 Admin Bot
|
69c506c9f9
|
feat(audit): log successful JWT auth with subject, acting_party, roles
- Add 'auth ok' info log after JWT validation passes
- Export ClaimString/ClaimStringSlice from identity package
- Log fields: subject, acting_party, roles/permissions, path, method
- Complements existing 'auth failed' error logs for full audit trail
|
2026-09-10 04:33:56 +09:00 |
|
  rockandpoimen
|
97707aa2f2
|
feat(identity): inject X-Forwarded-User headers after JWT validation (#15)
Closes homelab#9 (P3.4)
## Changes
- New `internal/identity` package: header injection + anti-spoofing
- `proxy.go`: strip spoofed headers on all requests, inject identity after JWT validation
## Headers
| Header | Source | When |
|--------|--------|------|
| X-Forwarded-User | sub claim | Always after JWT |
| X-Forwarded-Roles | roles or permissions claim | Always after JWT |
| X-Acting-Service | azp claim | Only when azp != sub |
| X-Auth-Verified | literal "true" | Always after JWT |
## Tests
13 tests, 93.9% coverage. Covers: spoofing, service accounts, human users, empty claims, nil values, wildcard, mixed types, precedence.
---------
Co-authored-by: Poimen <[email protected]>
Reviewed-on: #15
|
2026-09-08 23:08:39 +00:00 |
|