feat: OIDC provider by alukach · Pull Request #132 · source-cooperative/data.source.coop

alukach · 2026-04-02T17:18:17Z

What I'm changing

Turns the data proxy into an OIDC provider so it can authenticate to the Source Cooperative API on behalf of each user, and adds an STS token-exchange endpoint so clients can trade an OIDC token for temporary S3-style credentials.

Highlights

OIDC provider — the proxy now mints and signs RSA JWTs and publishes them at GET /.well-known/openid-configuration and GET /.well-known/jwks.json, so the Source API (and other relying parties) can verify them. Supports zero-downtime key rotation by serving both the active and previous key in the JWKS.
Per-user API auth — replaces the single static api_secret with a flexible ApiAuth that signs a short-lived JWT scoped to the calling principal. Upstream API calls are now made as that user instead of with a shared secret.
STS token exchange — new /.sts endpoint with a _default role that trusts the auth provider, letting an authenticated user obtain temporary credentials.

Also included

New config module parses keys/secrets once per isolate (RSA PEM parsed a single time).
Object writes now return an S3 405 MethodNotAllowed instead of a misleading 404 (the proxy is read-only).
Upstream auth failures (401/403) now surface as S3 403 AccessDenied rather than a 500.
Cache keys are identity-scoped and URL-safe (hex-encoded subject).
Bumps multistore to 0.4.0, refreshes dependencies / cargo audit allowlist, and updates CI + deploy workflows to forward the new secrets.

Warning

this adds required env vars/secrets — OIDC_PROVIDER_KEY, OIDC_PROVIDER_KID, OIDC_PROVIDER_ISSUER, SESSION_TOKEN_KEY, AUTH_ISSUER. The worker will not boot without them. See the README → OIDC Provider for setup and the key-rotation procedure.

How to test it

Access the accompanying frontend PR (feat: OIDC auth source.coop#283) preview: https://source-cooperative-git-feat-oidc-auth-radiantearth.vercel.app/
Authenticate & access Restricted product (e.g. https://source-cooperative-git-feat-oidc-auth-radiantearth.vercel.app/alukach/alukach-experimentation). Verify ****
Set the env vars/secrets above (the README has a one-liner to generate an RSA key).
Discovery: curl https://<host>/.well-known/openid-configuration and /.well-known/jwks.json return the issuer and the active (+ previous, during rotation) keys.
Token exchange: exchange an OIDC token at /.sts and confirm temporary credentials are returned.
Behavior: a signed object download still streams; a PUT/POST/DELETE returns 405; a request the API rejects returns 403 AccessDenied (not 500).

PR Checklist

This PR has no breaking changes.
I have updated or added new tests to cover the changes in this PR.
This PR affects the Source Cooperative Frontend & API,
and I have opened issue/PR #XXX to track the change.

Related Issues

[Proposed Feature] Support auth from data proxy via OIDC tokens source.coop#237

Add multistore-oidc-provider dependency and wire up OIDC configuration loading from environment variables (OIDC_PROVIDER_KEY, OIDC_PROVIDER_KID, OIDC_PROVIDER_ISSUER) with optional key rotation support. Serve /.well-known/openid-configuration and /.well-known/jwks.json endpoints when OIDC is configured. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Introduce ApiAuth enum that supports OIDC JWT bearer tokens, static shared secrets (legacy), or no authentication. When OIDC config is present, the proxy signs a fresh JWT for each API request instead of using a static secret. This enables service-to-service auth via the OIDC provider added in previous commits. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…ng modules Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

github-actions · 2026-04-02T17:19:54Z

🚀 Latest commit deployed to https://source-data-proxy-pr-132.source-coop.workers.dev

Date: 2026-06-15T16:48:51Z
Commit: fef5e7b

The advisory covers a timing side-channel in RSA decryption. We only use RSA for signing JWTs, never decryption, so the vulnerable code path is never reached. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…DC configuration

Without an audience restriction, /.sts accepted an ID token minted for ANY OAuth client of AUTH_ISSUER and exchanged it for that user's credentials — a confused-deputy cross-client impersonation. AUTH_AUDIENCE is currently configured in no environment, so the endpoint was live and unrestricted. Fail closed: only mount /.sts when an audience restriction is configured, and short-circuit it with a 501 NotImplemented otherwise, so an unrestricted exchanger is never registered. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

account/product path segments are percent-decoded before being split out of the request path, then interpolated raw into the upstream API URL. A decoded `?`/`#`/`&` therefore injected query parameters into the secret-authenticated Source API call, and — combined with the ?subject=<hex> cache key — let an anonymous request forge a key colliding with an authenticated user's, poisoning their product resolution. Percent-encode account/product with a path-segment set (unreserved chars pass through unchanged, so ordinary slugs are byte-identical). Also drop the release-compiled-out debug_assert in cache_key_with_subject for a real separator choice, so a query-bearing URL can never silently forge a colliding key. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

An unset GitHub secret evaluated to empty, jq emitted an empty value, `secret bulk` succeeded, and the job went green — while every request to the worker panicked in load_config. Fail loudly if OIDC_PROVIDER_KEY or SESSION_TOKEN_KEY is empty, and add a post-deploy smoke test that curls / and /.well-known/jwks.json so a worker that can't boot turns the job red instead of shipping silently. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Superseded — reposting with inline comments.

claude · 2026-06-14T07:13:53Z

+            Err(e) => {
+                tracing::error!("failed to sign API auth JWT: {}", e);
+                None
+            }


Silent downgrade on JWT signing failure sends an unauthenticated request.

Returning None causes cached_fetch to omit the Authorization header and issue an anonymous API call. An authenticated user then sees AccessDenied (403) rather than a 500, hiding the real cause from both the user and operator logs.

The practical risk is low — JwtSigner::from_pem is called at startup and panics on a bad key, so runtime signing failures are very unlikely. A brief comment noting that None intentionally falls through to an anonymous request (which surfaces as AccessDenied) would make this non-obvious behaviour clear to future readers.

When OIDC_PROVIDER_KEY_PREVIOUS is set but OIDC_PROVIDER_KID_PREVIOUS is missing, the previous key was silently dropped from JWKS via `ok()?`, leaving no trace in the worker logs. Tokens signed with the old key then fail verification at relying parties with no diagnostic. Replace the silent `?` with an explicit warning, matching the existing warn-on-error branch for from_pem failures. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signing failures return None, causing the caller to issue an unauthenticated request that the API surfaces as AccessDenied (403) rather than a 500. The signing key is validated at startup so this is very unlikely at runtime; document the intentional fall-through so the non-obvious behaviour is clear to future readers. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

`default-features = false` with no feature list looked fragile (the review flagged it as relying on transitive features from multistore-sts). Document that on wasm32-unknown-unknown reqwest selects its fetch backend by target arch rather than a cargo feature, and that the methods we use (Client::new/send/text) are not feature-gated -- so no explicit list is needed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Superseded by a newer Claude review.

claude · 2026-06-15T06:41:09Z

Claude finished @alukach's task in 2m 31s —— View job

✅ No blocking issues — safe to merge.

All three blockers from the previous review are resolved in this sync:

Key rotation (src/config.rs:43–52): OIDC_PROVIDER_KEY_PREVIOUS set without OIDC_PROVIDER_KID_PREVIOUS now emits tracing::warn! and returns None explicitly — no more silent drop.
authorization_header downgrade (src/auth.rs:31–33): signing failure now logs tracing::error! and the fall-through-to-anonymous behaviour is documented in the function comment.
auth_audience docs: doc comment, README table row, and wrangler.toml comment all now correctly state that unset disables /.sts (returns 501) rather than the previous "any audience accepted" wording.

Two non-blocking items worth a quick check before merge:

wrangler.toml orphaned comment (wrangler.toml:32): # Recommended vars: is a leftover stub — the lines below it are actually "Required vars". Harmless but reads confusingly.
JWT TTL of 60 s (src/config.rs:35): the API-auth JWT lives only 60 seconds. If the Source Cooperative API verifier enforces exp without any clock-skew leeway, requests near the window boundary will intermittently 403. Worth confirming the verifier allows ≥ 5 s of leeway, or bumping the TTL to 120 s.

Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>

The env-var table claimed that leaving AUTH_AUDIENCE unset lets tokens for any client of AUTH_ISSUER work. The code fails closed instead: /.sts is disabled and returns 501 until AUTH_AUDIENCE is set (src/config.rs:87-92). Align the README with the actual behavior, as already documented in config.rs and wrangler.toml. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

alukach and others added 5 commits April 1, 2026 23:40

chore: add OIDC provider environment variables to wrangler.toml

f877b4b

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

fix: improve JWKS unwrap messages and clarify wrangler.toml comments

ec81b41

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs: update README with OIDC provider setup, key rotation, and missi…

2ab9f85

…ng modules Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

alukach temporarily deployed to preview April 2, 2026 17:18 — with GitHub Actions Inactive

alukach changed the title ~~Feat/OIDC provider~~ feat: OIDC provider Apr 2, 2026

alukach temporarily deployed to preview April 2, 2026 17:18 — with GitHub Actions Inactive

source-release-bot Bot added the feat label Apr 2, 2026

chore: ignore RUSTSEC-2023-0071 (rsa Marvin Attack)

9e1dd9f

The advisory covers a timing side-channel in RSA decryption. We only use RSA for signing JWTs, never decryption, so the vulnerable code path is never reached. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

alukach temporarily deployed to preview April 2, 2026 20:59 — with GitHub Actions Inactive

alukach temporarily deployed to preview April 2, 2026 21:00 — with GitHub Actions Inactive

feat: update dependencies to use multistore from git and implement OI…

5d27216

…DC configuration

alukach temporarily deployed to preview April 3, 2026 05:52 — with GitHub Actions Inactive

alukach temporarily deployed to preview April 3, 2026 05:53 — with GitHub Actions Inactive

Add secret to deployment

4992d1d

alukach temporarily deployed to preview April 3, 2026 06:04 — with GitHub Actions Inactive

alukach temporarily deployed to preview April 3, 2026 06:05 — with GitHub Actions Inactive

refactor: streamline previous OIDC key loading logic

a831c36

alukach temporarily deployed to preview April 3, 2026 06:09 — with GitHub Actions Inactive

alukach temporarily deployed to preview April 3, 2026 06:10 — with GitHub Actions Inactive

fix: avoid rewriting .well-known links

4b0c4c3

alukach temporarily deployed to preview April 3, 2026 06:14 — with GitHub Actions Inactive

fix: set issuer on previews

ffb6ae2

alukach temporarily deployed to preview April 3, 2026 06:21 — with GitHub Actions Inactive

alukach temporarily deployed to preview April 3, 2026 06:22 — with GitHub Actions Inactive

alukach added 2 commits April 6, 2026 22:07

refactor auth to separate module

e1aab7f

Add STS endpoint to make use of OIDC provider

549d155

alukach and others added 3 commits June 10, 2026 13:50

alukach temporarily deployed to preview June 10, 2026 21:06 — with GitHub Actions Inactive

Merge branch 'main' into feat/oidc-provider

b9f17cd

alukach temporarily deployed to preview June 14, 2026 07:04 — with GitHub Actions Inactive

This comment was marked as outdated.

Sign in to view

claude Bot reviewed Jun 14, 2026

View reviewed changes

Comment thread src/config.rs Outdated

claude Bot reviewed Jun 14, 2026

View reviewed changes

Comment thread Cargo.toml

This comment was marked as outdated.

Sign in to view

alukach and others added 3 commits June 14, 2026 22:53

alukach temporarily deployed to preview June 15, 2026 05:54 — with GitHub Actions Inactive

This comment was marked as outdated.

Sign in to view

claude Bot reviewed Jun 15, 2026

View reviewed changes

Comment thread src/config.rs Outdated

claude Bot reviewed Jun 15, 2026

View reviewed changes

Comment thread wrangler.toml Outdated

Merge branch 'main' into feat/oidc-provider

a5e9312

alukach temporarily deployed to preview June 15, 2026 06:40 — with GitHub Actions Inactive

alukach and others added 2 commits June 14, 2026 23:47

Apply suggestions from code review

be24094

Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>

tylere approved these changes Jun 15, 2026

View reviewed changes

source-release-bot Bot mentioned this pull request Jun 16, 2026

chore(main): release 2.2.0 #150

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: OIDC provider#132

feat: OIDC provider#132
alukach merged 59 commits into
mainfrom
feat/oidc-provider

alukach commented Apr 2, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Apr 2, 2026 •

edited

Loading

Uh oh!

This comment was marked as outdated.

Uh oh!

Uh oh!

claude Bot Jun 14, 2026

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

Uh oh!

Uh oh!

claude Bot commented Jun 15, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

alukach commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What I'm changing

Highlights

Also included

How to test it

PR Checklist

Related Issues

Uh oh!

github-actions Bot commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

Uh oh!

claude Bot Jun 14, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

Uh oh!

Uh oh!

claude Bot commented Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

alukach commented Apr 2, 2026 •

edited

Loading

github-actions Bot commented Apr 2, 2026 •

edited

Loading

claude Bot commented Jun 15, 2026 •

edited

Loading