glm-5.3-flash
63dc4b6d06
Plan updated with the alknet-tty findings: the drainer pattern (single ordered writer) makes outbound chunk-boundary parsing sound; TestStdinSink's try_send→Full→Pending is the inbound backpressure precedent; OQ-01(a) now cites the reference. Task graph (taskgraph-validated, 17 tasks, 6 generations, no cycles): - tasks/server/: core-types, auth, healthz-decoy, adapter - tasks/gateway/: dispatch, routes, publish - tasks/websocket/: byte-adapter (research POC), upgrade-session, overlay-ops - tasks/adapters/: from-openapi, from-jsonschema, to-openapi, from-wss, mcp - tasks/client/: http-host - tasks/infra/: integration-suite (phase 4) Critical path runs through server core → adapter → WS session → overlay tests → integration suite. High-risk tasks are the three WS tasks, de-risked by the ws-byte-adapter POC blocking upgrade-session.
42 lines
1.1 KiB
Markdown
42 lines
1.1 KiB
Markdown
---
|
|
id: server-auth
|
|
name: Bearer auth middleware and identity extraction
|
|
status: pending
|
|
depends_on: [server-core-types]
|
|
scope: narrow
|
|
risk: low
|
|
impact: component
|
|
level: implementation
|
|
tags: [server, phase-1]
|
|
---
|
|
|
|
## Description
|
|
|
|
Port `bearer_auth_middleware` and `extract_bearer_identity` +
|
|
`ResolvedIdentity` from
|
|
`/workspace/@alkdev/alknet/crates/alknet-http/src/server/auth.rs`.
|
|
Resolution via `IdentityProvider::resolve_from_token(&AuthToken { raw })
|
|
` (alkcall::core::auth). Middleware behavior: no/invalid token →
|
|
identity None (routes decide 401 vs anonymous); token present →
|
|
ResolvedIdentity(Some(identity)). Unit tests over the middleware with a
|
|
static identity provider.
|
|
|
|
## Acceptance Criteria
|
|
|
|
- [ ] Middleware ports with tests (missing header, malformed, valid token, unknown token)
|
|
- [ ] `set_identity` observability path documented for the WS route's use
|
|
- [ ] No env-var reads anywhere (no-env-vars invariant)
|
|
- [ ] `cargo test` passes
|
|
|
|
## References
|
|
|
|
- docs/architecture/http-server.md (§Auth)
|
|
- docs/architecture/decisions/004-auth-as-shared-core.md
|
|
|
|
## Notes
|
|
|
|
> Agent fills during implementation.
|
|
|
|
## Summary
|
|
|
|
> Agent fills on completion. |