# `rho auth`

## Purpose

`rho auth` owns trust and authorization decisions.

It answers questions like:

- is this peer trusted yet
- should this first connection be paired
- may this actor perform this action in this repo
- has this peer been permanently blocked

## Responsibilities

- evaluate whether an actor may perform an action
- manage repo-level authorization metadata
- manage trust-on-first-use pairing records
- trigger middleware on first-contact or high-trust decisions
- support permanent deny and block records
- expose deterministic authorization checks to other `rho` commands

## Preserve From The Old System

- explicit approval and policy boundaries
- the idea that trust decisions should not be hidden inside transport or agent logic

## Simplify

- start with TOFU plus explicit user confirmation
- keep trust records local and inspectable
- keep blocking simple and decisive
- do not start with large distributed trust frameworks

## Replace Old Functionality With

- a small Rust auth crate used by the CLI commands
- explicit trust and block records
- deterministic evaluation against repo policy plus trust state
- middleware hooks for first connection pairing and exceptional actions

## Leave Off In V1

- web-of-trust systems
- certificate authorities
- distributed revocation protocols
- complex role inheritance across many repos

## Suggested Files

```text
rho/policy/auth.yaml
~/.rho/trust/<provider>/<handle>.yaml
~/.rho/blocks.yaml
```

V1 repo auth policy should keep admin control explicit:

```yaml
version: 1

auth:
  trust: local
  accepted_identity_proofs:
    - github-profile-fragment-claim

  admins:
    - rho://id/github/rho-owner

  admin_only_paths:
    - rho.yaml
    - rho/membership.yaml
    - rho/policy/**
    - rho/participants/**
```

Normal collaboration read/write rules belong in
`rho/policy/permissions.yaml`. `rho auth` answers who can change policy and who
is trusted; permissions answer who can read/write content paths.

## Important Rules

- First contact should default to pending trust, not silent allow.
- TOFU pairing should record the observed key fingerprint.
- A blocked peer should be treated as denied for every action until explicitly unblocked.
- `rho auth` decides authorization; `rho middleware` may assist with human approval, but should not replace the source of truth.
