# 3.1 — SQS: Gateway JWT validation against Authentik JWKS

Phase: 3 — Authentication & Authorization
Stage: TODO
Depends on: 8.2 (X-Service dispatcher), 8.10 (gate)

## Context

SQS (kmsvc management-service) has placeholder env vars for JWT validation:
- `KMSVC_AUTHENTIK_ISSUER_URL`
- `KMSVC_AUTHENTIK_AUDIENCE`

But **kmsvc code is unverified** — we don't know if it actually validates JWTs.
**Phase 8.2 decision**: Gateway validates SQS JWTs at ingress (not pushing to kmsvc).

## Requirements

- [ ] Gateway extracts `Authorization: Bearer <token>` from SQS requests
- [ ] Validates JWT signature against Authentik JWKS endpoint:
  - Issuer: `https://authentik.riotpiao.com/application/o/sqs/`
  - JWKS: `https://authentik.riotpiao.com/application/o/sqs/jwks/`
  - Algorithm: RS256 only (no alg confusion)
- [ ] Verifies claims:
  - `iss` matches expected issuer
  - `aud` equals `sqs`
  - `exp` not exceeded
  - `nbf` not in future (60s clock skew)
- [ ] Checks `permissions` claim contains `sqs:read` or `sqs:write` (or wildcard `*`)
- [ ] Returns 403 with details on validation failure
- [ ] Caches JWKS with 15min TTL, refreshes on `kid` miss (key rotation)
- [ ] Integration test: Get real JWT from Authentik, call SQS endpoint, confirm 200

## Implementation

1. Add JWT validator to `internal/auth/jwt.go` (was removed, restore as Phase 3 work)
2. Wire into `internal/serviceadapter/router.go` Dispatcher for SQS only
3. Update `k8s/configmap.yaml` SQS `auth.required: true` + capability check
4. Add test to `internal/serviceadapter/real_integration_test.go`

## Verification

```bash
# Get JWT from Authentik
export JWT=$(curl -s -X POST https://authentik.riotpiao.com/application/o/token/ \
  -d "grant_type=client_credentials&client_id=<id>&client_secret=<secret>&scope=openid" \
  | jq -r '.access_token')

# Should succeed
curl -w '%{http_code}' -H "Authorization: Bearer $JWT" \
  -H 'X-Service: sqs' -H 'X-Resource: send-message' \
  https://api.riotpiao.com/

# Should 403
curl -w '%{http_code}' -H 'X-Service: sqs' -H 'X-Resource: send-message' \
  https://api.riotpiao.com/
# expected: 403
```

## Notes

- **Not Phase 8.2**: Phase 8 was about routing & dispatcher architecture
- **Phase 3 scope**: Full auth integration & JWT validation
- **MinIO/Temporal**: Have native JWT support, tested in Phase 3 separately
- **Memory/IAM**: Services validate own JWTs (dumb pipe)