feat(dev-sso): validate bunyip-issued tokens as a Resource Server #113

Merged

longjacksonle merged 1 commit from feat/dev-sso-rs-trust-bunyip into main

2026-06-05 19:41:15 +02:00

longjacksonle commented

2026-06-05 19:36:39 +02:00

Owner

What

After the bunyip-as-OP cutover the mokosh SPA authenticates against bunyip-api, so mokosh-server must accept the at+jwt bunyip mints instead of issuing its own. This wires mokosh-server as a Resource Server in dev-sso. Config only, no code change: the auth middleware already carries the BunyipVerifier (src/modules/auth/oidc_rs.rs: fetch bunyip discovery + JWKS, JIT-provision the user), which activates from OIDC_ISSUER + OIDC_AUDIENCE.

Changes

compose.dev-sso.yml: set OIDC_ISSUER to bunyip-api's public host (must equal both the token iss and bunyip's advertised discovery issuer) and OIDC_AUDIENCE to mokosh-server's own host (the audience on the mokosh-apps oauth_clients row in bunyip-api). MOKOSH_AUTH_ISSUER reverts to mokosh-server's own identity for its now-unused OP endpoints.
Add an extra_hosts pin: the verifier fetches ${OIDC_ISSUER}/.well-known/openid-configuration, but inside the container the issuer host resolves to dev-01's public edge (self-signed cert + 404 on the OP path). Pin it to the local Traefik on the shared network, which serves the OP with a valid Let's Encrypt cert. BUNYIP_OP_TRAEFIK_IP overrides the default per box.

Companion PRs

bunyip feat/dev-sso-bunyip-as-op (the OP).
mokosh-apps feat/dev-sso-bunyip-issuer (SPA issuer).

Supersedes

Replaces PR #79 (the mokosh-server return_to->redirect OP login bridge): that patched mokosh-server's own OP, the wrong layer once bunyip-api is the OP. #79 should be closed.

Verification

With a bunyip-issued at+jwt (iss=…bunyip-api, kid=dev-2026, aud=…mokosh-api), mokosh-server returns 200 on GET /api/v1/auth/me (user JIT-resolved into the default tenant), GET /api/v1/contacts/companies, and POST create-company. Startup logs Bunyip RS verifier mounted.

🤖 Generated with Claude Code

## What After the bunyip-as-OP cutover the mokosh SPA authenticates against bunyip-api, so mokosh-server must accept the `at+jwt` bunyip mints instead of issuing its own. This wires mokosh-server as a Resource Server in dev-sso. Config only, no code change: the auth middleware already carries the BunyipVerifier (`src/modules/auth/oidc_rs.rs`: fetch bunyip discovery + JWKS, JIT-provision the user), which activates from `OIDC_ISSUER` + `OIDC_AUDIENCE`. ## Changes - `compose.dev-sso.yml`: set `OIDC_ISSUER` to bunyip-api's public host (must equal both the token `iss` and bunyip's advertised discovery issuer) and `OIDC_AUDIENCE` to mokosh-server's own host (the audience on the mokosh-apps oauth_clients row in bunyip-api). `MOKOSH_AUTH_ISSUER` reverts to mokosh-server's own identity for its now-unused OP endpoints. - Add an `extra_hosts` pin: the verifier fetches `${OIDC_ISSUER}/.well-known/openid-configuration`, but inside the container the issuer host resolves to dev-01's public edge (self-signed cert + 404 on the OP path). Pin it to the local Traefik on the shared network, which serves the OP with a valid Let's Encrypt cert. `BUNYIP_OP_TRAEFIK_IP` overrides the default per box. ## Companion PRs - bunyip `feat/dev-sso-bunyip-as-op` (the OP). - mokosh-apps `feat/dev-sso-bunyip-issuer` (SPA issuer). ## Supersedes Replaces PR #79 (the mokosh-server `return_to`->`redirect` OP login bridge): that patched mokosh-server's own OP, the wrong layer once bunyip-api is the OP. #79 should be closed. ## Verification With a bunyip-issued `at+jwt` (`iss=…bunyip-api`, `kid=dev-2026`, `aud=…mokosh-api`), mokosh-server returns 200 on `GET /api/v1/auth/me` (user JIT-resolved into the default tenant), `GET /api/v1/contacts/companies`, and `POST` create-company. Startup logs `Bunyip RS verifier mounted`. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

longjacksonle added 1 commit

2026-06-05 19:36:39 +02:00

feat(dev-sso): validate bunyip-issued tokens as a Resource Server

Check / fmt + clippy + compile + tests (pull_request) Successful in 3m17s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

ce25821c85

After the bunyip-as-OP cutover the mokosh SPA authenticates against bunyip-api, so mokosh-server must accept the at+jwt bunyip mints instead of issuing its own. The auth middleware already carries the BunyipVerifier (src/modules/auth/oidc_rs.rs: fetches bunyip discovery + JWKS, JIT-provisions the user); it activates purely from OIDC_ISSUER + OIDC_AUDIENCE, so this is config only, no code change.

Set OIDC_ISSUER to bunyip-api's public host (it must equal both the token `iss` and bunyip's advertised discovery issuer) and OIDC_AUDIENCE to mokosh-server's own host (the audience on the mokosh-apps oauth_clients row in bunyip-api). Keep MOKOSH_AUTH_ISSUER as mokosh-server's own identity for its now-unused OP endpoints.

Add an extra_hosts pin: the verifier fetches `${OIDC_ISSUER}/.well-known/openid-configuration`, but inside the container the issuer host resolves to dev-01's public edge (self-signed cert + 404 on the OP path). Pin it to the local Traefik on the shared network, which serves the OP with a valid Let's Encrypt cert; override BUNYIP_OP_TRAEFIK_IP in .env on a box whose Traefik publishes nebula-secure elsewhere.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>