Admin Bot
8a3a1c447c
Replace the handwritten Authentik JWT checks with github.com/zitadel/zitadel-go/v3. What the SDK now owns: - OIDC discovery (client.Discover) to find issuer and JWKS URI - remote, auto-refreshing JWKS (rp.NewRemoteKeySet) - signature, expiry and issuer checks (op.NewAccessTokenVerifier, op.VerifyAccessToken) - the verified claim set and role lookup (oauth.IntrospectionContext, IsGrantedRole) What stays local: - a multi-audience allow-list, because this gateway is a shared resource server and the SDK's oauth.WithJWT accepts exactly one client ID - an adapter from IntrospectionContext to jwt.MapClaims so the rest of the gateway keeps one claim representation Other changes: - issuer is configuration-driven; the hardcoded authentik.riotpiao.com check is gone - aud may be a string or an array (ZITADEL sends an array) - CheckPermissions also reads urn:zitadel:iam:org:project:roles, the claim ZITADEL uses for project roles - requiredCapability accepts a comma-separated list, so llm:inference and llm-inference both satisfy the LLM gate - a five-segment token is reported as an encrypted JWE with the fix in the message, instead of failing as a bad signature Config: auth.zitadelDomain turns the SDK path on; jwksUrl stays supported for the legacy path and for tests.
60 lines
2.4 KiB
AMPL
60 lines
2.4 KiB
AMPL
module forgejo.riotpiao.com/rock/homelab-frontend
|
|
|
|
go 1.26.0
|
|
|
|
require (
|
|
github.com/MicahParks/keyfunc/v2 v2.1.0
|
|
github.com/golang-jwt/jwt/v5 v5.3.1
|
|
github.com/google/uuid v1.6.0
|
|
github.com/zitadel/oidc/v3 v3.49.2
|
|
github.com/zitadel/zitadel-go/v3 v3.30.0
|
|
go.opentelemetry.io/otel v1.46.0
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.46.0
|
|
go.opentelemetry.io/otel/sdk v1.46.0
|
|
go.opentelemetry.io/otel/trace v1.46.0
|
|
go.temporal.io/api v1.63.5
|
|
go.temporal.io/sdk v1.48.0
|
|
golang.org/x/net v0.58.0
|
|
google.golang.org/grpc v1.83.2
|
|
google.golang.org/protobuf v1.36.12
|
|
gopkg.in/yaml.v3 v3.0.1
|
|
)
|
|
|
|
require (
|
|
github.com/bmatcuk/doublestar/v4 v4.10.0 // indirect
|
|
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
|
|
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
|
github.com/envoyproxy/protoc-gen-validate v1.3.3 // indirect
|
|
github.com/facebookgo/clock v0.0.0-20150410010913-600d898af40a // indirect
|
|
github.com/go-chi/chi/v5 v5.3.1 // indirect
|
|
github.com/go-jose/go-jose/v4 v4.1.4 // indirect
|
|
github.com/go-logr/logr v1.4.4 // indirect
|
|
github.com/go-logr/stdr v1.2.2 // indirect
|
|
github.com/gogo/protobuf v1.3.2 // indirect
|
|
github.com/golang/mock v1.6.0 // indirect
|
|
github.com/gorilla/securecookie v1.1.2 // indirect
|
|
github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.3 // indirect
|
|
github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 // indirect
|
|
github.com/muhlemmer/gu v0.3.1 // indirect
|
|
github.com/muhlemmer/httpforwarded v0.1.0 // indirect
|
|
github.com/nexus-rpc/nexus-proto-annotations v0.1.0 // indirect
|
|
github.com/nexus-rpc/sdk-go v0.7.0 // indirect
|
|
github.com/robfig/cron v1.2.0 // indirect
|
|
github.com/rs/cors v1.11.1 // indirect
|
|
github.com/stretchr/objx v0.5.3 // indirect
|
|
github.com/stretchr/testify v1.12.1 // indirect
|
|
github.com/zitadel/schema v1.3.2 // indirect
|
|
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.46.0 // indirect
|
|
go.opentelemetry.io/otel/metric v1.46.0 // indirect
|
|
go.opentelemetry.io/proto/otlp v1.11.0 // indirect
|
|
go.yaml.in/yaml/v3 v3.0.5 // indirect
|
|
golang.org/x/oauth2 v0.36.0 // indirect
|
|
golang.org/x/sync v0.22.0 // indirect
|
|
golang.org/x/sys v0.47.0 // indirect
|
|
golang.org/x/text v0.41.0 // indirect
|
|
golang.org/x/time v0.3.0 // indirect
|
|
google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688 // indirect
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 // indirect
|
|
)
|