Add audit trail for authenticated API requests. ## Changes - Add `auth ok` info log after JWT validation passes - Export `ClaimString`/`ClaimStringSlice` from identity package - Log fields: subject, acting_party, roles/permissions, path, method ## Log format ```json {"level":"info","message":"auth ok","extra":{"subject":"2213aa...","acting_party":"portfolio-agent","roles":"llm:inference,memory:read","path":"/v1/chat/completions","method":"POST"}} ``` ## Why Gateway only logged auth failures — no audit trail for who accessed LLM endpoints. Required for cluster access auditing. Complements existing X-Forwarded-User header injection (already complete). --------- Co-authored-by: poimen <[email protected]> Reviewed-on: #21
Closes homelab#9 (P3.4) ## Changes - New `internal/identity` package: header injection + anti-spoofing - `proxy.go`: strip spoofed headers on all requests, inject identity after JWT validation ## Headers | Header | Source | When | |--------|--------|------| | X-Forwarded-User | sub claim | Always after JWT | | X-Forwarded-Roles | roles or permissions claim | Always after JWT | | X-Acting-Service | azp claim | Only when azp != sub | | X-Auth-Verified | literal "true" | Always after JWT | ## Tests 13 tests, 93.9% coverage. Covers: spoofing, service accounts, human users, empty claims, nil values, wildcard, mixed types, precedence. --------- Co-authored-by: Poimen <[email protected]> Reviewed-on: #15
rockandpoimen
rockandpoimen
rockandpoimen
rockandpoimen