# 3.2 — MinIO: Load-test native JWT/OIDC validation

Phase: 3 — Authentication & Authorization
Stage: TODO
Depends on: 8.2 (X-Service dispatcher), 8.10 (gate)

## Context

MinIO is configured for OIDC via `MINIO_IDENTITY_OPENID_*` env vars.
Per homelab/project-usage/jwt-auth-rollout.md: "likely yes, **not yet load-tested**".

**Phase 8.2 decision**: Gateway acts as dumb pipe, MinIO validates JWTs itself.

## Requirements

- [ ] MinIO validates JWT tokens from Authentik
  - Checks JWKS against `MINIO_IDENTITY_OPENID_CONFIG_URL`
  - Verifies `aud` claim (check current config)
  - Maps claims to MinIO policies
- [ ] Policy mapping works:
  - Authentik group `homelab-admins` → MinIO `consoleAdmin` policy
  - Other groups → appropriate S3 bucket access
- [ ] Integration test: Get JWT from Authentik, call S3 endpoint, confirm auth works
- [ ] Load test: 100+ requests/sec with valid JWTs succeed
- [ ] Performance: JWT validation doesn't add >50ms latency per request

## Implementation

1. Verify MinIO OIDC config in k8s/infra (not this repo)
2. Create JWT token with homelab-admins group
3. Test S3 operations (ListBuckets, GetObject, PutObject)
4. Add load test to integration suite

## Verification

```bash
export JWT=$(curl -s -X POST https://authentik.riotpiao.com/application/o/token/ \
  -d "grant_type=client_credentials&client_id=<id>&client_secret=<secret>&scope=openid" \
  | jq -r '.access_token')

# List buckets
aws s3 ls --endpoint-url https://api.riotpiao.com/ \
  --header "Authorization: Bearer $JWT"

# Get object
curl -H "Authorization: Bearer $JWT" \
  https://api.riotpiao.com/ \
  -H 'X-Service: s3' -H 'X-Resource: list-objects'
```

## Notes

- **Not Phase 8.2**: Phase 8 was routing, Phase 3 is auth verification
- **MinIO owner responsibility**: Verify config in k8s/infra cluster
- **Gateway responsibility**: Pass JWT through unchanged (dumb pipe)
- **Test coverage**: Real JWT token, real S3 operations