1.4 KiB
Bridge providers receive authenticated caller identity
Bridge payloads are guest-controlled. A provider that uses a payload field as
an ownership namespace lets one plugin impersonate another plugin and mutate
or claim its managed records. The consumer-to-host BridgeInvokeRequest
cannot safely carry identity because the consumer constructs that message.
Decision: the host derives the caller plugin from the loaded module or native
plugin registration. It passes that identity to the provider in
BridgeCallRequest.caller_plugin and, for Go providers, through
plugin.WithBridgeCallerPlugin. Providers read it with
plugin.BridgeCallerPlugin and fail closed when an ownership-sensitive call
has no authenticated caller.
The new host-to-provider protobuf field is additive. Older providers ignore it. New ownership-sensitive providers intentionally reject calls from older hosts that cannot authenticate a caller. Hosts must never copy a caller name from opaque bridge payloads or a consumer-authored capability field.
Consequences:
- Providers can derive durable ownership from an authenticated principal.
- Bridge payload schemas do not need security-sensitive source fields.
- Native and Wasm providers observe the same caller context contract.
Keywords: plugin bridge, caller identity, authentication, ownership, BridgeCallRequest, WithBridgeCallerPlugin, Wasm, confused deputy