Repository navigation
atenet: cache RFC 8693 token exchanges in a broker - #3344
Open
Max Thompson (thompsonmax) wants to merge 6 commits into
Open
Max Thompson (thompsonmax) wants to merge 6 commits into
Max Thompson (thompsonmax) wants to merge 6 commits into
Conversation
2 tasks
Max Thompson (thompsonmax)
force-pushed
the
token-exchange-broker
branch
from
October 27, 2026 21:04
5185d77 to
4d5ff5c
Compare
Max Thompson (thompsonmax)
marked this pull request as ready for review
November 13, 2026 19:02
A replace_headers entry can now set token_exchange, naming an RFC 8693 token endpoint, an audience, and scopes. The egress gateway will exchange the actor's JWT there and inject the returned access token. ateapi requires token_url to be https with a DNS hostname and no userinfo, query, or fragment. It also rejects a policy unless one of its https rules allows the token_url's host and port, so the endpoint stays within what the policy already allows. EgressPolicyTemplate gets the same check. The gateway does not exchange tokens yet and denies a request that carries a token_exchange header with a 500. Without that case the entry would reach the credential provider with an empty URI. Signed-off-by: Max Thompson <maxthomp@google.com>
Egress policies will let the gateway exchange an actor JWT for an access token at an RFC 8693 endpoint. Add the client for that. It posts the token exchange form, caps the response at 1 MiB, follows no redirects, ignores proxy environment variables, and maps endpoint errors to gRPC codes that the gateway can turn into a 403, 500, or 503. Add --token-exchange-ca-file for endpoints with private certificates. The router builds the client at startup so a bad file fails startup. Nothing calls the client yet. Signed-off-by: Max Thompson <maxthomp@google.com>
Add tokenexchange.Broker, which mints a 300-second actor JWT bound to the exchange's audience, exchanges it, and caches the access token per actor, token URL, audience, and scopes. A token is reused until a third of its lifetime or 30 seconds remains, whichever comes first, and for 60 seconds when the endpoint returns no expires_in. Concurrent requests for one token share a single exchange. The exchange outlives a caller that gives up, so a slow endpoint still fills the cache for the next request, and it has its own 10-second deadline so an endpoint that never answers cannot hold the exchange forever. Mint failures wrap ErrMint so the gateway can map them like other actor JWT mint failures. Signed-off-by: Max Thompson <maxthomp@google.com>
TestSecretLikeFieldsAreLabeled flags fields whose names look like credentials. token_exchange holds an endpoint, an audience, and scopes, and token_url can carry no userinfo or query, so neither holds a secret. The token URL check now skips headers that use another source, and the token_url doc names the DNS hostname rule. The http-rule test case now fails on the protocol alone, and the scopes limits have test cases. Signed-off-by: Max Thompson <maxthomp@google.com>
A malformed token response's JSON error can quote the endpoint's own text, such as an expires_in number a megabyte long. Clip it like the other endpoint-supplied error fields. Exchange's doc now names each error code by outcome. New tests cover DEL and a space in access_token and a truncated response body, and the deadline test uses an expired context instead of waiting. Signed-off-by: Max Thompson <maxthomp@google.com>
Each token_exchange entry costs a pass over every rule when ateapi checks that an https rule allows its token URL. A policy with thousands of entries could cost seconds of CPU. Reject more than 16, the same bound as one rule's replace_headers, before running the check. Signed-off-by: Max Thompson <maxthomp@google.com>
Max Thompson (thompsonmax)
force-pushed
the
token-exchange-broker
branch
from
November 13, 2026 19:32
f46bd45 to
83cb7d6
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #1661. Stacked on #3334 and #3335. Only "atenet: cache RFC 8693 token exchanges in a broker" is new; the other commits are from #3334 and #3335.
tokenexchange.Broker. It mints a 300-second actor JWT bound to the exchange'saudiencethrough the gateway'sactorjwt.Minter, exchanges it with the atenet: add an RFC 8693 token exchange client to the egress gateway #3335 client, and caches the access token per actor,token_url,audience, and scopes. It copiesactorjwt.Minter'scache.Expiringand detached singleflight.expires_in.DeadlineExceeded.ErrMint, so the gateway can map it as it maps actor JWT mint failures. An endpoint'sPermissionDeniedneeds a different status than the minter's.Nothing calls the broker until the next PR wires it into
applyEffects. It takes the minter through a one-method interface so its tests can use a fake.Testing:
synctestunit tests cover the reuse windows, collapsed concurrent exchanges, an abandoned exchange still filling the cache, the hung-endpoint deadline, the cache key, and error handling. Each fails when the code it covers is removed. A module-widego test -race ./...passes exceptcmd/ateworker-microvm/internal/child, which fails on main on macOS too, and an atelet registry test that timed out under load and passes alone.hack/verify-all.shpasses.AI use: AI-assisted (Claude Code) for code, tests, and docs. I reviewed and tested it.