riotpiao-poimen/homelab-frontend
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(proxy): add /auth/exchange token exchange endpoint #19

Merged
rock merged 1 commits from feat/p3.5-token-exchange into main 2026-09-09 00:31:13 +00:00
Conversation 0 Commits 1 Files Changed 3
+448
rock commented 2026-09-09 00:05:38 +00:00
Owner
Copy Link
Copy Source

Closes homelab#10 (P3.5)

Endpoint

POST /auth/exchange — RFC 8693-inspired token exchange.

Flow

  1. Validate subject_token (user JWT) via gateway's JWKS validator
  2. Authenticate service via client_credentials against Authentik
  3. Verify requested scope is subset of service's roles (deny escalation)
  4. Return service token + subject identity metadata

Request

{"subject_token": "<user JWT>", "client_id": "portfolio-agent",
 "client_secret": "<secret>", "scope": "memory:read", "resource": "poimen-memory"}

Response

{"access_token": "<service JWT>", "subject": "user-hash",
 "acting_party": "portfolio-agent", "scope": "memory:read"}

Tests

14 tests: scope subset logic, JWT payload extraction, missing fields, invalid JSON, wrong method, not configured, scope escalation denial, claim helpers.

Closes homelab#10 (P3.5) ## Endpoint `POST /auth/exchange` — RFC 8693-inspired token exchange. ## Flow 1. Validate `subject_token` (user JWT) via gateway's JWKS validator 2. Authenticate service via `client_credentials` against Authentik 3. Verify requested `scope` is subset of service's roles (deny escalation) 4. Return service token + subject identity metadata ## Request ```json {"subject_token": "<user JWT>", "client_id": "portfolio-agent", "client_secret": "<secret>", "scope": "memory:read", "resource": "poimen-memory"} ``` ## Response ```json {"access_token": "<service JWT>", "subject": "user-hash", "acting_party": "portfolio-agent", "scope": "memory:read"} ``` ## Tests 14 tests: scope subset logic, JWT payload extraction, missing fields, invalid JSON, wrong method, not configured, scope escalation denial, claim helpers.
rock added 1 commit 2026-09-09 00:05:42 +00:00
feat(proxy): add /auth/exchange token exchange endpoint
CI / CI (pull_request) Successful in 3m38s
Details
c9ded315bc 
POST /auth/exchange: service presents user JWT + own credentials,
gets scoped service token with subject identity metadata.

Flow: validate subject token, authenticate service via
client_credentials, verify scope subset, return token + metadata.
Scope escalation denied if requested scope exceeds service roles.

14 tests covering: helpers, validation, missing fields, scope
subset, JWT decoding, edge cases.

Closes homelab#10

Co-authored-by: poimen <[email protected]>
rock merged commit 359645f397 into main 2026-09-09 00:31:13 +00:00
rock deleted branch feat/p3.5-token-exchange 2026-09-09 00:31:18 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
area/auth
Authentication & authorization
 area/authentik
Authentik OIDC provider config
 area/downstream
Downstream service changes
 area/gateway
API gateway code
 priority/high
Must have
 priority/low
Nice to have
 priority/medium
Should have
 status/blocked
Blocked by dependency
 status/done
Completed
 status/in-progress
Currently being worked on
 status/review
Ready for review
 status/todo
Not started
 type/docs
Documentation
 type/feature
New feature
 type/infra
Infrastructure change
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
poimen rock (Rock)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: riotpiao-poimen/homelab-frontend#19