lab/authz-bridge
1
0
Fork 0
Code Issues 9 Pull requests 6 Projects Releases Packages Wiki Activity Actions 12

Build surface (flow-serving server scaffolding) #21

Merged
ginjiruu merged 2 commits from feat/build-surface into master 2026-09-14 21:39:59 +00:00
Conversation 0 Commits 2 Files changed 13 +793 -6
ginjiruu commented 2026-09-14 21:33:17 +00:00
Owner
Copy link

Closes #12

The Bridge's flow-serving foundation: the single binary runs the three
listeners — a gRPC ext_authz Check service on :8083 (OIDC) and
:8084 (Exchange), and a plain-HTTP listener on :8082
(callback/logout) — all wired into the manager and consuming the
per-replica Snapshot, with the ext_authz proto and a JWT/JWKS
library in place. Nothing protocol-specific yet: a Check returns a
stub OK; a :8082 request returns a stub. This makes "the servers
exist, are wired, and read the Snapshot" true, unblocking every flow
ticket.

What's in it

  • internal/serve — the Server manager runnable (three listeners;
    one failing stops all; clean shutdown on ctx done;
    NeedLeaderElection()==false so every replica serves, like the
    mirror). The gRPC Check resolves the App by the request's Host via
    AppForHostname (the resolution path the Flows use) and returns the
    stub OK (status code 0); the HTTP listener returns the stub. The
    serving path reads only SnapshotProvider.Current() (a lock-free
    pointer load) — no K8s API read.
  • internal/jwt — Verify: the ES256 signature against the JWKS
    (matched by kid; the ES256-only algorithm whitelist defeats an
    algorithm-confusion forgery) plus the exp/iss/aud claim
    checks; returns the typed claims plus the raw claim map for the
    claim→header injection. No hand-rolled crypto — go-jose does the
    signature/key handling.
  • cmd/main.go — the Server is added to the manager (sharing
    the mirror's Snapshot), with --oidc-bind-address /
    --exchange-bind-address / --callback-bind-address flags
    (defaults :8083 / :8084 / :8082).
  • Dependencies — envoyproxy/go-control-plane (the envoy
    module; the envoy/service/auth/v3 Check proto) and
    go-jose/go-jose/v4 are direct dependencies.
  • Tests — the spec's Seam A in-process pattern: the Server
    driven against a constructed Snapshot (the pure snapshot builder)
    on ephemeral ports, asserting the CheckResponse status, the HTTP
    response, the Snapshot read count, and the fail-on-bound-address /
    shutdown behavior; jwt.Verify against a generated ES256 key (token
    signed with go-jose, public key in the JWKS).

Verification

  • GOTOOLCHAIN=go1.26.0 make lint — 0 issues
  • GOTOOLCHAIN=go1.26.0 make test — all packages pass
  • go build ./... — clean
Closes #12 The Bridge's flow-serving foundation: the single binary runs the three listeners — a gRPC `ext_authz` `Check` service on `:8083` (OIDC) and `:8084` (Exchange), and a plain-HTTP listener on `:8082` (callback/logout) — all wired into the manager and consuming the per-replica Snapshot, with the `ext_authz` proto and a JWT/JWKS library in place. Nothing protocol-specific yet: a `Check` returns a stub `OK`; a `:8082` request returns a stub. This makes "the servers exist, are wired, and read the Snapshot" true, unblocking every flow ticket. ## What's in it - **`internal/serve`** — the `Server` manager runnable (three listeners; one failing stops all; clean shutdown on ctx done; `NeedLeaderElection()==false` so every replica serves, like the mirror). The gRPC `Check` resolves the App by the request's Host via `AppForHostname` (the resolution path the Flows use) and returns the stub OK (status code 0); the HTTP listener returns the stub. The serving path reads only `SnapshotProvider.Current()` (a lock-free pointer load) — no K8s API read. - **`internal/jwt`** — `Verify`: the ES256 signature against the JWKS (matched by kid; the ES256-only algorithm whitelist defeats an algorithm-confusion forgery) plus the `exp`/`iss`/`aud` claim checks; returns the typed claims plus the raw claim map for the claim→header injection. No hand-rolled crypto — go-jose does the signature/key handling. - **`cmd/main.go`** — the `Server` is added to the manager (sharing the mirror's Snapshot), with `--oidc-bind-address` / `--exchange-bind-address` / `--callback-bind-address` flags (defaults `:8083` / `:8084` / `:8082`). - **Dependencies** — `envoyproxy/go-control-plane` (the `envoy` module; the `envoy/service/auth/v3` `Check` proto) and `go-jose/go-jose/v4` are direct dependencies. - **Tests** — the spec's Seam A in-process pattern: the `Server` driven against a constructed `Snapshot` (the pure snapshot builder) on ephemeral ports, asserting the `CheckResponse` status, the HTTP response, the Snapshot read count, and the fail-on-bound-address / shutdown behavior; `jwt.Verify` against a generated ES256 key (token signed with go-jose, public key in the JWKS). ## Verification - `GOTOOLCHAIN=go1.26.0 make lint` — 0 issues - `GOTOOLCHAIN=go1.26.0 make test` — all packages pass - `go build ./...` — clean
add build surface: flow-serving servers, jwt verify, manager wiring
Some checks failed
Lint / Run on Ubuntu (push) Has been cancelled
Details
E2E Tests / Run on Ubuntu (push) Has been cancelled
Details
Tests / Run on Ubuntu (push) Has been cancelled
Details
Lint / Run on Ubuntu (pull_request) Has been cancelled
Details
E2E Tests / Run on Ubuntu (pull_request) Has been cancelled
Details
Tests / Run on Ubuntu (pull_request) Has been cancelled
Details
182ca961c2 
The single binary now runs the three flow-serving listeners on top of
the per-replica Snapshot (no K8s API read on the serving path):

- gRPC ext_authz Check on :8083 (OIDC) and :8084 (Exchange) return
  the stub OK (status code 0), resolving the App by the request's
  Host via AppForHostname (the resolution path the Flows use).
- The plain-HTTP callback/logout listener on :8082 returns the stub.
- The servers are a manager runnable in the "others" group
  (NeedLeaderElection false): every replica serves from its own
  Snapshot, like the mirror.

The build surface the Flows are built on:
- envoyproxy/go-control-plane (envoy module; the ext_authz Check
  proto) and go-jose/v4 (JWKS + ES256 verification + claim checks)
  are direct dependencies.
- internal/jwt: Verify validates the ES256 signature against the
  JWKS (matched by kid; the algorithm whitelist defeats an
  algorithm-confusion forgery) and checks exp/iss/aud; it returns
  the typed claims plus the raw claim map for the claim->header
  injection.
- internal/serve: the Server runnable (three listeners, one failing
  stops all, clean shutdown on ctx done), the SnapshotProvider
  read path, and the stub Check/handler the follow-up Flow tickets
  replace.
ginjiruu merged commit 80a4075ac6 into master 2026-09-14 21:39:59 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
needs-info

   
needs-triage

   
ready-for-agent

   
ready-for-human

   
wontfix
No labels
needs-info
needs-triage
ready-for-agent
ready-for-human
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
lab/authz-bridge!21
No description provided.