homelab-frontend

Files

T

rock 8177f8b92f feat(proxy): add /auth/exchange token exchange endpoint

Closes homelab#10 (P3.5)

## Endpoint

`POST /auth/exchange` — RFC 8693-inspired token exchange.

## Flow

1. Validate `subject_token` (user JWT) via gateway's JWKS validator
2. Authenticate service via `client_credentials` against Authentik
3. Verify requested `scope` is subset of service's roles (deny escalation)
4. Return service token + subject identity metadata

## Request
```json
{"subject_token": "<user JWT>", "client_id": "portfolio-agent",
 "client_secret": "<secret>", "scope": "memory:read", "resource": "poimen-memory"}
```

## Response
```json
{"access_token": "<service JWT>", "subject": "user-hash",
 "acting_party": "portfolio-agent", "scope": "memory:read"}
```

2026-09-09 00:31:10 +00:00

auth

fix: accept multi-issuer JWTs from any Authentik provider (#1 )

2026-09-06 13:45:04 +00:00

config

feat(config): add tokenUrl, clientId, clientSecret to auth config (#17 )

2026-09-08 23:43:29 +00:00

identity

feat(identity): inject X-Forwarded-User headers after JWT validation (#15 )

2026-09-08 23:08:39 +00:00

logging

chore: initial commit of Go API gateway