[alexlovelltroy]

Description

This pull request introduces strict JWT-based authentication for all /admin/ API routes, ensuring that administrative operations are protected and unavailable if JWT verification cannot be configured or fails. Node bootstrap and non-admin endpoints remain accessible without tokens. The PR also updates documentation and adds comprehensive tests to validate the new authentication boundary and failure modes.

Admin authentication and API protection:

• All /admin/ APIs now require a bearer JWT, enforced via a middleware (adminJWTMiddleware). If the JWT verifier is unavailable or misconfigured (e.g., missing or empty JWKS), admin endpoints return HTTP 503, but non-admin endpoints (e.g., node bootstrap) remain accessible. [1] [2] [3] [4]
• The JWT verifier requires specific claims (sub, iss, aud) and only accepts tokens from the Authorization header (not cookies or query parameters), preventing ambient credential use. [1] [2]

Testing and validation:

• Adds comprehensive tests for admin JWT authentication, including coverage for valid/invalid tokens, claim requirements, JWKS fetch failures, and ensuring that only admin endpoints are gated by JWT auth. Tests also verify that node bootstrap remains tokenless and that state is not mutated by rejected admin requests. [1] [2]

Documentation and usage guidance:

• Updates README.md to document the new requirement for bearer JWTs on all /admin/ endpoints, including example curl commands with the Authorization header and a pointer to detailed admin authentication and upgrade guidance. [1] [2] [3] [4] [5]
• Clarifies CLI flag descriptions and startup messages to reflect that admin APIs are unavailable without a JWKS URL. [1] [2]

Other improvements:

• Ensures HTTP clients used for JWKS fetching have a timeout and robust error handling for non-200 responses.

These changes collectively harden the security boundary for administrative operations, provide clear operator guidance, and ensure robust, test-driven enforcement of the new authentication requirements.

Checklist

• My code follows the style guidelines of this project
• I have added/updated comments where needed
• I have added tests that prove my fix is effective or my feature works
• I have run make test (or equivalent) locally and all tests pass
• I have updated the relevant documentation (CLI examples, man pages, README, other docs, etc.)
• DCO Sign-off: All commits are signed off (git commit -s) with my real name and email
• REUSE Compliance:
  • Each new/modified source file has SPDX copyright and license headers
  • Any non-commentable files include a <filename>.license sidecar
  • All referenced licenses are present in the LICENSES/ directory

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Dependency update
• Build system/CI

---

• I agree to follow the Code of Conduct.

[synackd]

Reviewed the authentication boundary, failure behavior, documentation, and dependency changes. The middleware placement and WireGuard private-key log removal look correct. The comments below cover the remaining security policy question and client/documentation gaps.

Upstream CI passes, including race tests and vulnerability checks. Local tests passed for the packages that ran, including pkg/wgtunnel, but the full suite could not complete because the FlatBuffers dependency download failed, including after retrying with network access.

[synackd]

This generated definition describes the simulator node request body as an empty object. The simulator node response type is also generated as only:

{"type": "object"}

The actual request model includes groups and embeds OpenCHAMIComponent, which includes node identity and network fields such as ID, mac, ip, and wgip. These definitions are used by the newly documented simulator POST/PUT requests and GET response, so consumers of /openapi.json cannot discover those fields, and generated clients may expose only untyped objects.

Could we fix schema generation so both definitions include their actual fields, regenerate the checked-in Swagger artifacts, and extend the contract test to assert representative properties such as ID, ip, and groups?

[synackd]

I think after the item above, this should be good to go.