Upgrade Liquor Cabinet and enable hashed access tokens #263

2026-11-04T11:37:20Z

raucao commented

2026-11-04 11:37:20 +00:00

Bumps the dev Compose Liquor Cabinet image to 2.0.0-rc.2 and sets RS_HASHED_ACCESS_TOKENS=true, so it looks up remoteStorage authorizations by the SHA256 digest of the presented bearer token. That matches how Akkounts has stored authorizations in Redis since the token hashing change, where the plaintext is no longer available after issuance.

Without the flag, the dev setup kept Liquor Cabinet on a plaintext lookup, so a freshly issued authorization (stored only under its digest key) could not be found and requests failed with 401. Verified locally: a token whose digest is present in Redis is authorized, while a wrong token still returns 401. Liquor Cabinet 2.0.0-rc.2 still falls back to the plaintext key, so authorizations created before hashing keep working.

Bumps the dev Compose Liquor Cabinet image to 2.0.0-rc.2 and sets RS_HASHED_ACCESS_TOKENS=true, so it looks up remoteStorage authorizations by the SHA256 digest of the presented bearer token. That matches how Akkounts has stored authorizations in Redis since the token hashing change, where the plaintext is no longer available after issuance. Without the flag, the dev setup kept Liquor Cabinet on a plaintext lookup, so a freshly issued authorization (stored only under its digest key) could not be found and requests failed with 401. Verified locally: a token whose digest is present in Redis is authorized, while a wrong token still returns 401. Liquor Cabinet 2.0.0-rc.2 still falls back to the plaintext key, so authorizations created before hashing keep working.

raucao added 1 commit 2026-11-04 11:37:20 +00:00

Upgrade Liquor Cabinet and enable hashed access tokens

CI / Test (pull_request) Successful in 45s

Details

Release Drafter / Update release notes draft (pull_request) Successful in 3s

Details

7b1f33abd0

Liquor Cabinet 2.0.0-rc.2 can look up remoteStorage authorizations by the SHA256 digest of the presented bearer token, which matches how Akkounts now stores them. Set RS_HASHED_ACCESS_TOKENS=true in the dev Compose setup so the two sides agree; Liquor Cabinet still falls back to the plaintext key for authorizations created before hashing.

raucao added the

integration

remotestorage

dev environment kredits-1 labels 2026-11-04 11:40:04 +00:00

raucao merged commit 939f447eae into master

2026-11-04 11:40:14 +00:00

raucao deleted branch dev/upgrade_liquor-cabinet

2026-11-04 11:40:14 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: kosmos/akkounts#263