tailcfg/peercap, types/appctype: prepare for conn25 grants - #20852
Open
sailorfrag wants to merge 1 commit into
Open
tailcfg/peercap, types/appctype: prepare for conn25 grants#20852sailorfrag wants to merge 1 commit into
sailorfrag wants to merge 1 commit into
Conversation
This change contains the protocol changes needed to support describing authorization for conn25 apps. As a temporary transition measure during development, app configurations can disable authorization enforcement. Updates tailscale/corp#40076 Change-Id: I3183c10374aacb0048f6632c384f71f758c20f2f Signed-off-by: Adrian Dewhurst <adrian@tailscale.com>
creachadair
approved these changes
Aug 14, 2026
| // ToAttribute returns the full [Cap] key for the given value under this prefix, | ||
| // of the form prefix+value. | ||
| func (p Prefix) ToAttribute(value string) Cap { | ||
| return Cap(string(p) + value) |
Member
There was a problem hiding this comment.
Is it worthwhile to panic if value == ""?
Member
Author
There was a problem hiding this comment.
Maybe, I'd like to keep this consistent with the nodecap equivalent and it doesn't do that, so that feels like a separate cleanup?
| // BypassFilter indicates that the connector should not look for peer | ||
| // capabilities when determining authorization to use an app. This is a | ||
| // temporary measure during development and will be removed without warning. | ||
| BypassFilter bool `json:"bypassFilter,omitzero"` |
Member
There was a problem hiding this comment.
Perhaps we should give it a less "attractive" name, e.g., ExperimentalBypassFilter or UnsafeBypassFilter or something?
Member
Author
There was a problem hiding this comment.
Yeah this has been in the back of my mind. I can do that easily enough, but I also plan to have this deleted in under a month.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This change contains the protocol changes needed to support describing authorization for conn25 apps. As a temporary transition measure during development, app configurations can disable authorization enforcement.
Updates tailscale/corp#40076
Change-Id: I3183c10374aacb0048f6632c384f71f758c20f2f