[1.0.0] Harden the default security posture of the server.#212

Merged

ChadSikorra merged 6 commits into

FreeDSx:mainfrom

ChadSikorra:upgrade/security-pt1

Jul 12, 2026

Commits on Jul 12, 2026

Harden the default security posture of the server.
ChadSikorra
committed
Add read / write granularity to attribute access control. This is needed to correctly gate userPassword access and gives more fine grained control over attribute access in general.
ChadSikorra
committed
Fix compare request audits so it classifies it as a read denial.
ChadSikorra
committed
Fix the test since the default ACL is now more strict. The test needs to explicitly opt-in to a more relaxed ACL.
ChadSikorra
committed
Make sure syncRepl functions properly under the new ACL rules. It needs a bypass for attribute visibility, which is expected for sync. It's also why sync repl is a priveleged control.
ChadSikorra
committed
Construct the AclRules uniformly with the secure defaults. Force callers to explicitly construct using "fromEmpty" if they want their own. Document the hazards.
ChadSikorra
committed