Alwaysgaurav1 opened a new pull request, #9043:
URL: https://github.com/apache/texera/pull/9043
### What changes were proposed in this PR?
This PR implements Phase 1 authorization for requests reaching the
`agent-service`, providing defense-in-depth across the API gateways, the
`access-control-service`, and the `agent-service` itself:
1. **`agent-service` Direct JWT Verification (`config/jwt.ts`)**:
- Replaced non-cryptographic JWT decoding with real cryptographic **HS256
signature verification** using `node:crypto` (`createHmac`, `timingSafeEqual`).
- Resolves the shared secret from `AUTH_JWT_SECRET` (falling back to
candidate `auth.conf` locations and built-in defaults) with a 30-second clock
skew tolerance.
- Added an `.onBeforeHandle` guard across `agentsRouter` in `server.ts`
that rejects requests missing a valid Bearer token with `401 Unauthorized`
(while preserving unauthenticated probes on `/api/healthcheck`).
- Enforced authentication on the `/api/agents/:id/react` WebSocket via
the `access-token` query parameter during the `open(ws)` handshake.
2. **`access-control-service` Ext-Authz Route
(`AccessControlResource.scala`)**:
- Added a route matcher for `.*/api/agents.*` to
`AccessControlResource.authorize()`.
- Validates the token using `parseToken()` and requires a `REGULAR` or
`ADMIN` user role.
- Forwards trusted user identity headers (`x-user-id`, `x-user-name`,
`x-user-email`) on HTTP 200, returning HTTP 401 for missing/malformed tokens
and HTTP 403 for inactive roles.
3. **Gateway & Kubernetes Deployment**:
- `bin/single-node/nginx.conf`: Configured `upstream
access_control_authz`, an internal `/_agent_auth` subrequest location, and
`auth_request /_agent_auth;` on `/api/agents`.
- `bin/k8s/templates/base/gateway/gateway-agent-security-policy.yaml`:
Added an Envoy Gateway `SecurityPolicy` for `agent-service-route` pointing
extAuth to `access-control-service`.
- `bin/k8s/templates/base/agent-service/agent-service-deployment.yaml`:
Injected `.Values.texeraEnvVars` (providing `AUTH_JWT_SECRET`).
- `bin/dockerfiles/agent-service.dockerfile`: Bundled `auth.conf` into
the container image.
4. **Frontend (`agent.service.ts`)**:
- Updated `agentHeaders()` to attach `Authorization: Bearer <token>` from
`AuthService.getAccessToken()`.
- Appended `?access-token=${encodeURIComponent(token)}` to the WebSocket
connection URL in `startStatePolling()`.
- Ensured all agent HTTP requests (`syncAgentsWithBackend`,
`createAgent`, `getAllAgents`, `fetchModelTypes`) pass `agentHeaders()`.
### Any related issues, documentation, discussions?
Resolves #5561
### How was this PR tested?
- **`agent-service` Unit & Integration Tests**:
- `agent-service/src/config/jwt.spec.ts`: Added 9 unit tests testing HS256
signature verification, string coercion, secret mismatches, tampering,
expiration within/outside clock skew, non-HS256 algorithms, and malformed
tokens.
- `agent-service/src/server.spec.ts`: Added unit tests verifying 401
rejection for unauthenticated, invalid, and expired tokens, 200 pass-through
for valid tokens, and unauthenticated bypass for `/api/healthcheck`.
- `agent-service/src/server.ws.spec.ts`: Added unit tests verifying
WebSocket disconnection with `WsServerErrorEvent("Unauthorized")` when
`access-token` is missing or invalid.
- Ran Bun test suite: **327 tests pass, 0 fail**. TypeScript check (`tsc
--noEmit`) passes with 0 errors.
- **`access-control-service` Unit Tests**:
- `AgentAccessAuthSpec.scala`: Added tests covering 200 OK for `REGULAR`
and `ADMIN` roles, forwarding of `x-user-*` headers, 401 on missing/malformed
tokens, and 403 on `INACTIVE` role.
- **Frontend Unit Tests**:
- `agent.service.spec.ts`: Added tests verifying that `Authorization` is
attached when an access token is present and omitted when unauthenticated, and
that `?access-token=` is correctly appended to the WebSocket URL.
### Was this PR authored or co-authored using generative AI tooling?
Generated-by: Antigravity 2.0 (Gemini 2.5 Pro)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
