Alex Dunmow 9a4394a07c feat(auth): X-Bn-Verified-Captcha trusted header + CaptchaVerified helper ...

The host verifies (and consumes) a request's cap-token against its
stateful captcha server before wasm dispatch and stamps this header;
guests enforce captcha by checking CaptchaVerified, fail closed.
Included in AllTrustedHeaders so the host's strip-then-stamp loop
makes it unforgeable, like the identity headers.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-07 22:53:50 +08:00

..

claims.go

feat: bootstrap block/pluginsdk — the proto-first plugin SDK (P1)

2026-07-07 10:51:00 +08:00

context.go

feat: bootstrap block/pluginsdk — the proto-first plugin SDK (P1)

2026-07-07 10:51:00 +08:00

public_users.go

feat: bootstrap block/pluginsdk — the proto-first plugin SDK (P1)

2026-07-07 10:51:00 +08:00

trustedheaders_test.go

feat(auth): X-Bn-Verified-Captcha trusted header + CaptchaVerified helper

2026-07-07 22:53:50 +08:00

trustedheaders.go

feat(auth): X-Bn-Verified-Captcha trusted header + CaptchaVerified helper

2026-07-07 22:53:50 +08:00