kuns/claudedo-online
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: role-based access via Zitadel project roles

Browse Source 
Replace the ALLOWED_USER_IDS sub-allowlist with a Zitadel project role
check: tokens must carry the role from REQUIRED_ROLE (default "user")
in the urn:zitadel:iam:org:project[:id]:roles claim. Roles are granted
per account in Zitadel (project ClaudeDo), where access is now managed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Claude
2026-06-10 11:25:34 +00:00
parent 725f75fdd1
commit d4c734737b
6 changed files with 72 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
.env.example
View File

@@ -6,8 +6,8 @@ DATABASE_URL=postgres://mika:CHANGEME@l8kogcggsc80sgcgk8kswww4:5432/claudedo
ZITADEL_ISSUER=https://auth.kuns.dev
# Comma-separated accepted audiences: web client id, desktop client id, project id
ZITADEL_AUDIENCE=
# Comma-separated owner Zitadel user ids (the single owner's `sub`)
ALLOWED_USER_IDS=
# Zitadel project role required for API access (default: user)
REQUIRED_ROLE=user
# CORS: the web client origin (the app's own origin)
WEB_ORIGIN=https://claudedo.kuns.dev