Implement authenticated request context and API-key lifecycle #85

Merged

lost-rob0t merged 32 commits from agent/issue-27-http-auth into master

2026-07-31 01:24:32 +00:00

lost-rob0t commented

2026-07-31 00:48:39 +00:00

(Migrated from github.com)

Runtime changes

add default-deny HTTP API-key authentication middleware with one immutable request security context
generate opaque star_sk_v1 credentials containing a non-secret key id and 256-bit random secret
store only salted/peppered verifier material, status, scopes, owner, timestamps, expiration, and rotation metadata
use constant-time verifier comparison and uniform 401 invalid_credential responses
create a separate CouchDB authentication database and design view
add one-time bootstrap, create, metadata list, rotate-with-overlap, revoke, disable, and authenticated-context routes
never return a secret after initial bootstrap/create/rotate response; mark one-time secret responses no-store
configure exact CORS allowlists and remove wildcard origin behavior
propagate principal, credential id, scopes, correlation id, and deadline into bulk jobs and RabbitMQ service-call provenance
restrict bulk-job status to the submitting principal or an administrator
use no authentication cache, making successful revocation visible to the next verifier lookup

Deployment and verification

add pepper and bootstrap Docker secrets
bootstrap a real administrator key in the container-stack test
require authentication for FTS and context checks
verify unauthenticated denial, one-time bootstrap, and credential persistence after restart
add mandatory hermetic tests for malformed, incorrect, expired, disabled, revoked, and rotated credentials; constant-time comparison; redaction; CORS; service context; fail-closed configuration; and concurrent zero-cache revocation

Known scope boundary

The repository has no implemented KV target-lease adapter yet. This PR propagates a lease-safe service context containing principal, credential id, scopes, correlation id, and deadline so the future adapter can require explicit authenticated context rather than inferring authority.

Merge gates

final-head schema lock, hermetic unit, service integration, and container-stack workflows must all pass
issue #27 acceptance tests must all be discovered and pass
documentation must describe bootstrap, lifecycle routes, configuration, CORS, error behavior, and the zero-second cache bound
PR remains draft until every gate passes

Fixes #27

## Runtime changes - add default-deny HTTP API-key authentication middleware with one immutable request security context - generate opaque `star_sk_v1` credentials containing a non-secret key id and 256-bit random secret - store only salted/peppered verifier material, status, scopes, owner, timestamps, expiration, and rotation metadata - use constant-time verifier comparison and uniform `401 invalid_credential` responses - create a separate CouchDB authentication database and design view - add one-time bootstrap, create, metadata list, rotate-with-overlap, revoke, disable, and authenticated-context routes - never return a secret after initial bootstrap/create/rotate response; mark one-time secret responses `no-store` - configure exact CORS allowlists and remove wildcard origin behavior - propagate principal, credential id, scopes, correlation id, and deadline into bulk jobs and RabbitMQ service-call provenance - restrict bulk-job status to the submitting principal or an administrator - use no authentication cache, making successful revocation visible to the next verifier lookup ## Deployment and verification - add pepper and bootstrap Docker secrets - bootstrap a real administrator key in the container-stack test - require authentication for FTS and context checks - verify unauthenticated denial, one-time bootstrap, and credential persistence after restart - add mandatory hermetic tests for malformed, incorrect, expired, disabled, revoked, and rotated credentials; constant-time comparison; redaction; CORS; service context; fail-closed configuration; and concurrent zero-cache revocation ## Known scope boundary The repository has no implemented KV target-lease adapter yet. This PR propagates a lease-safe service context containing principal, credential id, scopes, correlation id, and deadline so the future adapter can require explicit authenticated context rather than inferring authority. ## Merge gates - final-head schema lock, hermetic unit, service integration, and container-stack workflows must all pass - issue #27 acceptance tests must all be discovered and pass - documentation must describe bootstrap, lifecycle routes, configuration, CORS, error behavior, and the zero-second cache bound - PR remains draft until every gate passes Fixes #27