zorin-authority-broker

Local authorization broker for Zorin Trust.

0.4 — ZWEB/1

Authority 0.4 adds loopback browser-login endpoints:

• POST /v1/web/status — checks whether the registered project/origin currently has an active trusted owner-phone USB session.
• POST /v1/web/authenticate — obtains a phone-signed web.authenticate owner proof without a second approval on an already paired workstation.

Both endpoints remain bound to 127.0.0.1:47475. Browser CORS is emitted only for origins registered for a local Authority project, and the request body origin must match the browser Origin header when it is present.

Sensitive application actions continue to use /v1/authorize, which requires explicit phone approval according to Host Agent policy.

Source · MIT