coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record authenticated caller in the decision envelope.
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 1m0s
Details

Browse source 
FLEX-WP-0023-T04: provenance.caller is additive (mode required;
principal/audience/not_after when a token was reviewed). TokenReview
keeps the JWT exp. request_digest is unchanged because the caller is
not binding material.

Assistant: grok
Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267
This commit is contained in:
tegwick 2026-09-14 04:44:07 +02:00
parent e62c0cfc36
commit ca070df32d
15 changed files with 344 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

10
cmd/flex-auth/main.go
View file

@ -388,11 +388,12 @@ func newServeMuxWithCallerAuth(engine *decisioncore.Engine, authenticator *calle
http.Error(w, err.Error(), http.StatusBadRequest)
return
}
if err := authenticator.Authorize(r.Context(), r.Header.Get("Authorization"), []string{request.Resource.System}); err != nil {
identity, err := authenticator.Authorize(r.Context(), r.Header.Get("Authorization"), []string{request.Resource.System})
if err != nil {
writeCallerAuthError(w, err)
return
}
decision, err := engine.Check(r.Context(), request)
decision, err := engine.Check(callerauth.WithRecord(r.Context(), authenticator.Record(identity)), request)
writeHTTP(w, decision, err)
})
mux.HandleFunc("/v1/batch_check", func(w http.ResponseWriter, r *http.Request) {
@ -409,11 +410,12 @@ func newServeMuxWithCallerAuth(engine *decisioncore.Engine, authenticator *calle
for _, resource := range request.Resources {
systems = append(systems, resource.System)
}
if err := authenticator.Authorize(r.Context(), r.Header.Get("Authorization"), systems); err != nil {
identity, err := authenticator.Authorize(r.Context(), r.Header.Get("Authorization"), systems)
if err != nil {
writeCallerAuthError(w, err)
return
}
decisions, err := engine.BatchCheck(r.Context(), request)
decisions, err := engine.BatchCheck(callerauth.WithRecord(r.Context(), authenticator.Record(identity)), request)
writeHTTP(w, decisions, err)
})
return mux

17
cmd/flex-auth/main_test.go
View file

@ -235,10 +235,25 @@ func TestServeCallerAuthenticationBindsSystemToPrincipal(t *testing.T) {
if err != nil {
t.Fatal(err)
}
resp.Body.Close()
if resp.StatusCode != http.StatusOK {
resp.Body.Close()
t.Fatalf("bound caller status = %d; want 200", resp.StatusCode)
}
var envelope api.DecisionEnvelope
if err := json.NewDecoder(resp.Body).Decode(&envelope); err != nil {
resp.Body.Close()
t.Fatalf("decode decision: %v", err)
}
resp.Body.Close()
if envelope.Provenance.Caller == nil || envelope.Provenance.Caller.Mode != "enforce" {
t.Fatalf("caller = %+v; want enforce", envelope.Provenance.Caller)
}
if envelope.Provenance.Caller.Principal != "system:serviceaccount:ops-warden:ops-warden" {
t.Fatalf("principal = %q", envelope.Provenance.Caller.Principal)
}
if envelope.Provenance.Caller.Audience != "flex-auth" {
t.Fatalf("audience = %q", envelope.Provenance.Caller.Audience)
}
wrong, _ := callerauth.New(callerauth.ModeEnforce, fixedTokenReviewer{identity: callerauth.Identity{
Username: "system:serviceaccount:another:caller",