Admin Bot
8875f36dde
Replace the handwritten Authentik JWT checks with github.com/zitadel/zitadel-go/v3. What the SDK now owns: - OIDC discovery (client.Discover) to find issuer and JWKS URI - remote, auto-refreshing JWKS (rp.NewRemoteKeySet) - signature, expiry and issuer checks (op.NewAccessTokenVerifier, op.VerifyAccessToken) - the verified claim set and role lookup (oauth.IntrospectionContext, IsGrantedRole) What stays local: - a multi-audience allow-list, because this gateway is a shared resource server and the SDK's oauth.WithJWT accepts exactly one client ID - an adapter from IntrospectionContext to jwt.MapClaims so the rest of the gateway keeps one claim representation Other changes: - issuer is configuration-driven; the hardcoded authentik.riotpiao.com check is gone - aud may be a string or an array (ZITADEL sends an array) - CheckPermissions also reads urn:zitadel:iam:org:project:roles, the claim ZITADEL uses for project roles - requiredCapability accepts a comma-separated list, so llm:inference and llm-inference both satisfy the LLM gate - a five-segment token is reported as an encrypted JWE with the fix in the message, instead of failing as a bad signature Config: auth.zitadelDomain turns the SDK path on; jwksUrl stays supported for the legacy path and for tests.
22 lines
612 B
Go
22 lines
612 B
Go
package auth
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestValidateBearerToken_JWEGetsClearError(t *testing.T) {
|
|
ti := newTestIssuer(t)
|
|
host, port, _ := strings.Cut(strings.TrimPrefix(ti.server.URL, "http://"), ":")
|
|
v, err := NewZitadelValidator(t.Context(), ti.server.URL, nil, ZitadelConfig{
|
|
Domain: host, InsecurePort: port, HTTPClient: ti.server.Client(),
|
|
})
|
|
if err != nil {
|
|
t.Fatalf("NewZitadelValidator: %v", err)
|
|
}
|
|
_, err = v.ValidateBearerToken("Bearer a.b.c.d.e")
|
|
if err == nil || !strings.Contains(err.Error(), "encrypted JWE") {
|
|
t.Fatalf("expected a JWE-specific error, got %v", err)
|
|
}
|
|
}
|