Authorization

authorization.py defines a small provider interface that the hub consults on every privileged action: joining a session, requesting hijack, posting chat, placing annotations.

LocalProvider

The reference provider implements standard RBAC with three roles — viewer, operator, admin. Use this in dev and small deployments.

WebhookProvider

For enterprise integration, every decision is delegated to an external HTTP endpoint. The hub does no policy of its own — it sends the request context to the webhook and trusts the verdict. This makes it straightforward to plug uterm into an existing identity / policy stack without forking the codebase.

Tunnel security

uterm’s binary tunnels (TCP forwarding, HTTP inspection) use in-memory tokens with:

• Hashed at rest — the hub stores a BLAKE2b digest, never the token. The plaintext leaves the create response once and lives only in the URL the operator shares.
• Time-bounded — invites carry an expires_at capped by both their own TTL and the tunnel’s, and expired ones are swept.
• Single-use — redeeming an invite consumes it.

No long-lived shared secret is written to disk for a tunnel session. When the session ends, the tokens are gone.