Track interim Quasar hosted authentication plugin #7

New issue

Open

opened 2026-09-06 19:08:26 +00:00 by nsaspy · 0 comments

nsaspy commented

2026-09-06 19:08:26 +00:00

Owner

Scope

quasar-auth reuses starintel-server POST /auth/login and its CouchDB-backed users, then maps StarIntel scopes to Quasar workspace/capability grants. quasar-auth-host is trusted runtime code loaded inside the Quasar image; it registers per-principal WebSocket sessions and exposes the private /biz/auth/login bridge. The starintel-server API key remains server-side.

Interim status

The enforcement layer is multi-principal, but public browser issuance is not complete. The hosted runtime still creates Quasar's shared local-user token, so deployment must treat it as a secret and retain the outer gateway auth gate. This plugin does not claim public per-user isolation yet.

Dependencies

Quasar #71: per-user issuance, unregister, suppress shared token, allowed origins
Quasar #72: WebSocket traversal through the shared reverse proxy
Quasar #73: trusted init/plugin hook surface
OIDC finalization prompt: separate follow-up; OIDC is deliberately out of scope here

Acceptance for this slice

Standalone auth policy tests pass
Host bridge compiles in the Quasar dev shell
Fake auth login registers a token in a real quasar.ws:websocket-server
Runtime deployment keeps the shared-token era behind gateway auth

## Scope `quasar-auth` reuses starintel-server `POST /auth/login` and its CouchDB-backed users, then maps StarIntel scopes to Quasar workspace/capability grants. `quasar-auth-host` is trusted runtime code loaded inside the Quasar image; it registers per-principal WebSocket sessions and exposes the private `/biz/auth/login` bridge. The starintel-server API key remains server-side. ## Interim status The enforcement layer is multi-principal, but public browser issuance is not complete. The hosted runtime still creates Quasar's shared `local-user` token, so deployment must treat it as a secret and retain the outer gateway auth gate. This plugin does not claim public per-user isolation yet. ## Dependencies - [Quasar #71](https://git.starintel.actor/nsaspy/quasar/issues/71): per-user issuance, unregister, suppress shared token, allowed origins - [Quasar #72](https://git.starintel.actor/nsaspy/quasar/issues/72): WebSocket traversal through the shared reverse proxy - [Quasar #73](https://git.starintel.actor/nsaspy/quasar/issues/73): trusted init/plugin hook surface - [OIDC finalization prompt](https://git.starintel.actor/starintel-labs/starintel-biz/src/branch/main/docs/prompts/oidc-finalization.md): separate follow-up; OIDC is deliberately out of scope here ## Acceptance for this slice - Standalone auth policy tests pass - Host bridge compiles in the Quasar dev shell - Fake auth login registers a token in a real `quasar.ws:websocket-server` - Runtime deployment keeps the shared-token era behind gateway auth