riotpiao-poimen/homelab-frontend
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(proxy): add /auth/token and /auth/refresh endpoints #18

Merged
rock merged 1 commits from feat/p3.1-auth-token into main 2026-09-09 00:00:16 +00:00
Conversation 0 Commits 1 Files Changed 3
+491
rock commented 2026-09-08 23:47:13 +00:00
Owner
Copy Link
Copy Source

Closes homelab#6 (P3.1) and homelab#8 (P3.3)

Endpoints

Path Method Body What it does
/auth/token POST {username, password, scope?} Password grant → JWT
/auth/refresh POST {refresh_token, scope?} Refresh grant → new JWT

Both proxy to Authentik tokenUrl (from P3.7 config). Upstream response forwarded verbatim — client sees Authentik errors directly.

Design

  • authClient interface extracted for testability (stub in tests, http.Client in prod)
  • No JWT validation on these endpoints (they issue tokens)
  • No credentials logged or leaked in responses
  • Default scope: openid roles permissions
  • 503 if tokenUrl/clientId not configured

Tests

15 tests: success, custom scope, missing username/password, invalid JSON, wrong HTTP method, not configured (503), upstream error (502), bad credentials forwarded (400), expired refresh (401), no credential leak.

Closes homelab#6 (P3.1) and homelab#8 (P3.3) ## Endpoints | Path | Method | Body | What it does | |------|--------|------|-------------| | `/auth/token` | POST | `{username, password, scope?}` | Password grant → JWT | | `/auth/refresh` | POST | `{refresh_token, scope?}` | Refresh grant → new JWT | Both proxy to Authentik `tokenUrl` (from P3.7 config). Upstream response forwarded verbatim — client sees Authentik errors directly. ## Design - `authClient` interface extracted for testability (stub in tests, `http.Client` in prod) - No JWT validation on these endpoints (they issue tokens) - No credentials logged or leaked in responses - Default scope: `openid roles permissions` - 503 if `tokenUrl`/`clientId` not configured ## Tests 15 tests: success, custom scope, missing username/password, invalid JSON, wrong HTTP method, not configured (503), upstream error (502), bad credentials forwarded (400), expired refresh (401), no credential leak.
rock added 1 commit 2026-09-08 23:47:15 +00:00
feat(proxy): add /auth/token and /auth/refresh endpoints
CI / CI (pull_request) Successful in 3m18s
Details
105eb7fc0a 
POST /auth/token: exchanges username+password for JWT via upstream
identity provider (grant_type=password).
POST /auth/refresh: exchanges refresh_token for new JWT.

Both proxy to Authentik token endpoint using config from P3.7.
Upstream responses forwarded verbatim. No credentials logged or
leaked in responses. authClient interface extracted for testability.

15 tests covering: success, custom scope, missing fields, invalid
JSON, wrong method, not configured, upstream error, credential
rejection, token expiry, no credential leak.

Closes homelab#6
Closes homelab#8

Co-authored-by: poimen <[email protected]>
rock merged commit a51c14426f into main 2026-09-09 00:00:16 +00:00
rock deleted branch feat/p3.1-auth-token 2026-09-09 00:00:34 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
area/auth
Authentication & authorization
 area/authentik
Authentik OIDC provider config
 area/downstream
Downstream service changes
 area/gateway
API gateway code
 priority/high
Must have
 priority/low
Nice to have
 priority/medium
Should have
 status/blocked
Blocked by dependency
 status/done
Completed
 status/in-progress
Currently being worked on
 status/review
Ready for review
 status/todo
Not started
 type/docs
Documentation
 type/feature
New feature
 type/infra
Infrastructure change
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
poimen rock (Rock)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: riotpiao-poimen/homelab-frontend#18