Authentication & authorization across every Candybox channel (SASL + TLS + per-Box/object ACLs + S3 SigV4) - #20

Merged

predatorray merged 9 commits into

mainfrom

claude/candybox-component-auth-vhd425

Jun 13, 2026

Commits on Jun 12, 2026

Add AUTH_PLAN.md: locked design for auth&authz across all channels
claude
committed
Phase A: SASL authentication + in-process TLS on the TCP protocol
claude
committed
Phase B1: Authorizer SPI + per-Box ACLs enforced on every node request
claude
committed
Phase B2: object owner + ACL grants in the CandyLocator (format v3)
claude
committed
Phase C: BookKeeper client passthrough + ZooKeeper auth/znode ACLs + security ops docs
claude
committed
Phase D: SigV4 authentication + S3 ACL semantics on the gateway
claude
committed
Phase E: admin API bearer auth + HTTPS, token-guarded metrics, dashboard login
claude
committed

Commits on Jun 13, 2026