# 3.3 — Temporal: Configure native JWT validation via jwtKeyProvider

Phase: 3 — Authentication & Authorization
Stage: TODO
Depends on: 8.2 (X-Service dispatcher), 8.10 (gate)

## Context

Temporal Helm chart supports native JWT authorization:
- `server.config.authorization.jwtKeyProvider` 
- `claimMapper` for custom claim handling

Per homelab/project-usage/jwt-auth-rollout.md: "native JWT authorization support".
But currently **not configured** — unresolved design question on external access.

**Phase 8.2 decision**: Gateway detects gRPC (returns 501 not-implemented).
Phase 9 will add gRPC proxy. Phase 3 can configure JWT validation in Temporal.

## Requirements

- [ ] Configure `server.config.authorization.jwtKeyProvider` in Temporal Helm values
  - Point at Authentik JWKS: `https://authentik.riotpiao.com/application/o/workflow/jwks/`
- [ ] Configure `claimMapper` to translate Authentik claims:
  - `permissions` claim → Temporal permissions
  - OR `groups` claim → Temporal role mappings
- [ ] Test: In-cluster worker with JWT can connect to Temporal frontend
- [ ] Test: Unauthenticated client gets 401
- [ ] Verify: No impact on existing workers/clients (backward compat)

## Implementation

1. Update k8s/infra temporal-values.yaml:
   ```yaml
   server:
     config:
       authorization:
         jwtKeyProvider:
           keySourceURIs:
             - "https://authentik.riotpiao.com/application/o/workflow/jwks/"
         claimMapper: |
           # Custom claims mapping (TBD)
   ```
2. Deploy & test
3. Add integration test (requires gRPC client, Phase 9)

## Verification

```bash
# In-cluster test (Pod with JWT)
kubectl -n temporal run --rm -it temporal-test \
  --image=temporalioservices/temporal-server:latest \
  -- tctl --address temporal-frontend:7233 namespace list

# External test (Phase 9, requires gRPC proxy)
# grpcurl -H "Authorization: Bearer $JWT" \
#   temporal-frontend.cluster.local:7233 \
#   temporal.api.workflowservice.v1.WorkflowService/ListNamespaces
```

## Notes

- **Not Phase 8.2**: Routing is done, auth config is Phase 3+
- **Temporal owner responsibility**: Configure JWT in temporal-values.yaml (k8s/infra)
- **Gateway responsibility**: Pass gRPC through (Phase 9: grpcproxy)
- **Open question**: External access to Temporal frontend (TBD)