riotpiao-poimen/homelab-frontend
2
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

fix: check scope claim for client_credentials JWT auth #27

Closed
rock wants to merge 2 commits from fix/client-credentials-scope-auth into main
pull from: fix/client-credentials-scope-auth
merge into: :main
Conversation 0 Commits 2 Files Changed 15
+971 -13
rock commented 2026-09-13 23:18:29 +00:00
Owner
Copy Link
Copy Source

Authentik client_credentials tokens carry capabilities as space-separated scope values, not in roles/permissions claims. Gateway now checks scope claim as fallback.

Enables paperless-ai and other service accounts to call LLM API through gateway with proper JWT auth.

Authentik client_credentials tokens carry capabilities as space-separated scope values, not in roles/permissions claims. Gateway now checks scope claim as fallback. Enables paperless-ai and other service accounts to call LLM API through gateway with proper JWT auth.
rock added 2 commits 2026-09-13 23:18:31 +00:00
feat(network): SSE optimization for local LLM streaming (#31 #32 #33)
CI / CI (pull_request) Successful in 3m11s
Details
cc9a32f53a 
Addresses three critical network issues for LLM streaming performance:

**#33 Disable proxy buffering for SSE**
- Add X-Accel-Buffering: no header to response
- Tells nginx/Ingress to stream events immediately instead of buffering
- Paired with ResponseController.Flush() for unbuffered token delivery

**#32 HTTP/2 multiplexing for concurrent streams**
- Enable HTTP/2 in server config via http2.ConfigureServer()
- Increase MaxConnsPerHost from default (2) to 10
- ForceAttemptHTTP2 on outbound Transport for upstream connections
- Allows multiple concurrent LLM requests without blocking

**#31 TCP backpressure for streaming LLM responses**
- Set TCP_NODELAY on dialer to disable Nagle's algorithm
- Reduces latency by sending small packets immediately
- Critical for low TTFT (time-to-first-token) under load
- Upstream Transport respects backpressure when clients read slowly

**Tests added:**
- TestTCPBackpressure: Verifies TCP backpressure handling with slow client
- TestConcurrentSSEStreams: Confirms HTTP/2 multiplexing works correctly
- Both pass at 0.11s and 0.06s respectively

Fixes all three streaming performance issues in one coherent change.
fix: check scope claim for client_credentials JWT auth
CI / CI (pull_request) Successful in 3m11s
Details
db09d546e0 
Authentik client_credentials tokens don't carry roles/permissions claims
(scope mappings not evaluated). Capabilities are carried as space-separated
scope values instead. Gateway now checks scope claim as fallback after
roles and permissions.
rock closed this pull request 2026-09-13 23:55:33 +00:00

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
area/auth
Authentication & authorization
 area/authentik
Authentik OIDC provider config
 area/downstream
Downstream service changes
 area/gateway
API gateway code
 priority/high
Must have
 priority/low
Nice to have
 priority/medium
Should have
 status/blocked
Blocked by dependency
 status/done
Completed
 status/in-progress
Currently being worked on
 status/review
Ready for review
 status/todo
Not started
 type/docs
Documentation
 type/feature
New feature
 type/infra
Infrastructure change
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
poimen rock (Rock)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: riotpiao-poimen/homelab-frontend#27