From 5fcbd71c61ae1f6cd40dffd72ad91544066f553b Mon Sep 17 00:00:00 2001
From: Dhruv Verma <dhruvverma@microsoft.com>
Date: Thu, 26 Dec 2024 10:54:46 -0500
Subject: [PATCH] Added changesets

---
 server/routerlicious/.changeset/curly-wombats-peel.md | 7 +++++++
 server/routerlicious/.changeset/six-candles-sneeze.md | 7 +++++++
 server/routerlicious/.changeset/weak-radios-camp.md   | 7 +++++++
 server/routerlicious/.changeset/wide-ducks-bake.md    | 7 +++++++
 4 files changed, 28 insertions(+)
 create mode 100644 server/routerlicious/.changeset/curly-wombats-peel.md
 create mode 100644 server/routerlicious/.changeset/six-candles-sneeze.md
 create mode 100644 server/routerlicious/.changeset/weak-radios-camp.md
 create mode 100644 server/routerlicious/.changeset/wide-ducks-bake.md

diff --git a/server/routerlicious/.changeset/curly-wombats-peel.md b/server/routerlicious/.changeset/curly-wombats-peel.md
new file mode 100644
index 000000000000..12eaf8055f99
--- /dev/null
+++ b/server/routerlicious/.changeset/curly-wombats-peel.md
@@ -0,0 +1,7 @@
+---
+"@fluidframework/server-services-utils": minor
+---
+
+Adds support for a new token claim - `isKeylessAccessToken`.
+
+The added support for this new claim would allow the server to know what keys to use to validate an access token. This value will only be added for tokens signed by the server. It is not exposed to the client API.
diff --git a/server/routerlicious/.changeset/six-candles-sneeze.md b/server/routerlicious/.changeset/six-candles-sneeze.md
new file mode 100644
index 000000000000..a801fe799c75
--- /dev/null
+++ b/server/routerlicious/.changeset/six-candles-sneeze.md
@@ -0,0 +1,7 @@
+---
+"@fluidframework/server-services": minor
+---
+
+Adds support for the tenant manager to use Riddlers new APIs
+
+Now the tenant manager used by Alfred can fetch the new private keys exposed by Riddler. The `getKeys` can be called with the `usePrivateKeys` flag set to true. This is currently only used for one Alfred to Riddler API call to fetch tenant keys when signing a document creation token.
diff --git a/server/routerlicious/.changeset/weak-radios-camp.md b/server/routerlicious/.changeset/weak-radios-camp.md
new file mode 100644
index 000000000000..5bb7ededccae
--- /dev/null
+++ b/server/routerlicious/.changeset/weak-radios-camp.md
@@ -0,0 +1,7 @@
+---
+"@fluidframework/server-routerlicious-base": major
+---
+
+Now Riddler supports using private keys to sign server access tokens
+
+Riddler's tenant manager now exposed two new properties - `enablePrivateKeyAccess` and `enableSharedKeyAccess`. These respectively indicate whether a tenant can be accessed using hidden private keys and whether a tenant can be accessed using shared secrets. The APIs added support toggling the `enablePrivateKeyAccess` prop. They also support fetching these new keys and refreshing these new keys. All calls to manipulate private keys should be made from witin the server.
diff --git a/server/routerlicious/.changeset/wide-ducks-bake.md b/server/routerlicious/.changeset/wide-ducks-bake.md
new file mode 100644
index 000000000000..8f2b1b493671
--- /dev/null
+++ b/server/routerlicious/.changeset/wide-ducks-bake.md
@@ -0,0 +1,7 @@
+---
+"@fluidframework/server-services-core": major
+---
+
+Adds new props to the tenant interface to support private key based access
+
+Now tenants have two new properties - `enablePrivateKeyAccess` and `enableSharedKeyAccess`. These are used by Riddler to determine whether a tenant allows just shared key access, private key access or both.