RBAC Phase 1: membership authority endpoint + fail-closed API auth #14

Merged

sharang merged 1 commits from feature/rbac-phase1-memberships into main

2026-08-24 18:21:48 +00:00

Author	SHA1	Message	Date
Sharang ParnerkarandClaude Fable 5	4a49c630d4	feat(auth): membership authority endpoint + fail-closed API auth (RBAC Phase 1) ci / shared (pull_request) Failing after 12s Details ci / test (pull_request) Successful in 21m20s Details ci / image (pull_request) Skipped Details GET /v1/users/{id}/memberships answers 'which tenants does this JWT subject belong to, with which org_roles and entitlements' (ratified auth design, model B2). Keycloak supplies user->tenant links and roles via the Adapter (attribute projection until the realm migrates to Organizations); registered tenants override status/plan/products from registry tables. New internal/authn verifies Keycloak bearer tokens (OIDC discovery + JWKS, audience AUTH_EXPECTED_AUDIENCE, default tenant-registry). With AUTH_ENABLED=true all routes except /healthz + /readyz require a token and the server refuses to start if the verifier cannot initialize; false (dev default) keeps the API open. Completes the M5.2-deferred org_roles lookup and replaces the 'M4.3 adds JWT validation' TODO in the spec. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-08-24 16:09:53 +02:00

Author

SHA1

Message

Date

Sharang ParnerkarandClaude Fable 5

4a49c630d4

feat(auth): membership authority endpoint + fail-closed API auth (RBAC Phase 1)

ci / shared (pull_request) Failing after 12s

Details

ci / test (pull_request) Successful in 21m20s

Details

ci / image (pull_request) Skipped

Details

GET /v1/users/{id}/memberships answers 'which tenants does this JWT
subject belong to, with which org_roles and entitlements' (ratified
auth design, model B2). Keycloak supplies user->tenant links and roles
via the Adapter (attribute projection until the realm migrates to
Organizations); registered tenants override status/plan/products from
registry tables.

New internal/authn verifies Keycloak bearer tokens (OIDC discovery +
JWKS, audience AUTH_EXPECTED_AUDIENCE, default tenant-registry). With
AUTH_ENABLED=true all routes except /healthz + /readyz require a token
and the server refuses to start if the verifier cannot initialize;
false (dev default) keeps the API open. Completes the M5.2-deferred
org_roles lookup and replaces the 'M4.3 adds JWT validation' TODO in
the spec.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-24 16:09:53 +02:00