glm-5.3-flash
d070e548ad
Tasks completed: server-core-types, server-auth, server-healthz-decoy, gateway-dispatch, server-adapter (5 of 17). - src/server/state.rs: DecoyConfig + RouterState (alkcall type paths, 6-endpoint reserved-path docs) - src/server/auth.rs: bearer middleware + ResolvedIdentity extractor (10 tests: missing/malformed/basic/failed-resolution matrix) - src/server/healthz.rs + decoy.rs: raw healthz; nginx-style 404, static site (path-traversal guarded), redirect decoys - src/gateway/dispatch.rs: GatewayDispatch invoke/invoke_streaming (internal:false, forwarded_for:None, bounded deadline) + src/gateway/error.rs: CallError→HTTP status mapping (HTTP_<status> passthrough, retryable→Retry-After) - src/server/adapter.rs: HttpAdapter ProtocolHandler — accept_bi → BiStream → TokioIo → hyper auto builder (h2 CONNECT enabled); integration tests over DuplexStream (request/response cycle, healthz, decoy 404) Verified: cargo test (46 lib tests), clippy -D warnings, fmt, test --all-features.
47 lines
1.5 KiB
Markdown
47 lines
1.5 KiB
Markdown
---
|
|
id: server-auth
|
|
name: Bearer auth middleware and identity extraction
|
|
status: completed
|
|
depends_on: [server-core-types]
|
|
scope: narrow
|
|
risk: low
|
|
impact: component
|
|
level: implementation
|
|
tags: [server, phase-1]
|
|
---
|
|
|
|
## Description
|
|
|
|
Port `bearer_auth_middleware` and `extract_bearer_identity` +
|
|
`ResolvedIdentity` from
|
|
`/workspace/@alkdev/alknet/crates/alknet-http/src/server/auth.rs`.
|
|
Resolution via `IdentityProvider::resolve_from_token(&AuthToken { raw })
|
|
` (alkcall::core::auth). Middleware behavior: no/invalid token →
|
|
identity None (routes decide 401 vs anonymous); token present →
|
|
ResolvedIdentity(Some(identity)). Unit tests over the middleware with a
|
|
static identity provider.
|
|
|
|
## Acceptance Criteria
|
|
|
|
- [x] Middleware ports with tests (missing header, malformed, valid token, unknown token)
|
|
- [x] `set_identity` observability path documented for the WS route's use
|
|
- [x] No env-var reads anywhere (no-env-vars invariant)
|
|
- [x] `cargo test` passes
|
|
|
|
## References
|
|
|
|
- docs/architecture/http-server.md (§Auth)
|
|
- docs/architecture/decisions/004-auth-as-shared-core.md
|
|
|
|
## Notes
|
|
|
|
> Agent fills during implementation.
|
|
|
|
## Summary
|
|
|
|
Ported `src/server/auth.rs`: `bearer_auth_middleware`,
|
|
`extract_bearer_identity`, `ResolvedIdentity` extractor — resolution
|
|
semantics preserved (no header/malformed/failed resolution → None;
|
|
routes decide 401 vs anonymous). 10 unit tests covering the matrix.
|
|
alkcall type paths. The WS route's `set_identity` observability is
|
|
documented in the module doc of adapter.rs. |