amadan
console: pin the /geo door as deliberate new instance-role access
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+7
−0
internal/console/svcroutes_test.go+7 −0
CI passed — run details
diff --git a/internal/console/svcroutes_test.go b/internal/console/svcroutes_test.go| index b41d8b297..9d464f183 100644 |
| --- a/internal/console/svcroutes_test.go |
| +++ b/internal/console/svcroutes_test.go |
| @@ -387,6 +387,13 @@ var exemptFromLegacyPin = map[string]bool{ |
| "GET /api/cli/apps/{account}/{app}/sidecars/{name}": true, |
| "DELETE /api/cli/apps/{account}/{app}/sidecars/{name}": true, |
| "POST /api/cli/apps/{account}/{app}/sidecars/{name}/wake": true, |
| + // The platform's GeoIP lookup (geoip spec §11.1) is new access on the |
| + // analytics read's footing: it did not exist before service principals, |
| + // and the app itself is the consumer (a batch job or a webhook handler |
| + // placing an address with its CARLOS_INSTANCE_TOKEN). It discloses |
| + // nothing about the account; only what the deployment's database says |
| + // about an address the caller chose. |
| + "GET /api/cli/apps/{account}/{app}/geo": true, |
| } |
| // TestInstanceRoleMatchesTodaysAppTokenReach is the compatibility pin of spec |