platform/tenant-registry
2
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

RBAC Phase 1: membership authority endpoint + fail-closed API auth #14

Merged
sharang merged 1 commits from feature/rbac-phase1-memberships into main 2026-08-24 18:21:48 +00:00
Conversation 0 Commits 1 Files Changed 14
+797 -7
sharang commented 2026-08-24 15:27:43 +00:00
Owner
Copy Link
Copy Source

Implements the model-B2 membership authority (ratified compliance auth design) and inbound token verification.

  • GET /v1/users/{id}/memberships: Keycloak supplies user->tenant links + org_roles (attribute projection until the realm migrates to Organizations); registered tenants override status/plan/products from registry tables (source: registry|keycloak). Closes the M5.2-deferred org_roles stub.
  • New internal/authn: OIDC discovery + JWKS verification (go-oidc/v3), audience tenant-registry. /healthz + /readyz stay PUBLIC_EXPLICIT; all other routes INTERNAL_SERVICE_ONLY. AUTH_ENABLED=true refuses to start on incomplete config (fail-closed); false (dev default) keeps current behavior.
  • Full suite green incl. postgres testcontainers; openapi.yaml updated (contract test passes).

Activation is a separate step (Auth-5): requires the orca-infra env merge and a portal service token (portal currently calls with no auth).

🤖 Generated with Claude Code

Implements the model-B2 membership authority (ratified compliance auth design) and inbound token verification. - GET /v1/users/{id}/memberships: Keycloak supplies user->tenant links + org_roles (attribute projection until the realm migrates to Organizations); registered tenants override status/plan/products from registry tables (source: registry|keycloak). Closes the M5.2-deferred org_roles stub. - New internal/authn: OIDC discovery + JWKS verification (go-oidc/v3), audience tenant-registry. /healthz + /readyz stay PUBLIC_EXPLICIT; all other routes INTERNAL_SERVICE_ONLY. AUTH_ENABLED=true refuses to start on incomplete config (fail-closed); false (dev default) keeps current behavior. - Full suite green incl. postgres testcontainers; openapi.yaml updated (contract test passes). Activation is a separate step (Auth-5): requires the orca-infra env merge and a portal service token (portal currently calls with no auth). 🤖 Generated with [Claude Code](https://claude.com/claude-code)
sharang added 1 commit 2026-08-24 15:27:44 +00:00
feat(auth): membership authority endpoint + fail-closed API auth (RBAC Phase 1)
ci / shared (pull_request) Failing after 12s
Details
ci / test (pull_request) Successful in 21m20s
Details
ci / image (pull_request) Skipped
Details
4a49c630d4 
GET /v1/users/{id}/memberships answers 'which tenants does this JWT
subject belong to, with which org_roles and entitlements' (ratified
auth design, model B2). Keycloak supplies user->tenant links and roles
via the Adapter (attribute projection until the realm migrates to
Organizations); registered tenants override status/plan/products from
registry tables.

New internal/authn verifies Keycloak bearer tokens (OIDC discovery +
JWKS, audience AUTH_EXPECTED_AUDIENCE, default tenant-registry). With
AUTH_ENABLED=true all routes except /healthz + /readyz require a token
and the server refuses to start if the verifier cannot initialize;
false (dev default) keeps the API open. Completes the M5.2-deferred
org_roles lookup and replaces the 'M4.3 adds JWT validation' TODO in
the spec.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
sharang merged commit ce75ed04c2 into main 2026-08-24 18:21:48 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
Benjamin_Boenisch sharang (Sharang Parnerkar)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: platform/tenant-registry#14