rock/homelab-frontend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
68 Commits 1 Branch 2 Tags
f9addf945d58c9ff6108f6e583d8c44ca84ae01a
Commit Graph
4 Commits
Author SHA1 Message Date
Admin Bot e1a5aca7d6 fix: Lazy-load JWKS in JWT validator + add unit tests
CI / Vet, test, build (push) Successful in 2m14s
Details
CI / Build and push image (push) Failing after 13s
Details 
Changes:
- Make JWT validator lazy-load JWKS on first use (not on init)
- Thread-safe JWKS loading with mutex
- Fixes test failures (JWKS 404 was panicking on NewValidator)
- Add unit tests for JWT validation logic

Tests now pass:
  ✅ Check permissions (sqs:read, sqs:write, wildcard)
  ✅ Reject empty/invalid/malformed tokens
  ✅ Handle missing permissions claim

All 100% passing with no external dependencies.
 2026-08-27 15:13:49 -07:00
Admin Bot 9d9395d938 feat: Phase 3.1 - SQS JWT validation against Authentik JWKS
CI / Vet, test, build (push) Successful in 2m4s
Details
CI / Build and push image (push) Failing after 18s
Details 
Implements gateway-level JWT validation for SQS requests:
- Validates JWT signature against Authentik JWKS
- Verifies claims: iss, aud, exp, nbf (with 60s skew)
- Checks 'permissions' claim for sqs:read/sqs:write/wildcard
- Returns 403 with error details on validation failure
- JWKS caching with 15min TTL and auto-refresh on key rotation

Architecture:
- SQS: Gateway validates JWT (kmsvc code unverified)
- MinIO, Temporal: Native JWT support (pass-through)
- Memory, IAM: Service-owned JWT validation

Integration tests added:
- Reject requests without Authorization header (403)
- Accept requests with valid JWT from Authentik
- Pass through Authorization header unchanged for other services

Uses github.com/MicahParks/keyfunc/v2 for JWKS handling:
- Automatic refresh every 15 minutes
- On-demand refresh if kid not found
- Handles RS256 signatures
 2026-08-27 11:40:35 -07:00
Admin Bot 8dfd17127b chore: remove unused internal/auth package
CI / Vet, test, build (push) Canceled after 55s
Details
CI / Build and push image (push) Canceled after 0s
Details 
JWT validation moved to individual services (Option B).
Gateway no longer needs auth module.
 2026-08-27 11:16:40 -07:00
Admin Bot df33203a72 feat: add JWT validation against Authentik JWKS for protected adapters
CI / Vet, test, build (push) Successful in 2m4s
Details
CI / Build and push image (push) Successful in 50s
Details 
Replaces stub 'check Authorization header' auth with real JWT validation:
- Extracts Bearer token from Authorization header
- Validates signature against Authentik JWKS endpoint
- Verifies iss, aud, exp claims
- Checks permissions claim for required capability
- Handles key rotation with 15min cache TTL
- Returns 403 with detailed error on auth failure

Protected adapters (memory, iam) now require valid Authentik JWT tokens.
 2026-08-27 11:07:20 -07:00