levior/cli
Watch
12
0
Fork
You've already forked cli
 0
Code Issues 1 Pull requests Projects Releases 30 Packages Wiki Activity Actions

fix: cli-api takes the project audience only from listed machine clients #33

Merged
simlau merged 1 commit from simlau/machine-allowlist into main 2026-10-28 21:06:26 +00:00
Conversation 0 Commits 1 Files changed 5 +40 -4
simlau commented 2026-10-28 20:42:03 +00:00
Owner
Copy link

Any app in the Zitadel org can ask for the kubernetes project as
audience, so a team app could have replayed a visiting admin's token to
cli-api (final review, 2026-10-28). A token whose audience is only the
project must now come from a client in MACHINE_CLIENT_IDS (holmes,
holmes-slack); people's ID tokens for the CLI app are unaffected. Test:
listed machine accepted, other client refused, person unchanged.

Any app in the Zitadel org can ask for the kubernetes project as audience, so a team app could have replayed a visiting admin's token to cli-api (final review, 2026-10-28). A token whose audience is only the project must now come from a client in MACHINE_CLIENT_IDS (holmes, holmes-slack); people's ID tokens for the CLI app are unaffected. Test: listed machine accepted, other client refused, person unchanged.
fix: cli-api takes the project audience only from listed machine clients
All checks were successful
ci / image-build (pull_request) Successful in 5s
Details
ci / test (pull_request) Successful in 29s
Details
ci / image (pull_request) Has been skipped
Details
ci / release (pull_request) Has been skipped
Details
162c3c4296 
Any app in the Zitadel org can ask for the kubernetes project as
audience, so a team app could have replayed a visiting admin's token to
cli-api (final review, 2026-10-28). A token whose audience is only the
project must now come from a client in MACHINE_CLIENT_IDS (holmes,
holmes-slack); people's ID tokens for the CLI app are unaffected. Test:
listed machine accepted, other client refused, person unchanged.
simlau merged commit d3f53f6633 into main 2026-10-28 21:06:26 +00:00
simlau deleted branch simlau/machine-allowlist 2026-10-28 21:06:27 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
agent:scotland-yard
Hand this issue to Scotland Yard (Paperclip)

No labels
agent:scotland-yard
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
levior/cli!33
No description provided.