Merge pull request #78 from BinHsu/feat/phase-4e-1-oidc-provider

feat(phase-4e-1): gateway OIDCProvider for Cognito JWT validation

Author: BinHsu

MODULE.bazel

@@ -184,6 +184,7 @@ use_repo(
     "com_github_coder_websocket",
     "com_github_golang_jwt_jwt_v5",
     "com_github_improbable_eng_grpc_web",
+    "com_github_lestrrat_go_jwx_v2",
     "com_github_pion_webrtc_v4",
     "com_github_prometheus_client_golang",
     "org_golang_google_grpc",

gateway_go/cmd/gateway/main.go

@@ -33,10 +33,12 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"net"
 	"net/http"
 	"os"
 	"os/signal"
+	"strings"
 	"syscall"
 	"time"
 
@@ -268,12 +270,23 @@ func main() {
 		die("gatewaygrpc.New", "err", err)
 	}
 
-	// Auth provider: Local mode uses NoOp (synthetic "local" Principal
-	// on every RPC); Cloud mode would swap in a StaticJWTProvider or
-	// (future) a real Cognito client — see internal/auth for the port
-	// definition and Phase 2 "Known Gaps" in ROADMAP.md for the
-	// Cognito-integration scope that is descoped from this phase.
-	authProvider := auth.NoOpProvider{}
+	// Auth provider: picked by DEPLOY_MODE per ADR-0034 §LOCAL mode
+	// posture. One binary, three modes, one env-var switch:
+	//
+	//   local        → NoOpProvider (synthetic "local" Principal; ADR-0007)
+	//   cloud        → OIDCProvider (Cognito JWKS; ADR-0034 §D1)
+	//   cloud-test   → StaticJWTProvider (HS256 pre-shared-secret;
+	//                  Phase 2 A2 scaffold preserved for integration-
+	//                  test scenarios)
+	//
+	// Empty / unset DEPLOY_MODE defaults to local to preserve Phase 3
+	// LAN demo posture. Unrecognised values panic loudly rather than
+	// silently degrade to NoOp — a typo like `DEPLOY_MODE=prod` must
+	// not accidentally disable auth in a cloud deploy.
+	authProvider, err := buildAuthProvider(processCtx)
+	if err != nil {
+		die("build auth provider", "err", err)
+	}
 
 	// gRPC server for aegis.v1.Gateway. Interceptors fire in registration
 	// order: auth first (attaches Principal to ctx); future additions
@@ -670,3 +683,53 @@ func corsAllowed(p *corspolicy.Policy, h http.HandlerFunc) http.HandlerFunc {
 		h(w, r)
 	}
 }
+
+// buildAuthProvider selects the auth.Provider implementation at startup
+// based on the DEPLOY_MODE env var, per ADR-0034 §LOCAL mode posture.
+//
+//	""     / "local" → NoOpProvider  (synthetic "local" Principal; ADR-0007)
+//	"cloud"          → OIDCProvider   (Cognito JWKS + claim mapping; ADR-0034 §D1)
+//	"cloud-test"     → StaticJWTProvider (HS256 pre-shared-secret; Phase 2 A2 scaffold)
+//
+// Unrecognised DEPLOY_MODE values return an error that causes main to
+// die() — a typo like `DEPLOY_MODE=prod` must not silently fall through
+// to NoOp in a cloud deploy.
+//
+// Required env vars per mode:
+//
+//	local        — (none)
+//	cloud        — AEGIS_COGNITO_ISSUER, AEGIS_COGNITO_AUDIENCE;
+//	               optional AEGIS_COGNITO_JWKS_URL (default derived from issuer).
+//	cloud-test   — AEGIS_JWT_STATIC_SECRET; optional AEGIS_JWT_STATIC_AUDIENCE.
+func buildAuthProvider(ctx context.Context) (auth.Provider, error) {
+	mode := strings.ToLower(strings.TrimSpace(os.Getenv("DEPLOY_MODE")))
+	switch mode {
+	case "", "local":
+		return auth.NoOpProvider{}, nil
+
+	case "cloud":
+		issuer := os.Getenv("AEGIS_COGNITO_ISSUER")
+		audience := os.Getenv("AEGIS_COGNITO_AUDIENCE")
+		if issuer == "" || audience == "" {
+			return nil, fmt.Errorf("DEPLOY_MODE=cloud requires AEGIS_COGNITO_ISSUER and AEGIS_COGNITO_AUDIENCE")
+		}
+		return auth.NewOIDCProvider(ctx, auth.OIDCConfig{
+			Issuer:   issuer,
+			Audience: audience,
+			JWKSURL:  os.Getenv("AEGIS_COGNITO_JWKS_URL"),
+		})
+
+	case "cloud-test":
+		secret := os.Getenv("AEGIS_JWT_STATIC_SECRET")
+		if secret == "" {
+			return nil, errors.New("DEPLOY_MODE=cloud-test requires AEGIS_JWT_STATIC_SECRET")
+		}
+		return auth.StaticJWTProvider{
+			Secret:           []byte(secret),
+			ExpectedAudience: os.Getenv("AEGIS_JWT_STATIC_AUDIENCE"),
+		}, nil
+
+	default:
+		return nil, fmt.Errorf("unrecognized DEPLOY_MODE %q (valid: local, cloud, cloud-test)", mode)
+	}
+}

gateway_go/go.mod

@@ -24,9 +24,16 @@ require (
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 // indirect
 	github.com/desertbit/timer v1.0.1 // indirect
+	github.com/goccy/go-json v0.10.3 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/klauspost/compress v1.17.9 // indirect
+	github.com/lestrrat-go/blackmagic v1.0.3 // indirect
+	github.com/lestrrat-go/httpcc v1.0.1 // indirect
+	github.com/lestrrat-go/httprc v1.0.6 // indirect
+	github.com/lestrrat-go/iter v1.0.2 // indirect
+	github.com/lestrrat-go/option v1.0.1 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/pion/datachannel v1.6.0 // indirect
 	github.com/pion/dtls/v3 v3.1.2 // indirect
@@ -47,6 +54,7 @@ require (
 	github.com/prometheus/common v0.55.0 // indirect
 	github.com/prometheus/procfs v0.15.1 // indirect
 	github.com/rs/cors v1.11.1 // indirect
+	github.com/segmentio/asm v1.2.0 // indirect
 	github.com/wlynxg/anet v0.0.5 // indirect
 	golang.org/x/crypto v0.48.0 // indirect
 	golang.org/x/time v0.10.0 // indirect
@@ -57,6 +65,7 @@ require (
 	github.com/coder/websocket v1.8.14
 	github.com/golang-jwt/jwt/v5 v5.3.1
 	github.com/improbable-eng/grpc-web v0.15.0
+	github.com/lestrrat-go/jwx/v2 v2.1.6
 	github.com/pion/webrtc/v4 v4.2.11
 	github.com/prometheus/client_golang v1.20.5
 	golang.org/x/net v0.50.0 // indirect

gateway_go/go.sum

@@ -53,6 +53,8 @@ github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7Do
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 h1:NMZiJj8QnKe1LgsbDayM4UoHwbvwDRwnI3hwNaAHRnc=
+github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0/go.mod h1:ZXNYxsqcloTdSy/rNShjYzMhyjf0LaoftYK0p+A3h40=
 github.com/desertbit/timer v0.0.0-20180107155436-c41aec40b27f/go.mod h1:xH/i4TFMt8koVQZ6WFms69WAsDWr2XsYL3Hkl7jkoLE=
 github.com/desertbit/timer v1.0.1 h1:yRpYNn5Vaaj6QXecdLMPMJsW81JLiI1eokUft5nBmeo=
 github.com/desertbit/timer v1.0.1/go.mod h1:htRrYeY5V/t4iu1xCJ5XsQvp4xve8QulXXctAzxqcwE=
@@ -94,6 +96,8 @@ github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/me
 github.com/gobwas/httphead v0.0.0-20180130184737-2c6c146eadee/go.mod h1:L0fX3K22YWvt/FAX9NnzrNzcI4wNYi9Yku4O0LKYflo=
 github.com/gobwas/pool v0.2.0/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6WezmKEw=
 github.com/gobwas/ws v1.0.2/go.mod h1:szmBTxLgaFppYjEmNtny/v3w89xOydFnnZMcgRRu/EM=
+github.com/goccy/go-json v0.10.3 h1:KZ5WoDbxAIgm2HNbYckL0se1fHD6rz5j4ywS6ebzDqA=
+github.com/goccy/go-json v0.10.3/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
 github.com/gogo/googleapis v1.1.0/go.mod h1:gf4bu3Q80BeJ6H1S1vYPm8/ELATdvryBaNFGgqEef3s=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
 github.com/gogo/protobuf v1.2.0/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
@@ -196,6 +200,18 @@ github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/leodido/go-urn v1.2.0/go.mod h1:+8+nEpDfqqsY+g338gtMEUOtuK+4dEMhiQEgxpxOKII=
+github.com/lestrrat-go/blackmagic v1.0.3 h1:94HXkVLxkZO9vJI/w2u1T0DAoprShFd13xtnSINtDWs=
+github.com/lestrrat-go/blackmagic v1.0.3/go.mod h1:6AWFyKNNj0zEXQYfTMPfZrAXUWUfTIZ5ECEUEJaijtw=
+github.com/lestrrat-go/httpcc v1.0.1 h1:ydWCStUeJLkpYyjLDHihupbn2tYmZ7m22BGkcvZZrIE=
+github.com/lestrrat-go/httpcc v1.0.1/go.mod h1:qiltp3Mt56+55GPVCbTdM9MlqhvzyuL6W/NMDA8vA5E=
+github.com/lestrrat-go/httprc v1.0.6 h1:qgmgIRhpvBqexMJjA/PmwSvhNk679oqD1RbovdCGW8k=
+github.com/lestrrat-go/httprc v1.0.6/go.mod h1:mwwz3JMTPBjHUkkDv/IGJ39aALInZLrhBp0X7KGUZlo=
+github.com/lestrrat-go/iter v1.0.2 h1:gMXo1q4c2pHmC3dn8LzRhJfP1ceCbgSiT9lUydIzltI=
+github.com/lestrrat-go/iter v1.0.2/go.mod h1:Momfcq3AnRlRjI5b5O8/G5/BvpzrhoFTZcn06fEOPt4=
+github.com/lestrrat-go/jwx/v2 v2.1.6 h1:hxM1gfDILk/l5ylers6BX/Eq1m/pnxe9NBwW6lVfecA=
+github.com/lestrrat-go/jwx/v2 v2.1.6/go.mod h1:Y722kU5r/8mV7fYDifjug0r8FK8mZdw0K0GpJw/l8pU=
+github.com/lestrrat-go/option v1.0.1 h1:oAzP2fvZGQKWkvHa1/SAcFolBEca1oN+mQ7eooNBEYU=
+github.com/lestrrat-go/option v1.0.1/go.mod h1:5ZHFbivi4xwXxhxY9XHDe2FHo6/Z7WWmtT7T5nBBp3I=
 github.com/lightstep/lightstep-tracer-common/golang/gogo v0.0.0-20190605223551-bc2310a04743/go.mod h1:qklhhLq1aX+mtWk9cPHPzaBjWImj5ULL6C7HFJtXQMM=
 github.com/lightstep/lightstep-tracer-go v0.18.1/go.mod h1:jlF1pusYV4pidLvZ+XD0UBX0ZE6WURAspgAczcDHrL4=
 github.com/lyft/protoc-gen-validate v0.0.13/go.mod h1:XbGvPuh87YZc5TdIa2/I4pLk0QoUACkjt2znoq26NVQ=
@@ -332,6 +348,8 @@ github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQD
 github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
 github.com/samuel/go-zookeeper v0.0.0-20190923202752-2cc03de413da/go.mod h1:gi+0XIa01GRL2eRQVjQkKGqKF3SF9vZR/HnPullcV2E=
 github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
+github.com/segmentio/asm v1.2.0 h1:9BQrFxC+YOHJlTlHGkTrFWf59nbL3XnCoFLTwDCI7ys=
+github.com/segmentio/asm v1.2.0/go.mod h1:BqMnlJP91P8d+4ibuonYZw9mfnzI9HfxselHZr5aAcs=
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
@@ -352,7 +370,9 @@ github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/tmc/grpc-websocket-proxy v0.0.0-20170815181823-89b8d40f7ca8/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=

gateway_go/internal/auth/BUILD.bazel

@@ -7,11 +7,14 @@ go_library(
         "interceptor.go",
         "jwt.go",
         "noop.go",
+        "oidc_provider.go",
     ],
     importpath = "github.com/BinHsu/aegis-core/gateway_go/internal/auth",
     visibility = ["//gateway_go:__subpackages__"],
     deps = [
         "@com_github_golang_jwt_jwt_v5//:jwt",
+        "@com_github_lestrrat_go_jwx_v2//jwk",
+        "@com_github_lestrrat_go_jwx_v2//jwt",
         "@org_golang_google_grpc//:grpc",
         "@org_golang_google_grpc//codes",
         "@org_golang_google_grpc//metadata",
@@ -22,10 +25,16 @@ go_library(
 go_test(
     name = "auth_test",
     size = "small",
-    srcs = ["auth_test.go"],
+    srcs = [
+        "auth_test.go",
+        "oidc_provider_test.go",
+    ],
     embed = [":auth"],
     deps = [
         "@com_github_golang_jwt_jwt_v5//:jwt",
+        "@com_github_lestrrat_go_jwx_v2//jwa",
+        "@com_github_lestrrat_go_jwx_v2//jwk",
+        "@com_github_lestrrat_go_jwx_v2//jwt",
         "@org_golang_google_grpc//:grpc",
         "@org_golang_google_grpc//codes",
         "@org_golang_google_grpc//metadata",