Omar SobhandClaude Fable 5
cbc8d35a2e
- tc-auth JwtVerifier: OIDC discovery -> JWKS, RS256 with the issuer pinned, 5s leeway (the crate's default 60s would double the life of Clerk's 60s session tokens), key cache with one refresh on unknown kid (Clerk rotates). Serves auth.mode = clerk AND generic oidc — a Clerk instance IS an OIDC issuer, so one verifier covers both - AuthService.authenticate dispatches: JWT-shaped bearers take the hosted-identity path, everything else stays a local opaque session. External users JIT-provision keyed by the stable sub claim (users.auth_subject, unique partial index in migration 0007); an existing local account with the same email is LINKED, not duplicated; role tracks the issuer claim every request (org:admin -> Owner) - Config auth.mode = "clerk" (requires issuer_url; validated), server pins the issuer at boot, Helm values/configmap accept mode=clerk - Tests with REAL crypto, no mocks: fresh RSA keypairs, a live local issuer publishing real discovery + JWKS docs, Clerk-shaped tokens — JIT + role mapping, repeat-subject no-dup, expired refused (leeway regression), wrong-key forgery refused, foreign issuer refused, and the full router round trip with Authorization: Bearer <session JWT> - docs/clerk.md: dashboard session-token customization (email + org role claims), config, @clerk/nextjs getToken() wiring, what CI proves 157 Rust + 63 frontend tests + 29 journeys. Air-gapped installs keep local auth — Clerk is a cloud-only alternative, not a replacement. Co-Authored-By: Claude Fable 5 <[email protected]>
51 lines
1.3 KiB
TOML
51 lines
1.3 KiB
TOML
[package]
|
|
name = "tc-api"
|
|
version = "0.1.0"
|
|
edition.workspace = true
|
|
rust-version.workspace = true
|
|
license.workspace = true
|
|
publish.workspace = true
|
|
|
|
[dependencies]
|
|
async-stream = "0.3"
|
|
axum = "0.8"
|
|
futures = "0.3"
|
|
serde = { workspace = true }
|
|
serde_json = { workspace = true }
|
|
sqlx = { workspace = true }
|
|
reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }
|
|
tc-auth = { path = "../tc-auth" }
|
|
tc-billing = { path = "../tc-billing" }
|
|
tc-config = { path = "../tc-config" }
|
|
tc-db = { path = "../tc-db" }
|
|
tc-domain = { path = "../tc-domain" }
|
|
tc-runtime = { path = "../tc-runtime" }
|
|
tc-safety = { path = "../tc-safety" }
|
|
tc-scheduler = { path = "../tc-scheduler" }
|
|
tc-secrets = { path = "../tc-secrets" }
|
|
thiserror = { workspace = true }
|
|
time = { workspace = true }
|
|
tokio = { workspace = true }
|
|
urlencoding = "2"
|
|
uuid = { workspace = true }
|
|
|
|
[dev-dependencies]
|
|
jsonwebtoken = "9"
|
|
eventsource-stream = "0.2"
|
|
reqwest = { version = "0.12", default-features = false, features = [
|
|
"json",
|
|
"rustls-tls",
|
|
"stream",
|
|
] }
|
|
tc-llm = { path = "../tc-llm" }
|
|
tc-testkit = { path = "../tc-testkit" }
|
|
hex = "0.4"
|
|
hmac = "0.12"
|
|
base64 = "0.22"
|
|
rand_core = { version = "0.6", features = ["getrandom"] }
|
|
rsa = { version = "0.9", features = ["pem"] }
|
|
sha2 = "0.10"
|
|
|
|
[lints]
|
|
workspace = true
|