4 Commits

Include renames

Author	SHA1	Message	Date
Admin Bot	139bc80529	refactor: dispatcher as dumb pipe + add gRPC detection for Temporal ... BREAKING CHANGE: Gateway no longer validates JWTs at dispatcher level. Each upstream service (MinIO, Authentik, Temporal) validates bearer tokens independently. Gateway passes Authorization header through unchanged. Changes: - Removed JWT validation from Dispatcher - Removed internal/auth JWT validator usage - Added gRPC URL scheme detection (grpc://) - Added temporal-frontend with gRPC config (returns 501 not-implemented) - All adapters now auth: required: false (services validate own tokens) - Gateway is now a transparent routing layer, not auth gateway gRPC forwarding requires grpcproxy middleware (future Phase 9). For now, gRPC clients should connect directly to temporal-frontend:7233.	2026-08-27 11:16:15 -07:00
Admin Bot	df33203a72	feat: add JWT validation against Authentik JWKS for protected adapters ... Replaces stub 'check Authorization header' auth with real JWT validation: - Extracts Bearer token from Authorization header - Validates signature against Authentik JWKS endpoint - Verifies iss, aud, exp claims - Checks permissions claim for required capability - Handles key rotation with 15min cache TTL - Returns 403 with detailed error on auth failure Protected adapters (memory, iam) now require valid Authentik JWT tokens.	2026-08-27 11:07:20 -07:00
Admin Bot	bd4cbbd0a3	feat: proxy requests to service adapter upstreams instead of echoing	2026-08-27 08:55:41 -07:00
Admin Bot	425611ec42	feat: phase 8 serviceadapter crd rollout (32/33 tasks)	2026-08-26 13:47:36 -07:00