Services send service_name and tags in POST /v1/auth/login.
MCIAS evaluates auth:login policy with these as the resource
context after credentials are verified, enabling rules like:
deny guest/viewer human accounts from env:restricted services
deny guest accounts from specific named services
- loginRequest: add ServiceName and Tags fields
- handleLogin: evaluate policy after credential+TOTP check;
policy deny returns 403 (not 401) to distinguish access
restriction from bad credentials
- Go client: Options.ServiceName/Tags stored on Client,
sent automatically in every Login() call
- Python client: service_name/tags on __init__, sent in login()
- Rust client: ClientOptions.service_name/tags, LoginRequest
fields, Client stores and sends them in login()
- openapi.yaml: document service_name/tags request fields
and 403 response for policy-denied logins
- engineering-standards.md: document service_name/tags in
[mcias] config section with policy examples
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- REST handleTOTPEnroll now requires password field in request body
- gRPC EnrollTOTP updated with password field in proto message
- Both handlers check lockout status and record failures on bad password
- Updated Go, Python, and Rust client libraries to pass password
- Updated OpenAPI specs with new requestBody schema
- Added TestTOTPEnrollRequiresPassword with no-password, wrong-password,
and correct-password sub-tests
Security: TOTP enrollment now requires the current password to prevent
session-theft escalation to persistent account takeover. Lockout and
failure recording use the same Argon2id constant-time path as login.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add TOTP enrollment/confirmation/removal to all clients
- Add password change and admin set-password endpoints
- Add account listing, status update, and tag management
- Add audit log listing with filter support
- Add policy rule CRUD operations
- Expand test coverage for all new endpoints across clients
- Fix .gitignore to exclude built binaries
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
