Proxy key database

The pxAuth service is the proxy key authority: the record of which keys may do what on whose behalf. Connect with jnu.connect('pxAuth', keystore). One table is exposed.

proxyAuth

One row per granted operation. A key with several permissions has several rows, and nothing requires every row for a proxyAddress to point at the same authAddress. Readable by the owner, who can also delete rows; deleting the rows revokes the key.

Column	Type	Meaning
proxyAddress	ethAddress	The key itself, the address that signs requests.
authAddress	ethAddress	The identity the key acts for. This is the address the scheduler records as a job’s owner and matches policies against.
owner	ethAddress	The user who granted the permission.
operationKey	string	The operation granted, for example job.exec, scheduler.jnu.jobs.query or $login for everything. A parent key grants its children: job grants job.cancel.
related	string	Optional restriction. job-<opaqueId> ties a job operation to one job; a JSON object ties a jnu operation to rows matching that prototype.
expireDate	timestamp	When the row stops working.
usesRemaining	integer	Decrements per use; the row dies at zero. null means unlimited.
amountRemaining	finNum	For bank operations, DCC the key may still spend.
operationGroup, creator, extensionSource, context	various	Informational grouping and provenance, no authority.
userAgent, ipAddress, referer	string	Captured when the row was created.

The companion proxyAuthLog table, which keeps the signed messages that created these rows, isn’t exposed.

Note

Reading this table with a proxy key requires pxAuth.jnu.proxyAuth.query. The Portal’s standard key purposes don’t include it, so in practice this table is read from a Portal login session, not from an API key.