fix(portal): lease attested access and renew it while connected - #15260
Open
jamilbk wants to merge 2 commits into
Open
fix(portal): lease attested access and renew it while connected#15260jamilbk wants to merge 2 commits into
jamilbk wants to merge 2 commits into
Conversation
A policy that requires an attested device checked the attestation only at connect, and the authorization then lived until the session expired whether or not the client was still connected. Attested authorizations now carry a 15-minute lease that the client channel renews in place every 5 minutes by re-sending the authorization the peer already holds, so a connected client is untouched and a departed one loses access within the lease.
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.
Tip: disable this comment in your organization's Code Review settings.
|
coverage: 73.84% (-0.09%) from 73.927% — fix-attested-authorization-lease into main |
jamilbk
added a commit
that referenced
this pull request
Sep 14, 2026
Postures had a `firezone.attested` leaf next to the `device_attested` policy condition, so the same requirement could be written in two places. Attestation is a property of the connection, not device telemetry, and #15260 gives it a lease that only the condition knows about. A posture leaf for it would have needed the same treatment. The leaf is gone. Attestation is expressed only through the condition, and the posture grammar is telemetry only. Related: #15260, #15059
jamilbk
requested review from
thomaseizinger
and removed request for
thomaseizinger
September 14, 2026 10:58
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A policy that requires an attested device checked the attestation only when the client connected. The authorization it granted then lived until the session expired, which can be up to 90 days, and the gateway or peer kept serving the flow even after the client had dropped off the portal. So a device that attested once kept its access long after the connection that vouched for it was gone.
Attested access is now a 15-minute lease. The authorization row and the message to the gateway or peer carry the lease as their expiry, while the flow log tokens keep the session expiry so client-side logs stay accepted. Every 5 minutes, and once right after joining, the client channel renews its attested authorizations in place: it moves the row's expiry forward and re-sends the authorization the peer already holds. connlib reuses the existing connection when the credentials match and only moves the resource's expiry, so nothing is torn down and the client never notices. A client that disconnects stops renewing and its access ends within 15 minutes. A disconnect shorter than that, a deploy included, is invisible because the new channel renews on join.
Renewal goes through the same messages as a fresh authorization, so every gateway and client in the field takes it. Gateways older than 1.4 keep session-long authorizations as before.
Related: #15173, #15259