feat(auth): add workload delegation primitives

Signed-off-by: Ryan S <267728323+ironcommit@users.noreply.github.com>

Author: ironcommit

openapi/ga/individual/platform.openapi.yaml

@@ -24,6 +24,23 @@
 from .models import NMP_PRINCIPAL_ENVVAR, AuthContext, Principal
 from .permissions import ALL_WORKSPACES, compute_accessible_workspaces
 from .tasks import principal_from_env
+from .workload_delegations import (
+    DOCKER_OPAQUE_WORKLOAD_PROOF_TOKEN_TYPE,
+    OPAQUE_DOCKER_PROOF_PREFIX,
+    WORKLOAD_DELEGATION_ENTITY_TYPE,
+    InvalidWorkloadProofTokenError,
+    ParsedOpaqueDockerProofToken,
+    WorkloadDelegationConflictError,
+    WorkloadDelegationEntity,
+    WorkloadDelegationError,
+    WorkloadDelegationStore,
+    WorkloadDelegationValidationError,
+    create_opaque_docker_proof_token,
+    docker_delegation_name,
+    parse_opaque_docker_proof_token,
+    reference_delegation_name,
+    verify_opaque_docker_proof_token_hash,
+)
 
 # Testing utilities are NOT exported here to avoid importing dev dependencies (respx)
 # at runtime. Import directly from nmp.common.auth.testing when needed in tests.
@@ -41,14 +58,29 @@
     "ACCESS_KEY_JWKS_PATH",
     "ACCESS_KEY_TOKEN_TYPE",
     "AccessKeyIssuerService",
+    "DOCKER_OPAQUE_WORKLOAD_PROOF_TOKEN_TYPE",
+    "OPAQUE_DOCKER_PROOF_PREFIX",
+    "WORKLOAD_DELEGATION_ENTITY_TYPE",
+    "InvalidWorkloadProofTokenError",
     "NMP_PRINCIPAL_ENVVAR",
+    "ParsedOpaqueDockerProofToken",
     "Principal",
+    "WorkloadDelegationConflictError",
+    "WorkloadDelegationEntity",
+    "WorkloadDelegationError",
+    "WorkloadDelegationStore",
+    "WorkloadDelegationValidationError",
     "auth_as_service",
     "auth_client_context",
     "build_service_principal_headers",
+    "create_opaque_docker_proof_token",
+    "docker_delegation_name",
     "principal_from_env",
+    "parse_opaque_docker_proof_token",
+    "reference_delegation_name",
     "compute_accessible_workspaces",
     "get_auth_client",
     "get_principal_auth_headers",
     "validate_access_key_token",
+    "verify_opaque_docker_proof_token_hash",
 ]

openapi/ga/openapi.yaml

@@ -27,6 +27,14 @@
 _DISCOVERY_CACHE_TTL = 3600  # 1 hour
 
 
+@dataclass
+class ActorClaims:
+    """Validated RFC 8693 actor claims."""
+
+    subject: str
+    groups: list[str]
+
+
 @dataclass
 class TokenClaims:
     """Validated token claims."""
@@ -36,6 +44,7 @@ class TokenClaims:
     groups: list[str]
     scopes: list[str]
     raw_claims: dict
+    actor: Optional[ActorClaims] = None
 
 
 class UnsignedJWTRejectedError(Exception):
@@ -96,17 +105,11 @@ def _extract_token_claims(self, claims: dict) -> Optional[TokenClaims]:
             logger.warning("Token is missing a valid subject claim")
             return None
 
-        email = claims.get(self.config.oidc.email_claim)
+        email_value = claims.get(self.config.oidc.email_claim)
+        email = email_value if isinstance(email_value, str) else None
 
-        groups: list[str] = []
-        for claim_name in [self.config.oidc.groups_claim, "cognito:groups"]:
-            if claim_name in claims:
-                groups_value = claims[claim_name]
-                if isinstance(groups_value, str):
-                    groups = [g.strip() for g in groups_value.split(",")]
-                elif isinstance(groups_value, list):
-                    groups = groups_value
-                break
+        groups = self._extract_groups_from_claims(claims)
+        actor = self._extract_actor_claims(claims)
 
         scopes: list[str] = []
         scope_value = claims.get("scope") or claims.get("scp")
@@ -130,6 +133,39 @@ def _extract_token_claims(self, claims: dict) -> Optional[TokenClaims]:
             groups=groups,
             scopes=scopes,
             raw_claims=claims,
+            actor=actor,
+        )
+
+    def _extract_groups_from_claims(self, claims: dict) -> list[str]:
+        """Extract normalized groups from configured or provider-specific claims."""
+        for claim_name in [self.config.oidc.groups_claim, "cognito:groups"]:
+            if claim_name not in claims:
+                continue
+            value = claims[claim_name]
+            if isinstance(value, str):
+                return [group.strip() for group in value.split(",") if group.strip()]
+            if isinstance(value, list):
+                return [str(group).strip() for group in value if str(group).strip()]
+            return []
+        return []
+
+    def _extract_actor_claims(self, claims: dict) -> Optional[ActorClaims]:
+        """Extract RFC 8693 act claims when a valid actor subject is present."""
+        actor_claims = claims.get("act")
+        if not isinstance(actor_claims, dict):
+            return None
+
+        actor_subject = actor_claims.get("sub")
+        if not isinstance(actor_subject, str):
+            return None
+
+        actor_subject = actor_subject.strip()
+        if not actor_subject:
+            return None
+
+        return ActorClaims(
+            subject=actor_subject,
+            groups=self._extract_groups_from_claims(actor_claims),
         )
 
     async def validate_token(self, token: str) -> Optional[TokenClaims]:

openapi/openapi.yaml

@@ -22,6 +22,14 @@ class ResolvedBearerToken:
 
     @property
     def principal(self) -> Principal:
+        if self.claims.actor is not None:
+            return Principal(
+                id=self.claims.actor.subject,
+                groups=self.claims.actor.groups,
+                on_behalf_of=self.claims.subject,
+                on_behalf_of_email=self.claims.email,
+                on_behalf_of_groups=self.claims.groups,
+            )
         return Principal(
             id=self.claims.subject,
             email=self.claims.email,