feat: Vault identity-OIDC JWT auth and node set-environment route #9

2026-10-23T21:36:00+11:00

unkin-agent commented

2026-10-23 21:36:00 +11:00

Writes only accept a shared static token, so terragrunt-enc and agents cannot use short-lived Vault identity tokens, and there is no way to grant an agent just enough to move a node to testing.

add internal/auth OIDC verifier (lazy discovery, backoff, 503 when issuer down)
accept JWTs with aud encapi as full write access alongside ENCAPI_WRITE_TOKEN
add PUT /api/v1/nodes/{certname}/environment (single UPDATE); aud encapi-testing may only set testing
return 422 for node writes naming an unknown role or environment
add ENCAPI_OIDC_ISSUER/AUDIENCE/TESTING_AUDIENCE, client SetNodeEnvironment, encapi-cli node set-env

Writes only accept a shared static token, so terragrunt-enc and agents cannot use short-lived Vault identity tokens, and there is no way to grant an agent just enough to move a node to testing. - add internal/auth OIDC verifier (lazy discovery, backoff, 503 when issuer down) - accept JWTs with aud `encapi` as full write access alongside ENCAPI_WRITE_TOKEN - add `PUT /api/v1/nodes/{certname}/environment` (single UPDATE); aud `encapi-testing` may only set `testing` - return 422 for node writes naming an unknown role or environment - add ENCAPI_OIDC_ISSUER/AUDIENCE/TESTING_AUDIENCE, client SetNodeEnvironment, `encapi-cli node set-env`

unkin-agent added 1 commit 2026-10-23 21:36:00 +11:00

feat: accept Vault identity JWTs for writes, add set-environment route

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/build Pipeline was successful

Details

ci/woodpecker/pr/test Pipeline was successful

Details

8c1bfda4c5

unkin-agent commented

2026-10-23 21:37:17 +11:00

internal/server/handlers.go:putNodeEnvironment — unknown environment (or "testing" not seeded) hits the FK in UpsertNode and mapErr returns 500 with the raw pg error text → map FK violation (pgconn code 23503) to 400/422 with a fixed message; add a test (fakeStore cannot hit this, needs the real DB or a fake that returns the FK error).
internal/server/handlers.go:putNodeEnvironment — GetNode then full-row UpsertNode overwrites role/params with the stale read if they change concurrently → add a store method that does UPDATE nodes SET environment=$2 ... WHERE certname=$1 (ErrNotFound on 0 rows).

- internal/server/handlers.go:putNodeEnvironment — unknown environment (or "testing" not seeded) hits the FK in UpsertNode and mapErr returns 500 with the raw pg error text → map FK violation (pgconn code 23503) to 400/422 with a fixed message; add a test (fakeStore cannot hit this, needs the real DB or a fake that returns the FK error). - internal/server/handlers.go:putNodeEnvironment — GetNode then full-row UpsertNode overwrites role/params with the stale read if they change concurrently → add a store method that does `UPDATE nodes SET environment=$2 ... WHERE certname=$1` (ErrNotFound on 0 rows).

unkin-agent added 1 commit 2026-10-23 21:39:43 +11:00

fix: map unknown role/environment to 422, set environment in one UPDATE

ci/woodpecker/pr/build Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/test Pipeline was successful

Details

033a5b0a61

unkin-agent commented

2026-10-23 21:41:35 +11:00

nit: internal/server/server.go:45 — Auth.TestingAudience is set in main.go but never read (scope is derived as "has the full audience, else testing") → drop the field, or classify scopeTesting by explicit match on it.

- nit: internal/server/server.go:45 — `Auth.TestingAudience` is set in main.go but never read (scope is derived as "has the full audience, else testing") → drop the field, or classify scopeTesting by explicit match on it.

benvin merged commit fa608c3767 into main

2026-10-23 21:46:38 +11:00

benvin deleted branch benvin/oidc-auth

2026-10-23 21:46:38 +11:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/encapi#9