Documentation
¶
Overview ¶
Package auth handles inbound caller authentication for codex-app-gateway.
Phase 1 uses an HMAC-signed token of the form
<workspace_id>.<thread_id>.<hex-hmac-sha256>
where the HMAC covers `<workspace_id>\0<thread_id>` keyed by a deployment-shared secret. This matches the wstoken / internal-API pattern used elsewhere in agentserver and avoids pulling a JWT lib just for phase 1. Phase 2 can swap in a JWT impl behind the same `Authenticator` interface.
Package auth implements inbound bearer-token verification.
Phase 2 default is RemoteVerifier: each ws connect POSTs the supplied bearer to agentserver's /api/internal/codex/tokens/verify, which owns the codex_remote_tokens table and applies bcrypt + expiry + revocation policy. This couples the gateway to agentserver's lifecycle but keeps the gateway stateless.
HMACAuthenticator stays in the package as a break-glass / local-test implementation but is no longer used in chart-deployed pods.
Index ¶
Constants ¶
This section is empty.
Variables ¶
ErrUnauthorized is returned by Verify when agentserver responds 401. Distinguishable so handlers can map directly to HTTP 401 without leaking other error reasons (network failure → 500, etc.).
Functions ¶
Types ¶
type Authenticator ¶
Authenticator is the seam for inbound auth. Phase-1 impl is HMAC.
type HMAC ¶
type HMAC struct {
// contains filtered or unexported fields
}
HMAC is the phase-1 Authenticator.
func NewHMAC ¶
NewHMAC returns a phase-1 Authenticator. The secret must be non-empty for tokens to verify; an empty secret will still mint and verify against itself but represents a deployment misconfiguration.
func (*HMAC) Mint ¶
Mint produces a token for `(workspaceID, threadID)`. Useful for tests and CLI tools; production callers receive tokens from agentserver.
func (*HMAC) Verify ¶
Verify parses and HMAC-verifies a token.
Token format: <workspace_id>.<thread_id>.<hex-hmac>
Expects exactly 3 dot-separated parts. The legacy threadID portion (parts[1]) is intentionally discarded — Phase 2 carries identity via the UserID field populated by RemoteVerifier, not by the token payload.
type RemoteVerifier ¶ added in v0.50.0
type RemoteVerifier struct {
// contains filtered or unexported fields
}
RemoteVerifier delegates token verification to agentserver's internal API.
func NewRemoteVerifier ¶ added in v0.50.0
func NewRemoteVerifier(baseURL, bearer string) *RemoteVerifier
NewRemoteVerifier constructs a verifier targeting agentserver's internal HTTP API. baseURL is the http base (e.g. "http://release-agentserver.namespace.svc:8080"); bearer is the value of INTERNAL_API_SECRET used as the X-Internal-Secret header.
Source Files