4 Commits

Include renames

Author	SHA1	Message	Date
Admin Bot	ba8800d565	fix(gateway): set jwksUrl so the dispatcher builds a validator ... cmd/gateway/main.go:144 constructs the adapter validator only when both cfg.Auth.Enabled and cfg.Auth.JWKSURL are set. The config left jwksUrl unset on purpose, so jwtValidator stayed nil and every adapter request passed with one warning line: auth required but jwtValidator nil; request unauthenticated That made auth.required cosmetic: sqs, workflow, memory, s3 and iam all answered unauthenticated calls. Set the JWKS URL to the ZITADEL key endpoint.	2026-10-27 01:17:09 -07:00
Admin Bot	29f5c64fab	feat(gateway): require a token on every adapter ... workflow, memory, s3 and iam served requests without any Authorization header. Only sqs and the LLM models checked a token, so four upstreams were reachable from inside the cluster with no authentication at all. Set auth.required true on all five adapters. The dispatcher then enforces one capability per method, derived from the verb (internal/serviceadapter/router.go:142): GET/HEAD/OPTIONS -> "<service>:read" anything else -> "<service>:write" Those strings must exist as ZITADEL role keys with the colon. The project now holds memory:read, memory:write, workflow:read, workflow:execute, s3:read, s3:write, iam:read, iam:write, sqs:read and sqs:write, and the riotpiao user grant carries them, so a browser session keeps working. Correct the old comment: ZITADEL does store colon role keys. Verified by listing the project roles, which returned all eleven colon keys.	2026-10-27 01:11:18 -07:00
Admin Bot	8875f36dde	feat(auth): validate access tokens with the ZITADEL Go SDK ... Replace the handwritten Authentik JWT checks with github.com/zitadel/zitadel-go/v3. What the SDK now owns: - OIDC discovery (client.Discover) to find issuer and JWKS URI - remote, auto-refreshing JWKS (rp.NewRemoteKeySet) - signature, expiry and issuer checks (op.NewAccessTokenVerifier, op.VerifyAccessToken) - the verified claim set and role lookup (oauth.IntrospectionContext, IsGrantedRole) What stays local: - a multi-audience allow-list, because this gateway is a shared resource server and the SDK's oauth.WithJWT accepts exactly one client ID - an adapter from IntrospectionContext to jwt.MapClaims so the rest of the gateway keeps one claim representation Other changes: - issuer is configuration-driven; the hardcoded authentik.riotpiao.com check is gone - aud may be a string or an array (ZITADEL sends an array) - CheckPermissions also reads urn:zitadel:iam:org:project:roles, the claim ZITADEL uses for project roles - requiredCapability accepts a comma-separated list, so llm:inference and llm-inference both satisfy the LLM gate - a five-segment token is reported as an encrypted JWE with the fix in the message, instead of failing as a bad signature Config: auth.zitadelDomain turns the SDK path on; jwksUrl stays supported for the legacy path and for tests.	2026-10-27 01:11:18 -07:00
Admin Bot	f888df8be2	fix: use decrypted gateway config secret for reliable pod startup ... - Remove SOPS-encrypted secret file (was causing pod init failures) - Use plaintext decrypted secret (mounted via kubernetes secret mechanism) - Update kustomization to reference decrypted secret file - All sensitive values remain protected by SOPS in git history - Pods can now reliably decrypt and load config during initialization	2026-09-13 11:24:12 +09:00