Scope principal delegation by destination

Let admins grant principal signing keys destination delegation authority without binding grants to individual agent identities.

Author: sl5-guy

README.md

@@ -119,7 +119,7 @@ The gateway authorizes a CONNECT only when all of these checks pass:
 2. The requested authority normalizes to a `host:port` destination.
 3. Postgres contains an active `permission_registry` row for that identity and destination.
 4. The row's `signature` verifies over the canonical permission row fields with the referenced active principal signing key.
-5. `principal_key_permissions` confirms that the signing key was allowed to delegate that identity/destination scope.
+5. `principal_key_permissions` confirms that the signing key was allowed to delegate that destination.
 
 ### Database Structure
 
@@ -128,10 +128,10 @@ The authorization registry has three main tables:
 | Table | Key Columns | Purpose |
 |---|---|---|
 | `principal_signing_keys` | `key_id`, `algorithm`, `public_key_spki_der`, `not_before`, `not_after`, `revoked_at` | Stores trusted P-256 public keys that may sign permissions. |
-| `principal_key_permissions` | `signing_key_id`, `subject_identity`, `destination`, `not_before`, `not_after`, `revoked_at` | Defines what each signing key is allowed to delegate. |
+| `principal_key_permissions` | `signing_key_id`, `destination`, `not_before`, `not_after`, `revoked_at` | Defines which destinations each signing key is allowed to delegate. |
 | `permission_registry` | `permission_id`, `signing_key_id`, `subject_identity`, `destination`, `not_before`, `not_after`, `revoked_at`, `signature` | Stores signed permissions that authorize a subject identity to reach a normalized destination. |
 
-`principal_key_permissions.signing_key_id` and `permission_registry.signing_key_id` both reference `principal_signing_keys.key_id`. A permission is usable only when the permission row is active, the signing key is active, the signature verifies over the canonical row fields, and the signing key has a matching delegation scope row.
+`principal_key_permissions.signing_key_id` and `permission_registry.signing_key_id` both reference `principal_signing_keys.key_id`. A permission is usable only when the permission row is active, the signing key is active, the signature verifies over the canonical row fields, and the signing key has a matching destination delegation row.
 
 The signed bytes are the following UTF-8 text, with fields in this exact order and timestamps formatted as UTC RFC 3339 with six fractional digits:
 

migrations/0001_signed_authorization_registry.sql

@@ -21,7 +21,6 @@ CREATE TABLE principal_signing_keys (
 CREATE TABLE principal_key_permissions (
     id BIGSERIAL PRIMARY KEY,
     signing_key_id TEXT NOT NULL REFERENCES principal_signing_keys(key_id),
-    subject_identity TEXT NOT NULL CHECK (subject_identity <> ''),
     destination TEXT NOT NULL CHECK (destination <> ''),
     not_before TIMESTAMPTZ NOT NULL,
     not_after TIMESTAMPTZ NOT NULL,
@@ -51,5 +50,5 @@ CREATE INDEX permission_registry_active_lookup_idx
     WHERE revoked_at IS NULL;
 
 CREATE INDEX principal_key_permissions_active_scope_idx
-    ON principal_key_permissions (signing_key_id, subject_identity, destination)
+    ON principal_key_permissions (signing_key_id, destination)
     WHERE revoked_at IS NULL;

src/policy.rs

@@ -151,10 +151,7 @@ impl PolicyEngine for PostgresPolicyEngine {
 
         let mut last_denial = None;
         for candidate in candidates {
-            match self
-                .evaluate_candidate(&candidate, &source_identity, &normalized_dest)
-                .await
-            {
+            match self.evaluate_candidate(&candidate, &normalized_dest).await {
                 Ok(()) => return PolicyDecision::Allow { source_identity },
                 Err(reason) => last_denial = Some(reason),
             }
@@ -176,7 +173,6 @@ impl PostgresPolicyEngine {
     async fn evaluate_candidate(
         &self,
         candidate: &CandidatePermission,
-        source_identity: &str,
         normalized_dest: &str,
     ) -> Result<(), String> {
         if !candidate.signer_active_now {
@@ -200,7 +196,6 @@ impl PostgresPolicyEngine {
             .registry
             .signer_has_scope(
                 &candidate.signing_key_id,
-                source_identity,
                 normalized_dest,
                 candidate.permission_not_before,
                 candidate.permission_not_after,
@@ -209,8 +204,8 @@ impl PostgresPolicyEngine {
             .map_err(|e| format!("signer scope lookup failed: {e:#}"))?;
         if !has_scope {
             return Err(format!(
-                "signing key {:?} is not allowed to delegate {:?} to {:?}",
-                candidate.signing_key_id, normalized_dest, source_identity
+                "signing key {:?} is not allowed to delegate {:?}",
+                candidate.signing_key_id, normalized_dest
             ));
         }
 

src/registry.rs

@@ -109,7 +109,6 @@ impl RegistryStore {
     pub async fn signer_has_scope(
         &self,
         signing_key_id: &str,
-        subject_identity: &str,
         destination: &str,
         permission_not_before: DateTime<Utc>,
         permission_not_after: DateTime<Utc>,
@@ -120,18 +119,16 @@ impl RegistryStore {
                 SELECT 1
                 FROM principal_key_permissions
                 WHERE signing_key_id = $1
-                  AND subject_identity = $2
-                  AND destination = $3
+                  AND destination = $2
                   AND revoked_at IS NULL
                   AND not_before <= now()
                   AND not_after > now()
-                  AND not_before <= $4
-                  AND not_after >= $5
+                  AND not_before <= $3
+                  AND not_after >= $4
             )
             "#,
         )
         .bind(signing_key_id)
-        .bind(subject_identity)
         .bind(destination)
         .bind(permission_not_before)
         .bind(permission_not_after);

tests/common/mod.rs

@@ -472,13 +472,12 @@ impl TestAuthzRegistry {
             sqlx::query(
                 r#"
                 INSERT INTO principal_key_permissions (
-                    signing_key_id, subject_identity, destination, not_before, not_after
+                    signing_key_id, destination, not_before, not_after
                 )
-                VALUES ($1, $2, $3, $4, $5)
+                VALUES ($1, $2, $3, $4)
                 "#,
             )
             .bind(&self.key_id)
-            .bind(subject_identity)
             .bind(&normalized_destination)
             .bind(not_before)
             .bind(not_after)