[bherila]

Motivation

• Resolve a privilege-escalation where project-scoped deployment tokens without storage scopes could access Blob and KV data because data-plane handlers only used project_id() and did not check the newly-introduced Blob*/Kv* permissions.
• Make deployment-token authorization consistent with the rest of the platform by mapping storage permissions to deployment-token variants and enforcing them on all data-plane operations.

Description

• Added permission checks using the permission_guard! macro to Blob handlers so writes require BlobWrite, deletes require BlobDelete, and reads/head/download/copy require BlobRead as appropriate (crates/temps-blob/src/handlers/handler.rs).
• Added permission checks to KV handlers so reads/ttl/keys require KvRead, writes/incr/expire require KvWrite, and deletes require KvDelete (crates/temps-kv/src/handlers/handler.rs).
• Extended DeploymentTokenPermission with blob:read|write|delete and kv:read|write|delete and mapped standard Permission::Blob*/Permission::Kv* to the new deployment-token variants in AuthContext::has_permission (crates/temps-entities/src/deployment_tokens.rs, crates/temps-auth/src/context.rs).
• Added a regression unit test that verifies deployment-token storage permissions map to the corresponding standard permissions and updated CHANGELOG.md under ## [Unreleased] to document the security fix (crates/temps-auth tests and CHANGELOG.md).

Testing

• Ran cargo check --lib -p temps-auth -p temps-blob -p temps-kv which completed successfully and produced no warnings considered blocking by the project's rules.
• Ran the new unit test cargo test -p temps-auth deployment_token_storage_permissions_map_to_standard_permissions which passed.
• Verified compilation of the affected crates as part of the workspace build (cargo check / crate checks completed successfully).

---

Codex Task

[chatgpt-codex-connector]

You have reached your Codex usage limits for security reviews. Please try again later.

[github-actions]

📓 Changelog preview

This is what your commits will add to the generated CHANGELOG.md at release time (via git-cliff). Do not edit CHANGELOG.md by hand — it is generated from your Conventional Commit messages.

## [Unreleased]

### CI

- **self-hosted:** Add build/test workflow on push to bherila fork
- **self-hosted:** Recreate example-plugin web/dist before cargo check
- **self-hosted:** Also recreate temps-cli/dist placeholder
- **self-hosted:** Run hosted unit-test crate set, skip integration-heavy crates
- **self-hosted:** Exclude temps-screenshots live-browser tests

### Fixed

- **auth:** Enforce blob and kv token scopes

[bherila]

The functional change was carried into upstream security-hardening PR gotempsh#676 and its merged replacement gotempsh#677. Upstream gotempsh#676 explicitly lists this fork PR in its source coverage.

Fork main has now been fast-forwarded to upstream main at 7250ab59b38d3138014ade7f5d6391c856eaa4f7. Closing this obsolete fork PR as part of the upstream synchronization; its branch history is retained.