mirror of
https://github.com/dadosfera/maestro.git
synced 2026-10-23 20:29:08 +00:00
When the ingress annotation carries permission (+project_uuid), authorize against the tenant's orchest-api /api/authz/check (host derived from the JWT, allowlist-guarded); relay allow/deny, fail-closed 502. All-or-nothing on incomplete params; param-less requests stay identity-only (webserver case). Co-Authored-By: WOZCODE <contact@withwoz.com>