feat: JWT auth validation with Authentik OIDC

- Add jwt_validator module with JWKS caching (TTL + refresh-on-miss)
- Implement RS256 algorithm pinning + claim validation
- Replace apikey with Bearer token validation in http_server
- Add capability-based access control (memory:read/write/*)
- Backward compatible: MEM_AUTH_MODE=jwt|apikey (default: apikey)
- 16 tests passing (7 unit + 9 integration)
- Docs: JWT_AUTH.md with deployment guide

Config via env vars:
- MEM_AUTH_MODE=jwt
- AUTHENTIK_ISSUER=https://authentik.riotpiao.com/application/o/poimen-memory/
- AUTHENTIK_AUDIENCE=poimen-memory
- JWT_CACHE_TTL_SECS=3600 (optional)

Gw passes Authorization: Bearer <token> header
Memory validates + checks permissions claim

This commit is contained in:

Story Crater Bot

2026-08-27 12:29:23 -07:00

parent 82cc2c8310

commit 47e55afae3

9 changed files with 997 additions and 45 deletions

									
										crates/mem-cli/Cargo.toml
									
		+2
		
												View File
												
				@@ -36,3 +36,5 @@ sqlx = { workspace = true }

				pgvector = { workspace = true }

				base64 = { workspace = true }

				sha2 = { workspace = true }

				jsonwebtoken = { workspace = true }

				reqwest = { workspace = true }