riotpiao-poimen/homelab
2
0
Fork 0
Code Issues 9 Pull Requests Actions Packages Projects 1 Releases Wiki Activity

P3.1: Add /auth/token endpoint (password grant proxy) #6

New Issue
Open
opened 2026-09-08 04:40:45 +00:00 by rock · 0 comments
rock commented 2026-09-08 04:40:45 +00:00
Owner
Copy Link
Copy Source

Summary

Gateway exposes POST /auth/token accepting username+password, exchanges with Authentik via grant_type=password, returns JWT + refresh token.

Code repo: rock/homelab-frontend — internal/proxy/auth_endpoints.go

Acceptance Criteria

  • POST /auth/token accepts {"username":"...","password":"...","scope":"..."}
  • Proxies to Authentik token endpoint with grant_type=password
  • Returns {"access_token":"...","refresh_token":"...","expires_in":...,"token_type":"Bearer"}
  • Returns Authentik error verbatim on bad credentials (401)
  • No JWT validation on this endpoint itself
  • Config: auth.tokenUrl, auth.clientId, auth.clientSecret
  • Unit tests with mock Authentik responses

Depends on

  • P3.2, P3.7

Review checklist

  • No credentials logged (password, client_secret, tokens)
  • Rate limiting considered
  • Error responses use RFC 9457 problem detail format
## Summary Gateway exposes `POST /auth/token` accepting username+password, exchanges with Authentik via `grant_type=password`, returns JWT + refresh token. **Code repo:** `rock/homelab-frontend` — `internal/proxy/auth_endpoints.go` ## Acceptance Criteria - [ ] `POST /auth/token` accepts `{"username":"...","password":"...","scope":"..."}` - [ ] Proxies to Authentik token endpoint with `grant_type=password` - [ ] Returns `{"access_token":"...","refresh_token":"...","expires_in":...,"token_type":"Bearer"}` - [ ] Returns Authentik error verbatim on bad credentials (401) - [ ] No JWT validation on this endpoint itself - [ ] Config: `auth.tokenUrl`, `auth.clientId`, `auth.clientSecret` - [ ] Unit tests with mock Authentik responses ## Depends on - P3.2, P3.7 ## Review checklist - [ ] No credentials logged (password, client_secret, tokens) - [ ] Rate limiting considered - [ ] Error responses use RFC 9457 problem detail format
rock added this to the Phase 3: OAuth2 Token Exchange & Identity Propagation milestone 2026-09-08 04:40:45 +00:00
rock added the status/todoarea/autharea/gatewaypriority/hightype/feature labels 2026-09-08 04:40:46 +00:00
rock self-assigned this 2026-09-08 04:40:47 +00:00
rock added this to the API-GW OAuth project 2026-09-08 04:43:44 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
area/auth
Authentication & authorization
 area/authentik
Authentik OIDC provider config
 area/downstream
Downstream service changes
 area/gateway
API gateway code (homelab-frontend)
 priority/high
Must have
 priority/medium
Should have
 status/blocked
Blocked by dependency
 status/done
Completed
 status/in-progress
Currently being worked on
 status/review
Ready for review
 status/todo
Not started
 type/docs
Documentation
 type/feature
New feature
 type/infra
Infrastructure change
No labels area/auth area/gateway priority/high status/todo type/feature
Milestone
No items
No Milestone Phase 3: OAuth2 Token Exchange & Identity Propagation
Projects
Clear projects
No projects
API-GW OAuth
Backlog
Assignees
Clear assignees
poimen rock (Rock)
No Assignees rock
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: riotpiao-poimen/homelab#6