Chapter 23 — worked answers

1. Two middleware paths

User routes skip configured JWT verification when the secret is empty. Agent routes are excluded from user roles and then call authorizeAgentCredential in their own handlers. Absence of a user principal therefore does not waive node credential validation.

2. Static configuration overrides claims

When staticUsers is nonempty, the subject must be present; its configured role replaces Principal.Role and NamespaceRoles is cleared. A configured operator global role then determines authorization. Inspect effective configuration without exposing bearer material.

3. Rotation is a state mutation before acknowledgement

Heartbeat issues a new token and SetAgentCredential replaces AgentTokenHash/expiry before the response reaches the agent. Losing that response can leave the agent holding a hash-mismatching old token. Expiry/revocation/re-enrollment need separate recovery analysis; short lifetime alone does not solve the acknowledgement window.

4. Different trust properties

JWT/node tokens establish possession-based API authority, not encrypted transport or certificate-bound peer identity. Docker socket access permits powerful host runtime operations regardless of a viewer's limited API role. Mutual TLS and host containment need explicit additional mechanisms and evidence, neither supplied by token naming or a future interface.

Return to Chapter 23.