From be62232403137eed344abf923b183c75bcd9b41b Mon Sep 17 00:00:00 2001
From: Tom Scanlan <tom@openmeet.net>
Date: Fri, 8 May 2026 09:44:26 -0400
Subject: [PATCH] fix(spaces): drop LocalBindingResolver from default composite
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The default in-process credential verifier composed
[Enrollment, Local], so a never-enrolled space still resolved its
authority via LocalBindingResolver — collapsing the host-side consent
layer the enrollment table is meant to provide.

Default to enrollment-only. createLocalBindingResolver remains exported
for explicit single-tenant wiring via options.credentialVerifier.
---
 packages/contrail-appview/src/core/spaces/router.ts | 11 +----------
 1 file changed, 1 insertion(+), 10 deletions(-)

diff --git a/packages/contrail-appview/src/core/spaces/router.ts b/packages/contrail-appview/src/core/spaces/router.ts
index 943f6a9..a0557f5 100644
--- a/packages/contrail-appview/src/core/spaces/router.ts
+++ b/packages/contrail-appview/src/core/spaces/router.ts
@@ -9,9 +9,7 @@ import { HostedAdapter } from "./adapter";
 import {
   buildVerifier,
   createBindingCredentialVerifier,
-  createCompositeBindingResolver,
   createEnrollmentBindingResolver,
-  createLocalBindingResolver,
   createLocalKeyResolver,
   createServiceAuthMiddleware,
 } from "@atmo-dev/contrail-base";
@@ -71,18 +69,11 @@ export function registerSpacesRoutes(
   );
 
   if (spacesConfig.recordHost) {
-    // Default in-process verifier: enrollment is the canonical binding
-    // source; Local-binding is a fallback for spaces created but not yet
-    // enrolled. Caller overrides via `options.credentialVerifier` to
-    // accept external authorities.
     const credentialVerifier =
       options.credentialVerifier ??
       (authorityConfig.signing
         ? createBindingCredentialVerifier({
-            bindings: createCompositeBindingResolver([
-              createEnrollmentBindingResolver({ recordHost: adapter }),
-              createLocalBindingResolver({ authorityDid: authorityConfig.serviceDid }),
-            ]),
+            bindings: createEnrollmentBindingResolver({ recordHost: adapter }),
             keys: createLocalKeyResolver({
               authorityDid: authorityConfig.serviceDid,
               publicKey: authorityConfig.signing.publicKey,
-- 
2.51.2