Repository navigation
Nothing lets a reader, a regulator or an auditor see what a deployment runs and what it decided #1268
Description
The problem
A deployment decides what a request is permitted, holds the settings that decide how pages are changed, and may keep a record against the identifier it writes to a browser. None of that can be read by the person it concerns without a credential or the operator's word. The administration endpoints that exist answer an operator alone, and they leave the publisher's domain in a later change.
The change
Three read-only addresses, the same on every deployment, answered by one handler in core on all four adapters, with no credential.
| Address | What it shows | Who it answers |
|---|---|---|
/_ts/permissions and /_ts/permissions.json |
The permissions resolved for the request that asks, the signals that produced them and the terms the data is held under | Anyone |
/_ts/config and /_ts/config.json |
The settings the deployment runs, after defaults, with every secret masked as XXXX and every masked path listed |
Anyone |
/_ts/data |
What the deployment holds against the Edge Cookie the request carries, with every identifier masked | A browser opening the address as a page |
The configuration view masks every secret whatever the settings document says, masks the origin URLs, the Basic-auth path and username and the store names unless the publisher shows them, and hides whatever the publisher lists in a new [inspect] section (show, hide, and config = false to answer 404). A pattern that would not be honored as written refuses the settings, so a publisher cannot believe a value hidden that is shown.
The data page is answered only to a browser navigation (Sec-Fetch-Mode: navigate with Sec-Fetch-Dest: document), is sent with Content-Security-Policy: sandbox so a page that opened it cannot read it, shows no identifier, and is never stored. A test lists every field of the stored record, so a field added later fails the test until it is decided whether the field is an identifier. Only the Fastly adapter keeps an identity graph, so the other adapters answer that nothing is held.
Where it is
Draft on the fork, jwrosewell#4, on top of the module context (fork pull request 3).
Activity