feat(serviceadapter): enforce JWT auth on X-Service dispatch

Replace hardcoded SQS-only validator (pointed at non-existent sqs provider JWKS) with shared multi-issuer validator from proxy. Auth-required adapters now validate JWT and check capability (<service>:read for GET, <service>:write for POST). Identity headers injected on success. Auth-optional adapters unchanged. 10 new tests, 69% package coverage. Closes homelab#11 Co-authored-by: poimen <[email protected]>
2026-09-08 16:14:15 -07:00
parent 6f7b850193
commit 62c5cb0b86
3 changed files with 370 additions and 104 deletions
@@ -9,6 +9,7 @@ import (
 	"os/signal"
 	"syscall"

+	"forgejo.riotpiao.com/rock/homelab-frontend/internal/auth"
 	"forgejo.riotpiao.com/rock/homelab-frontend/internal/config"
 	"forgejo.riotpiao.com/rock/homelab-frontend/internal/proxy"
 	"forgejo.riotpiao.com/rock/homelab-frontend/internal/server"
@@ -75,7 +76,13 @@ func main() {
 		_ = registry.Add(a)
 	}
 	log.Printf("%d service adapters loaded", registry.Count())
-	dispatcher := serviceadapter.NewDispatcher(registry)
+
+	// Create shared JWT validator for X-Service auth enforcement
+	var jwtValidator *auth.Validator
+	if cfg.Auth.Enabled && cfg.Auth.JWKSURL != "" {
+		jwtValidator = auth.NewValidator(cfg.Auth.Issuer, cfg.Auth.Audience, cfg.Auth.JWKSURL)
+	}
+	dispatcher := serviceadapter.NewDispatcher(registry, jwtValidator)

 	// Create router that handles health endpoints, X-Service (ServiceAdapter) routing,
 	// temporal endpoints, and passes others to upstream handler