unkin/artifactapi
3
0
Fork 0
Code Issues 5 Pull Requests 5 Actions Packages Projects Releases 1 Wiki Activity

1 Release 60 Tags

RSS Feed
  • v3.14.0 9161558334
    Compare

    Add optional OIDC bearer auth on remote/virtual config writes (#136)
    ci/woodpecker/tag/docker Pipeline was successful
    Details

    unkin-agent released this 2026-10-16 22:08:20 +11:00 | 42 commits to master since this release

    Remote and virtual configuration writes are unauthenticated, so anything that can reach the API can repoint or delete repos. Vault identity OIDC tokens give callers a verifiable identity.

    • add ARTIFACTAPI_OIDC_ISSUER/ARTIFACTAPI_OIDC_AUDIENCE; unset issuer keeps auth off
    • require a JWKS-verified bearer token on POST/PUT/DELETE of /api/v2/remotes and /api/v2/virtuals, 401 otherwise
    • leave uploads, object deletes, probe, reads and /v2 open
    • discover the issuer lazily with a 10s client timeout; fail fast with 503 for 15s after a failed discovery
    • log the verified sub; allow Authorization in CORS

    Reviewed-on: #136
    Co-authored-by: unkin-agent unkin-agent@unkin.net
    Co-committed-by: unkin-agent unkin-agent@unkin.net

    Downloads