Registry authorization

Namespace, package, token, and visibility authorization in Cuitty Registry.

Cuitty Registry uses relationship-based authorization for namespace, package, token, publish, install, and admin operations. The Registry database remains the source of package metadata; SpiceDB answers permission checks.

Representative objects

registry_namespace
registry_package
registry_version
registry_token
registry_upload_session
organization
user

Common permissions

Permission	Typical use
`read`	View namespace, package, version, and metadata
`install`	Download packages, crates, wheels, tarballs, manifests, and layers
`publish`	Upload new versions or push OCI manifests
`maintain`	Yank, unyank, retag, and edit package metadata
`admin`	Manage visibility, quotas, tokens, ownership, and transfers

Private packages may return 404 to callers without read permission. Authenticated callers with partial access should receive 403 for disallowed operations.

Fail closed

Security-expanding writes should fail if authorization relationships cannot be committed. Examples include making a package public, granting publish permission, creating a package token, or transferring namespace ownership.

Security-reducing writes should be retried until the authorization graph reflects the Registry database. Examples include revoking a token, making a package private, or removing a maintainer.

Outbox inspection

SELECT id, operation_kind, resource_kind, resource_id, status, attempts, last_error
FROM registry_authz_outbox
WHERE status IN ('pending', 'processing', 'failed_retryable', 'failed_terminal')
ORDER BY created_at ASC
LIMIT 50;

Replay retryable rows with the Registry worker or maintenance command, then spot-check permissions with zed permission check.