Wire JWT validation into ServiceAdapter dispatcher. Currently auth.required: true on SQS adapter is ignored — and the existing SQS validator is broken.
The SQS dispatcher has a hardcodedsqsJWTAuth validator pointing at authentik.riotpiao.com/application/o/sqs/jwks/ — but no sqs provider exists in Authentik. Every SQS request gets 403 regardless of token validity.
Other X-Service adapters (memory, s3, iam) have auth.required: false and pass JWT through unchanged.
Fix required
Replace sqsJWTAuth hardcoded validator with the same multi-issuer validator used by /v1/* (accepts any Authentik provider)
After JWT validation, check roles claim for sqs:read (GET) / sqs:write (POST)
Apply same pattern to all adapters with auth.required: true
Checks roles claim for <service>:read/<service>:write
Returns 401/403 with RFC 9457 problem detail
Adapters with auth.required: false unchanged
Unit tests
Depends on
P3.4 (identity header injection)
## Summary
Wire JWT validation into ServiceAdapter dispatcher. Currently `auth.required: true` on SQS adapter is ignored — and the existing SQS validator is **broken**.
**Code repo:** `rock/homelab-frontend` — `internal/serviceadapter/router.go`
## Current state (verified 2026-09-08)
The SQS dispatcher has a **hardcoded** `sqsJWTAuth` validator pointing at `authentik.riotpiao.com/application/o/sqs/jwks/` — but no `sqs` provider exists in Authentik. Every SQS request gets 403 regardless of token validity.
Other X-Service adapters (`memory`, `s3`, `iam`) have `auth.required: false` and pass JWT through unchanged.
## Fix required
1. Replace `sqsJWTAuth` hardcoded validator with the **same multi-issuer validator** used by `/v1/*` (accepts any Authentik provider)
2. After JWT validation, check `roles` claim for `sqs:read` (GET) / `sqs:write` (POST)
3. Apply same pattern to all adapters with `auth.required: true`
4. Inject X-Forwarded-User headers (reuse P3.4 logic)
## Test results from audit
```
portfolio-agent (roles: [sqs:read]) -> X-Service: sqs -> 403 (BROKEN)
memory-agent (roles: [sqs:read/write]) -> X-Service: sqs -> 403 (BROKEN)
```
## Acceptance Criteria
- [ ] Dispatcher uses multi-issuer validator (not provider-specific)
- [ ] Checks `roles` claim for `<service>:read`/`<service>:write`
- [ ] Returns 401/403 with RFC 9457 problem detail
- [ ] Adapters with `auth.required: false` unchanged
- [ ] Unit tests
## Depends on
- P3.4 (identity header injection)
rock
added this to the Phase 3: OAuth2 Token Exchange & Identity Propagation milestone 2026-09-08 04:42:44 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
Wire JWT validation into ServiceAdapter dispatcher. Currently
auth.required: trueon SQS adapter is ignored — and the existing SQS validator is broken.Code repo:
rock/homelab-frontend—internal/serviceadapter/router.goCurrent state (verified 2026-09-08)
The SQS dispatcher has a hardcoded
sqsJWTAuthvalidator pointing atauthentik.riotpiao.com/application/o/sqs/jwks/— but nosqsprovider exists in Authentik. Every SQS request gets 403 regardless of token validity.Other X-Service adapters (
memory,s3,iam) haveauth.required: falseand pass JWT through unchanged.Fix required
sqsJWTAuthhardcoded validator with the same multi-issuer validator used by/v1/*(accepts any Authentik provider)rolesclaim forsqs:read(GET) /sqs:write(POST)auth.required: trueTest results from audit
Acceptance Criteria
rolesclaim for<service>:read/<service>:writeauth.required: falseunchangedDepends on
Closed by homelab-frontend PR #16: riotpiao-poimen/homelab-frontend#16