feat(auth): AuthBackend 协议可选 bearer-token 扩展(supports_bearer_token / authenticate_bearer_token) - #2
Merged
Conversation
…otocol Today, non-browser requests to Flocks authenticate via a single shared API token stored in .secret.json. Leaking it grants admin-equivalent access across all tenants — incompatible with multi-tenant service-to- service deployments (e.g. a facade issuing per-team JWTs). Extend the existing AuthBackend protocol with two OPTIONAL methods: - supports_bearer_token() default False - authenticate_bearer_token(token) default None Backends that override these opt in to serving Bearer auth themselves. The follow-up server-side PR will consult supports_bearer_token() in apply_auth_for_request and route accordingly; until then this PR is a pure protocol extension with zero behavior change. Use case: a JWTAuthBackend (sample in a separate PR) decodes a short-lived per-team JWT, returns LocalUser with tenant_ids populated, and gives the facade real per-team isolation in Flocks without sharing the API token across tenants. Refs: - PoC reference implementation (not part of this PR): github.com/xiejava1018/flocks @ workshop/poc-c0 - Design: see PR description
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
动机
当前非浏览器请求只能用
.secret.json里的共享 API token(共享密钥比对), 泄露即全租户管理员权限 — 无法支撑多租户服务间调用(如门面按 team 签发短期 JWT 调 Flocks)。方案
AuthBackend协议新增两个可选方法(默认 False/None, 存量后端零影响):后续 PR(另行):
_apply_auth_for_requestBearer 分支先咨询supports_bearer_token(), 命中则委托 backend 解码。Cookie 路径不动。本 PR 范围(纯协议扩展, 零行为变更)
flocks/auth/backend.py+34 行(两个可选方法)tests/test_auth_backend_bearer_protocol.py— 默认不启用 + 自愿接入两态测试用例
workshop_auth 插件(workshop/poc-c0 分支)是第一个消费者: per-team 短期 JWT(RS256/JWKS),
tenant_ids进 claims, Flocks 内真实租户隔离。该 PR 曾误提到 AgentFlocks#732(已关闭), 现按内部评审流程并入本仓 main。