unkin-agent 9161558334 Add optional OIDC bearer auth on remote/virtual config writes (#136) ...

Remote and virtual configuration writes are unauthenticated, so anything that can reach the API can repoint or delete repos. Vault identity OIDC tokens give callers a verifiable identity.

- add `ARTIFACTAPI_OIDC_ISSUER`/`ARTIFACTAPI_OIDC_AUDIENCE`; unset issuer keeps auth off
- require a JWKS-verified bearer token on POST/PUT/DELETE of `/api/v2/remotes` and `/api/v2/virtuals`, 401 otherwise
- leave uploads, object deletes, probe, reads and `/v2` open
- discover the issuer lazily with a 10s client timeout; fail fast with 503 for 15s after a failed discovery
- log the verified `sub`; allow `Authorization` in CORS

Reviewed-on: #136
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

2026-10-16 22:08:20 +11:00

..

basic_test.go

test: raise core-package unit coverage to 90% (#98)

2026-07-03 14:31:24 +10:00

basic.go

Feat/v3 go rewrite (#47)

2026-06-07 19:30:35 +10:00

oidc_test.go

Add optional OIDC bearer auth on remote/virtual config writes (#136)

2026-10-16 22:08:20 +11:00

oidc.go

Add optional OIDC bearer auth on remote/virtual config writes (#136)

2026-10-16 22:08:20 +11:00