Repository navigation
Check a send grant on every outbound mail - #259
Merged
alexanderguy merged 15 commits intoNov 7, 2026
Merged
Conversation
The capability walk emitted mail.send:<domain> for each mail trigger, but no runtime code read it, and its name claimed a send authority that the hub never checked.
A deny whose action or namespace-wide pattern was spelled more broadly than an allow of the same coordinate ranked below it, so the deny refused nothing. Every grant here already matches the grammar's one action, so its spelling says nothing about what the grant covers.
The probe gate refuses a requirement in any reserved namespace with the reason reserved_namespace_grant_requirements, in place of mail_accept_grant_requirements, and names each namespace in the refusal text, so one reason covers every namespace the table reserves.
The correspondent minter named a recipient through its signing key and fell back to an exact address match, so the same recipient could resolve or not by key state and address spelling. The minter and the sender key resolver now read one resolver that ignores both.
Member
Author
Self-Review (
|
alexanderguy
deleted the
intr-710-check-a-send-grant-on-every-outbound-mail
branch
November 7, 2026 20:10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
mail.sendgrants for each recipient before it routes, holds or relays mail from a sidecar, before it stores the sidecar's audit copy, and before the REST run-mail routes start a run. A refused relay recipient is dropped and logged; a refused REST mail gets403 mail_send_denied. A recipient hasprincipal,asset,tenantanddomaincoordinates, and any matching deny narrows a broader allow.mail.send:*:*at its first trigger, and the owner and admin system roles getmail.send:tenant:<tenant id>. Migration0124_mail_send_backfillgives the same rows to existing deployments and to holders ofworkflow-runmanage. Stop the old hub before the migration runs.mail.sendgrant that can never decide a send, and a workflow grant requirement cannot use the reservedmail.sendnamespace. Coordinate grants rank by their coordinate pattern alone, so a deny with action*now also overrides amail.acceptallow at the same coordinate.Verification
make allexits 0 on the branch tip.make build,make lintandmake testpass on each of the 15 commits.Closes INTR-710