run apps/server/src/auth/RpcAuthorization.test.ts
• vp check
• full monorepo typecheck
• After merge + compose + deploy: open web client → identity claim loads without the authorization-scope error
• Spot-check relay status still works with read scope (no install requirement for status alone)

---

opened by Patrick Roza in chat thread Discord · 🔀 Add Thread Source Attribution Filters · T3

[patroza]

Summary

• Runtime WS auth was reading a second scope table (RPC_REQUIRED_SCOPE Map in ws.ts) while the typed single source of truth lives in auth/RpcAuthorization.ts (RPC_REQUIRED_SCOPES / requiredScopeForRpcMethod).
• Identity RPCs (identity.getSessionClaim, etc.) were registered only in the typed table, so clients failed with: Could not load identity — RPC method identity.getSessionClaim has no declared authorization scope.
• The Map also drifted elsewhere (e.g. cloudGetRelayClientStatus was AuthRelayWriteScope in the Map vs AuthRelayReadScope in the typed table).
• Fix: delete the Map; route all observeRpc* authorization through requiredScopeForRpcMethod. Add a test that every WsRpcGroup method resolves via that helper.

Why this was easy to re-break

Identity overlay already imported requiredScopeForRpcMethod but never used it — the runtime path stayed on the stale Map.

Deploy note

After merge into fork/changes, Compose should auto-rebase fork/identity (which already has identity scopes in RPC_REQUIRED_SCOPES). Once integration picks up the rebased tip, the identity claim UI error goes away.

Test plan

• vp test run apps/server/src/auth/RpcAuthorization.test.ts
• vp check
• full monorepo typecheck
• After merge + compose + deploy: open web client → identity claim loads without the authorization-scope error
• Spot-check relay status still works with read scope (no install requirement for status alone)

---

opened by Patrick Roza in chat thread Discord · 🔀 Add Thread Source Attribution Filters · T3

[patroza]

Summary

• Runtime WS auth was reading a second scope table (RPC_REQUIRED_SCOPE Map in ws.ts) while the typed single source of truth lives in auth/RpcAuthorization.ts (RPC_REQUIRED_SCOPES / requiredScopeForRpcMethod).
• Identity RPCs (identity.getSessionClaim, etc.) were registered only in the typed table, so clients failed with: Could not load identity — RPC method identity.getSessionClaim has no declared authorization scope.
• The Map also drifted elsewhere (e.g. cloudGetRelayClientStatus was AuthRelayWriteScope in the Map vs AuthRelayReadScope in the typed table).
• Fix: delete the Map; route all observeRpc* authorization through requiredScopeForRpcMethod. Add a test that every WsRpcGroup method resolves via that helper.

Why this was easy to re-break

Identity overlay already imported requiredScopeForRpcMethod but never used it — the runtime path stayed on the stale Map.

Deploy note

After merge into fork/changes, Compose should auto-rebase fork/identity (which already has identity scopes in RPC_REQUIRED_SCOPES). Once integration picks up the rebased tip, the identity claim UI error goes away.

Test plan

• vp test run apps/server/src/auth/RpcAuthorization.test.ts
• vp check
• full monorepo typecheck
• After merge + compose + deploy: open web client → identity claim loads without the authorization-scope error
• Spot-check relay status still works with read scope (no install requirement for status alone)

---

opened by Patrick Roza in chat thread Discord · 🔀 Add Thread Source Attribution Filters · T3

[patroza]

Summary

• Runtime WS auth was reading a second scope table (RPC_REQUIRED_SCOPE Map in ws.ts) while the typed single source of truth lives in auth/RpcAuthorization.ts (RPC_REQUIRED_SCOPES / requiredScopeForRpcMethod).
• Identity RPCs (identity.getSessionClaim, etc.) were registered only in the typed table, so clients failed with: Could not load identity — RPC method identity.getSessionClaim has no declared authorization scope.
• The Map also drifted elsewhere (e.g. cloudGetRelayClientStatus was AuthRelayWriteScope in the Map vs AuthRelayReadScope in the typed table).
• Fix: delete the Map; route all observeRpc* authorization through requiredScopeForRpcMethod. Add a test that every WsRpcGroup method resolves via that helper.

Why this was easy to re-break

Identity overlay already imported requiredScopeForRpcMethod but never used it — the runtime path stayed on the stale Map.

Deploy note

After merge into fork/changes, Compose should auto-rebase fork/identity (which already has identity scopes in RPC_REQUIRED_SCOPES). Once integration picks up the rebased tip, the identity claim UI error goes away.

Test plan

• vp test run apps/server/src/auth/RpcAuthorization.test.ts
• vp check
• full monorepo typecheck
• After merge + compose + deploy: open web client → identity claim loads without the authorization-scope error
• Spot-check relay status still works with read scope (no install requirement for status alone)

---

opened by Patrick Roza in chat thread Discord · 🔀 Add Thread Source Attribution Filters · T3

[patroza]

Summary

• Runtime WS auth was reading a second scope table (RPC_REQUIRED_SCOPE Map in ws.ts) while the typed single source of truth lives in auth/RpcAuthorization.ts (RPC_REQUIRED_SCOPES / requiredScopeForRpcMethod).
• Identity RPCs (identity.getSessionClaim, etc.) were registered only in the typed table, so clients failed with: Could not load identity — RPC method identity.getSessionClaim has no declared authorization scope.
• The Map also drifted elsewhere (e.g. cloudGetRelayClientStatus was AuthRelayWriteScope in the Map vs AuthRelayReadScope in the typed table).
• Fix: delete the Map; route all observeRpc* authorization through requiredScopeForRpcMethod. Add a test that every WsRpcGroup method resolves via that helper.

Why this was easy to re-break

Identity overlay already imported requiredScopeForRpcMethod but never used it — the runtime path stayed on the stale Map.

Deploy note

After merge into fork/changes, Compose should auto-rebase fork/identity (which already has identity scopes in RPC_REQUIRED_SCOPES). Once integration picks up the rebased tip, the identity claim UI error goes away.

Test plan

• vp test run apps/server/src/auth/RpcAuthorization.test.ts
• vp check
• full monorepo typecheck
• After merge + compose + deploy: open web client → identity claim loads without the authorization-scope error
• Spot-check relay status still works with read scope (no install requirement for status alone)

---

opened by Patrick Roza in chat thread Discord · 🔀 Add Thread Source Attribution Filters · T3