rock
db79ea8ffd
CI / CI (pull_request) Canceled after 0s
Full auth chain for entity extraction via api.riotpiao.com:
1. HTTP request → ingest_handler captures X-Forward-User header
2. Passes to execute_ingest → spawn worker with x_forward_user param
3. Worker calls process_ingest_with_auth → passes to pipeline
4. Pipeline.ingest_with_auth → passes to extractor
5. LlmEntityExtractor.extract_with_auth → calls LLM with auth
Auth priority (per API Gateway spec):
1. X-Forward-User header (API Gateway passthrough)
2. Authentik JWT via jwt_issuer (service account)
3. LLM_API_KEY env var (fallback)
Error handling:
✓ HTTP 403 JWT validation failed → returns error (not empty array)
✓ LLM extraction failures logged with full context
✓ Graceful fallback to mock response on explicit error
Integration with homelab-frontend/API.md:
✓ Supports Bearer token auth (Authentik JWT)
✓ Supports X-Forward-User header (gateway pattern)
✓ Proper error responses (RFC 9457 problem details)
✓ No more silent failures (403 errors now propagate)
Next: Deploy to K8s with proper JWT secrets
Test with actual X-Forward-User from gateway
Monitor LLM extraction success rate