coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record authenticated caller in the decision envelope.
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 1m0s
Details

Browse source 
FLEX-WP-0023-T04: provenance.caller is additive (mode required;
principal/audience/not_after when a token was reviewed). TokenReview
keeps the JWT exp. request_digest is unchanged because the caller is
not binding material.

Assistant: grok
Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267
This commit is contained in:
tegwick 2026-09-14 04:44:07 +02:00
parent e62c0cfc36
commit ca070df32d
15 changed files with 344 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

43
internal/callerauth/auth_test.go
View file

@ -6,6 +6,7 @@ import (
"fmt"
"strings"
"testing"
"time"
)
type fakeReviewer struct {
@ -27,10 +28,10 @@ func TestAuthenticatorEnforcesAudienceAndSystemBinding(t *testing.T) {
if err != nil {
t.Fatal(err)
}
if err := authenticator.Authorize(context.Background(), "Bearer caller-token", []string{"tenant-engine"}); err != nil {
if _, err := authenticator.Authorize(context.Background(), "Bearer caller-token", []string{"tenant-engine"}); err != nil {
t.Fatalf("Authorize: %v", err)
}
if err := authenticator.Authorize(context.Background(), "Bearer caller-token", []string{"user-engine"}); !errors.Is(err, ErrForbidden) {
if _, err := authenticator.Authorize(context.Background(), "Bearer caller-token", []string{"user-engine"}); !errors.Is(err, ErrForbidden) {
t.Fatalf("system mismatch error = %v; want forbidden", err)
}
@ -38,7 +39,7 @@ func TestAuthenticatorEnforcesAudienceAndSystemBinding(t *testing.T) {
Username: "system:serviceaccount:tenant-engine:tenant-engine",
Audiences: []string{"kubernetes"},
}}, "flex-auth", map[string]string{"tenant-engine": "system:serviceaccount:tenant-engine:tenant-engine"}, nil)
if err := wrongAudience.Authorize(context.Background(), "Bearer caller-token", []string{"tenant-engine"}); !errors.Is(err, ErrUnauthenticated) {
if _, err := wrongAudience.Authorize(context.Background(), "Bearer caller-token", []string{"tenant-engine"}); !errors.Is(err, ErrUnauthenticated) {
t.Fatalf("audience error = %v; want unauthenticated", err)
}
}
@ -46,17 +47,17 @@ func TestAuthenticatorEnforcesAudienceAndSystemBinding(t *testing.T) {
func TestAuthenticatorRejectsMissingTokenAndReviewerFailure(t *testing.T) {
bindings := map[string]string{"tenant-engine": "principal"}
authenticator, _ := New(ModeEnforce, fakeReviewer{identity: Identity{Username: "principal", Audiences: []string{"flex-auth"}}}, "flex-auth", bindings, nil)
if err := authenticator.Authorize(context.Background(), "", []string{"tenant-engine"}); !errors.Is(err, ErrUnauthenticated) {
if _, err := authenticator.Authorize(context.Background(), "", []string{"tenant-engine"}); !errors.Is(err, ErrUnauthenticated) {
t.Fatalf("missing token error = %v; want unauthenticated", err)
}
unavailable, _ := New(ModeEnforce, fakeReviewer{err: errors.New("apiserver down")}, "flex-auth", bindings, nil)
if err := unavailable.Authorize(context.Background(), "Bearer token", []string{"tenant-engine"}); !errors.Is(err, ErrUnavailable) {
if _, err := unavailable.Authorize(context.Background(), "Bearer token", []string{"tenant-engine"}); !errors.Is(err, ErrUnavailable) {
t.Fatalf("reviewer error = %v; want unavailable", err)
}
rejected, _ := New(ModeEnforce, fakeReviewer{err: fmt.Errorf("%w: invalid bearer token", ErrUnauthenticated)}, "flex-auth", bindings, nil)
if err := rejected.Authorize(context.Background(), "Bearer malformed", []string{"tenant-engine"}); !errors.Is(err, ErrUnauthenticated) {
if _, err := rejected.Authorize(context.Background(), "Bearer malformed", []string{"tenant-engine"}); !errors.Is(err, ErrUnauthenticated) {
t.Fatalf("rejected token error = %v; want unauthenticated", err)
}
}
@ -69,10 +70,38 @@ func TestAuthenticatorWarnModePermitsButRecordsFailure(t *testing.T) {
if err != nil {
t.Fatal(err)
}
if err := authenticator.Authorize(context.Background(), "", []string{"tenant-engine"}); err != nil {
if _, err := authenticator.Authorize(context.Background(), "", []string{"tenant-engine"}); err != nil {
t.Fatalf("warn mode returned error: %v", err)
}
if !strings.Contains(warning, "warning") {
t.Fatalf("warning = %q", warning)
}
}
func TestAuthenticatorWarnModeKeepsObservedPrincipal(t *testing.T) {
authenticator, err := New(ModeWarn, fakeReviewer{identity: Identity{
Username: "system:serviceaccount:other:caller",
Audiences: []string{"flex-auth"},
NotAfter: time.Unix(1788730498, 0).UTC(),
}}, "flex-auth", map[string]string{
"tenant-engine": "system:serviceaccount:tenant-engine:tenant-engine",
}, func(string, ...any) {})
if err != nil {
t.Fatal(err)
}
identity, err := authenticator.Authorize(context.Background(), "Bearer caller-token", []string{"tenant-engine"})
if err != nil {
t.Fatalf("warn mode returned error: %v", err)
}
record := authenticator.Record(identity)
if record.Mode != ModeWarn || record.Principal != "system:serviceaccount:other:caller" {
t.Fatalf("record = %+v; want warn with observed principal", record)
}
}
func TestDisabledRecordStatesAbsence(t *testing.T) {
record := Disabled().Record(Identity{Username: "ignored"})
if record.Mode != ModeDisabled || record.Principal != "" {
t.Fatalf("disabled record = %+v; want mode only", record)
}
}