{"id":18812336,"url":"https://github.com/staart/design-docs","last_synced_at":"2026-01-27T16:04:18.012Z","repository":{"id":246934307,"uuid":"816188891","full_name":"staart/design-docs","owner":"staart","description":null,"archived":false,"fork":false,"pushed_at":"2024-07-05T17:49:11.000Z","size":3,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-10-21T12:35:47.897Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/staart.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-06-17T08:11:31.000Z","updated_at":"2024-07-05T17:49:14.000Z","dependencies_parsed_at":"2024-07-05T23:13:22.196Z","dependency_job_id":"812eca1e-23e6-498a-b070-bed9e31638e2","html_url":"https://github.com/staart/design-docs","commit_stats":null,"previous_names":["staart/design-docs"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/staart/design-docs","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/staart%2Fdesign-docs","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/staart%2Fdesign-docs/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/staart%2Fdesign-docs/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/staart%2Fdesign-docs/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/staart","download_url":"https://codeload.github.com/staart/design-docs/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/staart%2Fdesign-docs/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28816408,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-27T12:25:15.069Z","status":"ssl_error","status_checked_at":"2026-01-27T12:25:05.297Z","response_time":168,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-07T23:31:57.235Z","updated_at":"2026-01-27T16:04:17.981Z","avatar_url":"https://github.com/staart.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# Design docs\n\n\u003e [!WARNING]  \n\u003e This is a very unfinished document where I brainstorm ideas and concepts for the new version of this project. Treat it as a very early draft.\n\n## Authentication\n\n## Authorization\n\n### Scopes\n\nEach scope is expressed as a Uniform Resource Name (URN). URNs are a way to uniquely identify resources and follow the format `urn:\u003cnamespace\u003e:\u003cresource\u003e`. In our case, the format is `urn:\u003capp name\u003e:\u003cauth\u003e:\u003cresource\u003e:\u003caccess\u003e`:\n\n- `urn` is the prefix for all URNs\n- Namespace is a combination of `\u003capp name\u003e` and `\u003cauth\u003e`\n  - `\u003capp name\u003e` is the name of the app; we use `staart` in the examples below\n  - Scopes can be for an organization or a user, so `\u003cauth\u003e` always starts with `org_` or `usr_`\n- `\u003cresource\u003e` is the resource the scope is for\n- Each scope must always end with the level of `\u003caccess\u003e` which can be either `read` or `write`\n\nFor example:\n\n- `urn:staart:org_1abc9c:*:read` -\u003e read access to the organization with the ID `org_1abc9c`\n- `urn:staart:usr_1abc9c:*:write` -\u003e write access to the user with the ID `usr_1abc9c`\n\nYou can also have scopes that are limited to a specific resource, for example:\n\n- `urn:staart:org_1abc9c:membership_16a085:read` -\u003e read access to the membership with the ID `membership_16a085` in the organization with the ID `org_1abc9c`\n- `urn:staart:usr_1abc9c:email:write` -\u003e write access to the email of the user with the ID `usr_1abc9c`\n- `urn:staart:org_1abc9c:membership_16a085:user:read` -\u003e read access to the user in the membership with the ID `membership_16a085` in the organization with the ID `org_1abc9c`\n\nScope matching uses glob patterns, so you can also have wildcard scopes:\n\n- `urn:staart:org_1abc9c:membership_*:read` -\u003e read access to all memberships in the organization with the ID `org_1abc9c`\n- `urn:staart:usr_*:write` -\u003e write access to all users\n- `urn:staart:org_*:membership_16a085:read` -\u003e read access to the membership with the ID `membership_16a085` regardless of the organization\n\nOther implementation notes:\n\n- Each scope must have at least 4 `:` characters (`urn`, namespace, organization or user, resource, `read` or `write`)\n  - `urn:staart:org_1abc9c:read` is not valid, instead use `urn:staart:org_1abc9c:*:read`\n  - `urn:staart:usr_1abc9c:resource:subresource:subsubresource:read` is valid and can be used to create complex scopes\n- `read` is a strict subset of `write`, so if a user has `write` access to a resource, they also have `read` access to it; therefore:\n  - A token cannot have both `read` and `write` access to the same resource\n- Superadmins by definition have all rights, so they have the scope `urn:staart:*:*:write`\n\n## Unstructured ideas\n\n- Use [`p-min-delay`](https://github.com/sindresorhus/p-min-delay) to delay responding to auth requests to at least 1 second to prevent timing attacks. For example, making a request to `/auth/login` will always take 1 second (even though it should usually be much shorter) so that it's impossible to know whether a user exists or not (since throwing a 404 is faster than when a user exists and password comparisons take place) and also useful for hash comparisons.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstaart%2Fdesign-docs","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fstaart%2Fdesign-docs","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstaart%2Fdesign-docs/lists"}