Identity and capabilities
reply2social has no users. It does not create them, store them or authenticate them. It asks the host —the site that hosts it— who the person on the other side is.
The invariant
This service never signs a token. It only validates.
If it had something to sign with, it would have something to manufacture an identity with — and an identity manufactured by the service that consumes it proves nothing. The only source of a valid identity here is the validator against the host.
How it happens
The host re-reads the user from the database on every validation, instead of believing what the token says. That is what makes suspending someone take effect immediately: the same token that worked a second ago starts returning 401, without waiting for it to expire. And if their role is lowered, the response carries the new role.
The three capabilities
They are cumulative: whoever can administer can operate, and whoever can operate can view. In the code they are axum extractors — a route declares what it requires and the rest cannot forget to check it.
| Capability | Example routes |
|---|---|
| Operate | approve an emission, pause emission, disseminate to the archive |
| Administer | sign accounts up, grant permissions, create flows, export the cauce |
The distinction that was hard to find: 401 versus 503
Both mean “you do not get through”. They mean opposite things.
A 401 when the host is down is a lie. It asserts “you are nobody” when the truth is “I could not ask”. The difference matters on screen: with a 401 the panel sends you to log in again —and logging in again will fix nothing, because the problem is elsewhere— whereas with a 503 it says the identity service is not responding, which is what is actually happening.
This did not come for free: the middleware swallowed the validator’s error and everything ended up degraded to 401. The failure had to be carried all the way to the extractor for the 503 to survive.
Fail-closed, always
On no path is doubt resolved by letting things through. A service that opens up when in doubt is a service that, the day its dependency fails, is left open — and that is exactly the day nobody is watching.
And the network credentials
A different thing, and worth not mixing up: the Instagram, Mastodon or Telegram tokens are not people’s identities but keys to the accounts.
- They are stored encrypted with AES-256-GCM in
cuentas.credenciales_cifradas. - They are never returned, not even masked. There is no endpoint that shows them.
- You load them and that is it: if you got it wrong, you load them again.
There is no HTTP endpoint that returns ciphertext. The only path that takes credentials out of an installation is the CLI backup, and that is not an endpoint. That is why the invariant has no exceptions to remember.