docs+test(closeout): final-review reservations — stale ACL prose, worker test gaps, config sample fix

2026-08-17 05:23:23 -04:00
parent f5a58d884b
commit b621d692d0
18 changed files with 167 additions and 46 deletions
@@ -801,7 +801,11 @@ the deliberate mitigation: it bounds that exposure window without the cost of a
 revocation store. It now bounds a stale *tag* grant the same way: the token carries
 the tags resolved from the caller's LDAP groups at mint time, so removing a
 `GroupToTag` entry takes effect for token-authenticated hub connections within one
-lifetime. That is where the per-session ACL's revocation need landed — a jti
+lifetime. That 5-minute staleness bound covers token-authenticated connections only:
+a cookie principal carries the `zb:dashboardtag` claims stamped at login for the
+cookie's whole life, so for cookie-authenticated (in-process page) subscriptions a
+revoked `GroupToTag` grant takes effect at the user's next login, not within five
+minutes. That is where the per-session ACL's revocation need landed — a jti
 denylist stays deferred, since the short lifetime already bounds every grant the
 token carries.