v0.0.19 - Publish release with prompt options for verb-only vs all-verbs session approval

src/main.c

@@ -468,8 +468,8 @@ int socket_name_random(char *out, size_t out_len);
 /* Version information (auto-updated by build/version tooling) */
 #define NSIGNER_VERSION_MAJOR 0
 #define NSIGNER_VERSION_MINOR 0
-#define NSIGNER_VERSION_PATCH 17
-#define NSIGNER_VERSION "v0.0.17"
+#define NSIGNER_VERSION_PATCH 19
+#define NSIGNER_VERSION "v0.0.19"
 
 
 /* NSIGNER_HEADERLESS_DECLS_END */

src/server.c

@@ -270,11 +270,12 @@ typedef struct {
 } policy_table_t;
 
 /* Policy check result */
-#define POLICY_ALLOW          0
-#define POLICY_ALLOW_SESSION  3   /* allow + save as session grant */
-#define POLICY_DENY          -1
-#define POLICY_PROMPT        -2   /* would need user confirmation */
-#define POLICY_NO_MATCH      -3   /* no policy entry matched (fail-closed = deny) */
+#define POLICY_ALLOW               0
+#define POLICY_ALLOW_SESSION_VERB  3   /* allow + save session grant for this caller+role+verb */
+#define POLICY_ALLOW_SESSION_ALL   4   /* allow + save session grant for this caller+role (all verbs) */
+#define POLICY_DENY               -1
+#define POLICY_PROMPT             -2   /* would need user confirmation */
+#define POLICY_NO_MATCH           -3   /* no policy entry matched (fail-closed = deny) */
 
 /* Initialize policy table */
 void policy_table_init(policy_table_t *table);
@@ -691,7 +692,8 @@ static int prompt_for_policy_decision(const caller_identity_t *caller,
     if (pending_derivation) {
         printf("  ** NEW IDENTITY — will be derived if approved **\n");
     }
-    printf("[y] allow once  [n] deny  [a] allow this caller+role for session\n> ");
+    printf("[y] allow once  [n] deny  [e] allow this caller+role+verb for session\n");
+    printf("[a] allow this caller+role for session (all verbs)\n> ");
     fflush(stdout);
 
     ch = getchar();
@@ -704,7 +706,10 @@ static int prompt_for_policy_decision(const caller_identity_t *caller,
 
     ch = tolower(ch);
     if (ch == 'a') {
-        return POLICY_ALLOW_SESSION;
+        return POLICY_ALLOW_SESSION_ALL;
+    }
+    if (ch == 'e') {
+        return POLICY_ALLOW_SESSION_VERB;
     }
     if (ch == 'y') {
         return POLICY_ALLOW;
@@ -1284,13 +1289,17 @@ int server_handle_one(server_ctx_t *ctx, server_activity_cb cb, void *cb_data) {
 
     if (pchk == POLICY_PROMPT) {
         pchk = prompt_for_policy_decision(&caller, method, role_name, purpose, pending_derivation);
-        if (pchk == POLICY_ALLOW_SESSION) {
+        if (pchk == POLICY_ALLOW_SESSION_VERB || pchk == POLICY_ALLOW_SESSION_ALL) {
             policy_entry_t grant;
 
             memset(&grant, 0, sizeof(grant));
             strncpy(grant.caller, caller.caller_id, sizeof(grant.caller) - 1);
             strncpy(grant.roles[0], role_name, ROLE_NAME_MAX - 1);
             grant.role_count = 1;
+            if (pchk == POLICY_ALLOW_SESSION_VERB) {
+                strncpy(grant.verbs[0], method, POLICY_VERB_MAX_LEN - 1);
+                grant.verb_count = 1;
+            }
             grant.prompt = PROMPT_NEVER;
             grant.source = POLICY_SOURCE_SESSION_GRANT;
             if (policy_table_insert_before_last(ctx->policy, &grant) != 0) {