[TaylorMutch]

Summary

Authenticate and authorize gateway-mediated application HTTP requests and WebSocket upgrades using configured gateway authentication, regardless of whether the separate app listener is enabled.

Rebased onto main at 2c31ac7e6. Stacked on feat/4953-authoritative-app-urls/TaylorMutch.

Related Issue

Closes #4722. Part of RFC 0017.

The linked issue has no state:accepted label; the author has verified repository ADMIN access.

Changes

• Resolve browser login origins through the gateway route index for both readable and hashed service hosts, preserving workspace authorization and the control-plane login boundary.
• Apply gateway identity, workspace access, and forwarding role/scope authorization before upstream connection.
• Add browser login with single-use bootstrap codes and bounded Secure/HttpOnly/SameSite=Strict host-only sessions.
• Use configured credential storage for sessions and shared revocation across gateway replicas.
• Separate gateway credentials from application bearer tokens/cookies, strip reserved credentials, and enforce origin/Fetch Metadata protections.

Release Notes

Breaking behavior: authenticated gateways require authentication for application requests with the app listener enabled or disabled. Direct app-listener authentication remains the ingress provider/application responsibility.

Testing

• Latest main rebase (2c31ac7e6): 2,553 server tests passed (34 ignored), 211 supervisor + 310 Kubernetes driver tests, 8 proxy tests, full Go SDK CI, 431 gateway + 6 workspace + 6 proxy Helm tests, and full repository pre-commit checks passed. All eight rebased layers independently passed locked Rust compilation with test targets. Dedicated supervisor rendering also verifies destination-CA delivery with the app listener enabled and disabled. Signed-OIDC browser regression covers hashed-host login, single-use redemption, authenticated sessions, cross-installation rejection, and anonymous denial.
• After the internal RPC separation in feat(supervisor): advertise accepted application route installations #4940, this rebased layer independently passed locked Rust compilation with test targets.
• Updated stack tip: 2,494 server library tests passed (34 ignored), 306 Kubernetes driver tests, RPC tracing coverage, SDK binding regeneration, and full repository pre-commit checks passed. The public discovery schema and generated SDK bindings are unchanged by the internal RPC refactor.
• Earlier HA validation, before the internal RPC separation: 3,136 runtime library tests passed (34 ignored), 48 Rust SDK mock tests, 8 proxy tests, full Go SDK CI, and 412 gateway + 6 workspace + 6 proxy Helm tests passed.
• Combined stack: full repository pre-commit (including strict Clippy), strict docs, and navigation checks passed.
• Earlier live Kubernetes validation, before the internal RPC separation: two gateways, shared supervisors, and proxy replicas; direct/proxy TLS and HTTP/WebSockets, abrupt owner-process loss/recovery, populated 2→1→2→1 scaling, route renewal/withdrawal, and discovery grant narrowing/regrant passed. Workload Pod identity, PID, and in-memory state survived owner handoff.
• Auth implementation validation also covered signed OIDC, TLS, independent gateway states, credential separation, CSRF, expiry/revocation, and a real Chrome browser login/session/logout test.

Qualification limits

Live HA validation exercised supervisor process/Pod loss on a local k3d cluster. Whole-node failure, real network partitions, metric-driven HPA, sustained production load, and published release artifacts remain unqualified. Grant-file projection contributes to revocation propagation time. Main now includes #4842 for gateway-mediated hashed hostnames. Direct application-listener/discovery hostnames remain readable; extending hashed naming to that path and installation-status presentation (#4670) remain separate work.

The example Kubernetes HTTPRoute controller is a deferred compatibility POC outside this stack.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Relevant implementation, configuration, and API documentation updated

PR dependency order: #4936 → #4940 → #4941 → #4956 → #4963 → #4964 → #4957 → #4958.

Replaces #4959, which GitHub automatically marked merged into its former SDK base when the rebased branches were published. This draft isolates the auth change against the URL layer; main was unchanged by that event.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-4963.docs.buildwithfern.com/openshell