[P0-19] Implement authenticated request context and API-key lifecycle #27

New issue

Closed

opened 2026-07-22 00:13:10 +00:00 by lost-rob0t · 0 comments

lost-rob0t commented

2026-07-22 00:13:10 +00:00

(Migrated from github.com)

Depends on

The authentication threat-model issue.

Required changes

Add HTTP authentication middleware that resolves one immutable request principal/context.
Implement opaque API keys with a public key id and random secret; store only verifier material, status, scopes, owner, creation/expiry, and rotation metadata.
Use constant-time verification.
Add bootstrap, create, list-metadata, rotate, revoke, and disable operations; never return a secret after initial creation.
Separate credential storage from intelligence documents.
Propagate authenticated principal, trace id, and deadline into service calls and target lease operations.
Replace wildcard CORS with configured allowed origins/methods/headers appropriate to authenticated use.
Return uniform 401 responses that do not disclose whether a key id exists.

Acceptance tests

Missing, malformed, expired, disabled, revoked, and incorrect credentials are rejected.
Valid credentials create the expected request principal.
Token comparison is constant-time at the verifier boundary.
Rotation supports an explicit overlap window and then invalidates the old secret.
Logs and error responses redact credentials.
Concurrent revocation takes effect according to a documented cache bound.

## Depends on The authentication threat-model issue. ## Required changes - Add HTTP authentication middleware that resolves one immutable request principal/context. - Implement opaque API keys with a public key id and random secret; store only verifier material, status, scopes, owner, creation/expiry, and rotation metadata. - Use constant-time verification. - Add bootstrap, create, list-metadata, rotate, revoke, and disable operations; never return a secret after initial creation. - Separate credential storage from intelligence documents. - Propagate authenticated principal, trace id, and deadline into service calls and target lease operations. - Replace wildcard CORS with configured allowed origins/methods/headers appropriate to authenticated use. - Return uniform 401 responses that do not disclose whether a key id exists. ## Acceptance tests - Missing, malformed, expired, disabled, revoked, and incorrect credentials are rejected. - Valid credentials create the expected request principal. - Token comparison is constant-time at the verifier boundary. - Rotation supports an explicit overlap window and then invalidates the old secret. - Logs and error responses redact credentials. - Concurrent revocation takes effect according to a documented cache bound.