feat(proxy): add /auth/exchange token exchange endpoint

POST /auth/exchange: service presents user JWT + own credentials, gets scoped service token with subject identity metadata. Flow: validate subject token, authenticate service via client_credentials, verify scope subset, return token + metadata. Scope escalation denied if requested scope exceeds service roles. 14 tests covering: helpers, validation, missing fields, scope subset, JWT decoding, edge cases. Closes homelab#10 Co-authored-by: poimen <[email protected]>
2026-09-08 17:05:13 -07:00
parent a51c14426f
commit c9ded315bc
3 changed files with 448 additions and 0 deletions
@@ -243,6 +243,10 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		h.handleAuthRefresh(w, r)
 		return
 	}
+	if r.URL.Path == "/auth/exchange" {
+		h.handleAuthExchange(w, r)
+		return
+	}

 	// Handle /v1/models endpoint (no routing needed, derived from config)
 	if r.URL.Path == "/v1/models" && r.Method == "GET" {