riotpiao-poimen/homelab-frontend
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(serviceadapter): enforce JWT auth on X-Service dispatch #16

Merged
rock merged 1 commits from feat/p3.6-xservice-auth into main 2026-09-08 23:20:34 +00:00
Conversation 0 Commits 1 Files Changed 3
+370 -104
poimen commented 2026-09-08 23:14:39 +00:00
Member
Copy Link
Copy Source

Closes homelab#11 (P3.6)

Problem

SQS dispatcher hardcoded a JWT validator pointing at authentik.riotpiao.com/application/o/sqs/jwks/ — provider doesn't exist. Every SQS request got 403 regardless of token.

Fix

  • Replace sqsJWTAuth with shared multi-issuer validator (same one /v1/* uses)
  • Auth-required adapters: validate JWT, check <service>:read (GET) or <service>:write (POST)
  • Inject identity headers on success (reuses internal/identity from P3.4)
  • Auth-optional adapters: pass through unchanged
  • NewDispatcher now takes *auth.Validator parameter (nil = auth disabled)

Tests

10 new tests covering: missing headers, unknown service/resource, wrong verb, auth bypass when disabled, upstream proxying, header passthrough, capability mapping, identity header absence without auth.

Closes homelab#11 (P3.6) ## Problem SQS dispatcher hardcoded a JWT validator pointing at `authentik.riotpiao.com/application/o/sqs/jwks/` — provider doesn't exist. Every SQS request got 403 regardless of token. ## Fix - Replace `sqsJWTAuth` with shared multi-issuer validator (same one `/v1/*` uses) - Auth-required adapters: validate JWT, check `<service>:read` (GET) or `<service>:write` (POST) - Inject identity headers on success (reuses `internal/identity` from P3.4) - Auth-optional adapters: pass through unchanged - `NewDispatcher` now takes `*auth.Validator` parameter (nil = auth disabled) ## Tests 10 new tests covering: missing headers, unknown service/resource, wrong verb, auth bypass when disabled, upstream proxying, header passthrough, capability mapping, identity header absence without auth.
poimen added 1 commit 2026-09-08 23:14:42 +00:00
feat(serviceadapter): enforce JWT auth on X-Service dispatch
CI / CI (pull_request) Successful in 3m36s
Details
62c5cb0b86 
Replace hardcoded SQS-only validator (pointed at non-existent
sqs provider JWKS) with shared multi-issuer validator from proxy.

Auth-required adapters now validate JWT and check capability
(<service>:read for GET, <service>:write for POST). Identity
headers injected on success. Auth-optional adapters unchanged.

10 new tests, 69% package coverage.

Closes homelab#11

Co-authored-by: poimen <[email protected]>
rock merged commit 09318778fa into main 2026-09-08 23:20:34 +00:00
rock deleted branch feat/p3.6-xservice-auth 2026-09-08 23:20:55 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
area/auth
Authentication & authorization
 area/authentik
Authentik OIDC provider config
 area/downstream
Downstream service changes
 area/gateway
API gateway code
 priority/high
Must have
 priority/low
Nice to have
 priority/medium
Should have
 status/blocked
Blocked by dependency
 status/done
Completed
 status/in-progress
Currently being worked on
 status/review
Ready for review
 status/todo
Not started
 type/docs
Documentation
 type/feature
New feature
 type/infra
Infrastructure change
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
poimen rock (Rock)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: riotpiao-poimen/homelab-frontend#16