CTO (Paperclip)
|
9f1eb84032
|
admin-api: Pocket-ID session-cookie verifier (OIDC Authorization-Code + PKCE, JWKS, group check)
validate / Go (vet + test) (push) Successful in 23s
validate / Rego (opa fmt + opa test) (push) Successful in 15s
validate / JSON Schema (ajv) (push) Successful in 20s
- internal/auth/pocket_id.go: Middleware mit /login + /callback,
OIDC-Discovery + JWKS-Cache, RS256-Signatur-Prüfung, PKCE S256,
AES-256-GCM-versiegeltes Session-Cookie, Erzwingung von
Gruppenmitgliedschaft 'proofedmesh-admin' (konfigurierbar).
Protect(h) setzt WithPrincipal(sub) + WithSession(sid) auf ctx;
fehlendes/ungültiges Cookie → 302 nach /login (next= bewahrt).
- internal/auth/context.go: WithPrincipal/WithSession/PrincipalFrom
/SessionFrom aus httpapi/rates.go in internal/auth gezogen,
damit auth und httpapi dieselben Kontext-Keys teilen (keine
import cycle: httpapi importiert auth).
- httpapi/rates.go: delegiert jetzt an auth.*; die Shim-Exports
WithPrincipal/WithSession bleiben für bestehende Tests.
- cmd/admin-api/main.go: Pocket-ID-Middleware aktivieren, sobald
-oidc-client-id, -oidc-client-secret, -oidc-redirect-url und
-session-cookie-secret gesetzt sind; ohne sie bleibt das
Stub-Admin-Prinzipal (bestehendes Verhalten für Dev-Mode).
- Tests (10 neue, 36/36 insgesamt grün, go vet clean):
httptest-Mock-Pocket-ID mit JWKS + /token-Endpoint deckt den
vollständigen Flow ab, inkl. missing cookie, falsche Gruppe,
Nonce/State-Mismatch, Audience-Mismatch, abgelaufenes ID-Token,
unbekannte kid, und Session-Ablauf nach TTL.
- README: Auth-Abschnitt + Konfigurations-Flags aktualisiert.
DEV-603
Co-Authored-By: Paperclip <noreply@paperclip.ing>
|
2026-10-25 18:10:02 +00:00 |
|
CTO (Paperclip)
|
be3ac9cdb8
|
admin-api: Pocket-ID client_credentials TokenSource with OIDC discovery + cache (replaces StaticToken in prod)
validate / JSON Schema (ajv) (push) Successful in 20s
validate / Go (vet + test) (push) Successful in 19s
validate / Rego (opa fmt + opa test) (push) Successful in 13s
* services/admin-api/internal/attest/pocket_id_token_source.go — attest.TokenSource impl: OIDC discovery via /.well-known/openid-configuration, HTTP Basic client_credentials grant, mutex-guarded in-memory token cache with configurable RefreshLeeway (default 30s = "verwirft bei exp-30s" from DEV-602).
* services/admin-api/internal/attest/pocket_id_token_source_test.go — 10 subtests against an httptest OIDC mock: happy path, cache hold, exp-30s refresh boundary, optional scope/audience, bad creds (401), missing config, discovery failures, non-positive expires_in, type-conformance.
* services/admin-api/cmd/admin-api/main.go — buildTokenSource(): -bearer flag wins (dev), else -oidc-issuer + POCKET_ID_CLIENT_ID + POCKET_ID_CLIENT_SECRET env → PocketIDTokenSource (prod); hard-fail at startup if issuer is set but credentials are missing. New flags -pocket-id-scope / -pocket-id-audience for the client_credentials request.
* services/admin-api/README.md — split inbound/outbound Pocket-ID auth, document the admin-api OIDC client registration (UI + API), new flags, env vars, prod bootstrap example.
36/36 go tests pass, go vet clean.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
|
2026-10-25 18:04:00 +00:00 |
|