nuts-foundation / nuts-foundation/nuts-node
Revisit `passthrough` scope policy mode gating
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 28
- Forks
- 23
- Avg merge
- 1d 10h
- Merged PRs (30d)
- 76
Description
Flagged in review of #4176 by @reinkrul: passthrough grants all requested scopes without evaluation, which is unsafe when enabled.
Position: the mode is explicitly opted in by a policy writer (not just a node-operator flag), and it has value for PoCs and environments where scope authorization is handled elsewhere. The default remains profile-only. So removing passthrough outright isn't the right move.
Proposal to discuss: gate passthrough behind strictmode — startup fails when strictmode=true and any credential profile uses scope_policy: passthrough. Parallel to the existing dynamic + no AuthZen endpoint startup check.
Revisit once dynamic is production-proven: should passthrough be removed, permanently gated, or left as-is?
Related:
- PRD: #4144
- Review comment: https://github.com/nuts-foundation/nuts-node/pull/4176#discussion_r3102580977
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the review discussion on PR #4176 and the PRD in #4144, then inspect the existing startup check for dynamic mode without an AuthZen endpoint. Determine whether passthrough should be removed, gated, or retained, and document the chosen policy and its startup behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- authorization, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100