feat(secureservice): wire JWT admission config#684
Draft
ZanzyTHEbar wants to merge 5 commits into
Draft
Conversation
Introduce provider-neutral admission config and verifier types for future federated network admission support. The new config is disabled by default and does not change handshake behavior.
Add a static JWKS-backed AdmissionVerifier implementation for provider-neutral federated admission. The verifier validates token signature, issuer, audience, expiry, network id, Anytype identity binding, subject, and required claims without wiring it into the handshake yet.
Add an additive handshake credentials field for provider-neutral admission tokens and propagate it through secureservice contexts. This only carries tokens for future admission enforcement; it does not validate tokens or change existing handshake behavior.
Add provider-neutral inbound admission enforcement by composing AdmissionVerifier with credential checking. Admission remains disabled by default, config-only enablement fails fast until verifier construction is wired, and callers can inject a verifier through NewWithAdmissionVerifier.
Build the JWT admission verifier from secure-service admission config when admission is enabled and no verifier was injected. JWKS retrieval is bounded, sanitized, and skipped for disabled admission or explicit verifier injection.
Author
|
/oc please review this draft stacked PR, focusing on the delta after #683 |
This was referenced May 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stack
This is the fifth PR in the federated admission stack and is intended to be reviewed after:
It is draft until the lower stack lands.
Summary
AdmissionConfigwhen admission is enabled and no verifier was injected.Security
admission.enabledoradmission.requiredis set.Validation
go test -buildvcs=false ./net/secureservicego test -buildvcs=false ./net/secureservice/handshakego test -buildvcs=false ./... -run '^$'go test -buildvcs=false ./net/transport/quic ./net/transport/webtransport ./net/transport/yamuxgo test -buildvcs=false ./...fails only in pre-existing unrelatednet/rpc/limiter TestLimiter_Concurrent_Bursts(40not <=38).