authn: accept tokens.sr.ht working tokens and PATs as bearer The /mcp surface is bearer-only, and none of the three credential planes this service has fits an agent. ResolveBearer adds the fourth: it decodes the presented token once, locally, and routes on the ClientID — the only thing that tells a tokens.sr.ht working token from a meta.sr.ht PAT, since both are sealed with the same instance key. A working token goes through sr-ht-ecore's validator (one copy of that check for the whole instance) and carries its grants out on the result, so the surface can ask Authorize where the action is known. A PAT reuses ResolveBasic with the token's own username as the identity — there is no presented username to compare against in a bearer header — and the same TokenGrantsAllow read gate the clone path applies. An instance with no [tokens.sr.ht] section passes a nil validator: meta PATs and anonymity keep working, a working token is refused, because a machine credential this instance cannot verify is refused rather than guessed at. A failed credential is always a refusal and never a downgrade to anonymous, and backend.go's two error classes are preserved so a caller can still answer 401 against 503. core.GrantRead is the vocabulary tokens.sr.ht deliberately does not know. There is no dolt:write: nothing on that surface writes, and a grant nobody checks is a promise to an operator that no code keeps.
internalauth: take both ends of the internal protocol from ecore The guard on /internal/repos and the header cmd/dolt-git-hook minted for it were two hand-written halves of one protocol in two packages that shared no type, no constant and no test. Both are now sr-ht-ecore/internalauth: Guard on the receiving end, AuthorizationAs on the calling one, over one Auth struct. The guard also pins the caller, which the old copy did not: core-go only asks that a token name some client and node, and on an endpoint that provisions a database for an arbitrary user that means any holder of the network key will do. The pinned pair lives in core so the mint and the pin cannot drift apart. The hook test now runs internalauth.Identify — the real receiving end — over the header the hook produced, so the two ends are checked against each other rather than against a third copy of the decode.
foundation: module, core domain, schema, spike-verified dolt interop Phase 0 foundation for dolt.sr.ht (pure-Go Dolt hosting for SourceHut). Dependency pins: - core-go v0.0.0-20260520082310-fdb3662452dc: the production instance's submodule commit (fdb3662); must never be upgraded so token/config/crypto behavior matches the rest of the instance. - dolthub/dolt/go v0.40.5-0.20260626152440-45335d44ad79: pseudo-version at the commit tagged v2.1.10 (45335d44), matching the installed dolt CLI. The /go submodule's latest tag (v0.40.4, 2021) does not interop with a modern CLI; matching the CLI commit guarantees a common NBS format (Format_DOLT) and remotesapi proto. - gopkg.in/go-jose/go-jose.v2 v2.6.3: same JOSE version dolt's creds package signs EdDSA keypair JWTs with, avoiding a duplicate JOSE lib. - grpc v1.79.3, logrus v1.8.3, lib/pq v1.10.9, chi/v5 v5.3.1, brant v0.5.1. Contents: - core/ pure domain: models, ValidateName/ParseRepoPath, the access matrix (Allowed + NotFoundForPrivate), full table-driven tests. - schema.sql + migrations/0001_initial.sql (brant format). - config.example.ini, contrib/dolt.sr.ht.conf (nginx), Makefile, scss/main.scss, static/logo.svg, README, .gitignore. - internal/smoke: throwaway import-and-build check (deleted in Phase 3). Spike (storage/spike_test.go, tag `spike`): bare NBS store via WriteEmptyRepo, served by remotesrv on an ephemeral single port, round-tripped through the real dolt CLI v2.1.10 (clone -> insert -> commit -> push -> re-clone -> verify rows). Green, no version juggling needed beyond selecting the v2.1.10 commit. FS must be rooted at the repos dir (LocalFilesysWithWorkingDir) so sealed chunk-URL prefixes are clean relatives. Build note: dolt pulls go-icu-regex (CGO), which needs ICU4C headers; on this Mac set CGO_CPPFLAGS/CGO_LDFLAGS to icu4c@78 (documented in README).