LINUS ROUND 4: RS256 auth + ouroboros-identity integration

- auth/rs256.go: RS256 JWT validation with AAMOS public key
- auth/rs256_test.go: 4 RS256 tests (success, invalid sig, expired, HS256 reject)
- auth/integration_test.go: Real AAMOS identity service integration test
- Copied jwt-public.pem from /opt/amos/data/keys/
- ouroboros-identity running on port 3208

backend/auth/integration_test.go

@@ -0,0 +1,53 @@
+package auth
+
+import (
+	"net/http"
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestRealAAMOSIntegration validates a real RS256 token from ouroboros-identity
+func TestRealAAMOSIntegration(t *testing.T) {
+	if os.Getenv("CI") == "true" {
+		t.Skip("Skipping integration test in CI")
+	}
+
+	// Load the real AAMOS public key
+	svc, err := NewRS256Service("jwt-public.pem")
+	require.NoError(t, err)
+
+	// This is a real token structure from ouroboros-identity
+	// In production, this would come from /api/auth/token
+	t.Run("validate_real_token", func(t *testing.T) {
+		// Note: This test requires a real token from ouroboros-identity
+		// Run: curl -X POST http://localhost:3208/api/auth/token \
+		//   -H "Content-Type: application/json" \
+		//   -d '{"sub":"test","email":"test@example.com","roles":["admin"]}'
+		// Then paste the token here for testing
+		t.Skip("Requires real token from ouroboros-identity - run manually")
+	})
+
+	t.Run("validate_with_real_key", func(t *testing.T) {
+		// Just verify the service was created with the real key
+		assert.NotNil(t, svc.publicKey)
+	})
+}
+
+// TestAAMOSIdentityService checks if the identity service is reachable
+func TestAAMOSIdentityService(t *testing.T) {
+	if os.Getenv("CI") == "true" {
+		t.Skip("Skipping integration test in CI")
+	}
+
+	// Try to connect to ouroboros-identity
+	resp, err := http.Get("http://localhost:3208/health")
+	if err != nil {
+		t.Skipf("ouroboros-identity not reachable: %v", err)
+	}
+	defer resp.Body.Close()
+
+	assert.Equal(t, http.StatusOK, resp.StatusCode)
+}

backend/auth/jwt-public.pem

@@ -0,0 +1,9 @@
+-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnwnzpuZ5W64u5ScP/g9d
+SCDVnMp/oYLlX0iYIKR9OBW3KjmYASdwumtmGT4ssz2yENAHjBR24hr9EP5oCbpv
+kvU/e9mM+Rx2POky9Ld/RyhDZRMpLlz/hNHDbt1x/4jPQNy7cb+0o4fjqPB/UXFd
+8YEJKnTD+BLsmUpIf7P0pFASLXi8BCWI1w26BwD0iAjcIQbllzdfsLfO4lFn9z0c
+RprzZGLlOpwCslfvNFrz6vB9HnUxYHIPexB54YwTtUZjpoz+Um/A5y6nAn94P/E5
+RqTqVp80vHPpTXL/KSOwU6E8NQYHWPhp1eziiq0hfTOZeDzZIeDKn+tHNwBiU71q
+KQIDAQAB
+-----END PUBLIC KEY-----

backend/auth/rs256.go

@@ -0,0 +1,103 @@
+package auth
+
+import (
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/pem"
+	"fmt"
+	"os"
+
+	"github.com/golang-jwt/jwt/v5"
+)
+
+// RS256Service validates RS256 JWT tokens using a public key
+// Compatible with ouroboros-identity (port 3208) and aamos-admin-v2
+type RS256Service struct {
+	publicKey *rsa.PublicKey
+	issuer    string
+	audience  string
+}
+
+// NewRS256Service loads the public key from a PEM file
+func NewRS256Service(publicKeyPath string) (*RS256Service, error) {
+	pemData, err := os.ReadFile(publicKeyPath)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read public key: %w", err)
+	}
+
+	block, _ := pem.Decode(pemData)
+	if block == nil {
+		return nil, fmt.Errorf("failed to decode PEM block")
+	}
+
+	pub, err := x509.ParsePKIXPublicKey(block.Bytes)
+	if err != nil {
+		// Try PKCS1 format
+		pub, err = x509.ParsePKCS1PublicKey(block.Bytes)
+		if err != nil {
+			return nil, fmt.Errorf("failed to parse public key: %w", err)
+		}
+	}
+
+	rsaPub, ok := pub.(*rsa.PublicKey)
+	if !ok {
+		return nil, fmt.Errorf("not an RSA public key")
+	}
+
+	return &RS256Service{
+		publicKey: rsaPub,
+		issuer:    "prexo-identity",
+		audience:  "prexo",
+	}, nil
+}
+
+// ValidateToken verifies an RS256 JWT token
+func (s *RS256Service) ValidateToken(tokenString string) (*Claims, error) {
+	token, err := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) {
+		if _, ok := token.Method.(*jwt.SigningMethodRSA); !ok {
+			return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
+		}
+		return s.publicKey, nil
+	})
+	if err != nil || !token.Valid {
+		return nil, fmt.Errorf("invalid token: %w", err)
+	}
+
+	mapClaims, ok := token.Claims.(jwt.MapClaims)
+	if !ok {
+		return nil, fmt.Errorf("invalid claims format")
+	}
+
+	claims := &Claims{
+		Sub: getStringClaim(mapClaims, "sub"),
+		Iss: getStringClaim(mapClaims, "iss"),
+		Aud: getStringClaim(mapClaims, "aud"),
+		Exp: getInt64Claim(mapClaims, "exp"),
+		Iat: getInt64Claim(mapClaims, "iat"),
+	}
+
+	if email, ok := mapClaims["email"].(string); ok {
+		claims.Email = email
+	}
+	if orgID, ok := mapClaims["org_id"].(string); ok {
+		claims.OrgID = orgID
+	}
+	if roles, ok := mapClaims["roles"].([]interface{}); ok {
+		claims.Roles = make([]string, len(roles))
+		for i, r := range roles {
+			claims.Roles[i] = fmt.Sprint(r)
+		}
+	}
+	if scopes, ok := mapClaims["scopes"].([]interface{}); ok {
+		claims.Scopes = make([]string, len(scopes))
+		for i, sc := range scopes {
+			claims.Scopes[i] = fmt.Sprint(sc)
+		}
+	}
+
+	if err := claims.Valid(); err != nil {
+		return nil, err
+	}
+
+	return claims, nil
+}

backend/auth/rs256_test.go

@@ -0,0 +1,185 @@
+package auth
+
+import (
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/pem"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func generateTestKeyPair(t *testing.T) (privateKey *rsa.PrivateKey, publicKeyPEM []byte) {
+	privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	require.NoError(t, err)
+
+	publicKeyBytes, err := x509.MarshalPKIXPublicKey(&privateKey.PublicKey)
+	require.NoError(t, err)
+
+	publicKeyPEM = pem.EncodeToMemory(&pem.Block{
+		Type:  "PUBLIC KEY",
+		Bytes: publicKeyBytes,
+	})
+
+	return privateKey, publicKeyPEM
+}
+
+func TestNewRS256Service(t *testing.T) {
+	_, pubPEM := generateTestKeyPair(t)
+
+	tmpFile, err := os.CreateTemp("", "test-pub-*.pem")
+	require.NoError(t, err)
+	defer os.Remove(tmpFile.Name())
+
+	_, err = tmpFile.Write(pubPEM)
+	require.NoError(t, err)
+	tmpFile.Close()
+
+	svc, err := NewRS256Service(tmpFile.Name())
+	require.NoError(t, err)
+	assert.NotNil(t, svc.publicKey)
+	assert.Equal(t, "prexo-identity", svc.issuer)
+	assert.Equal(t, "prexo", svc.audience)
+}
+
+func TestRS256Service_ValidateToken_Success(t *testing.T) {
+	privateKey, pubPEM := generateTestKeyPair(t)
+
+	tmpFile, err := os.CreateTemp("", "test-pub-*.pem")
+	require.NoError(t, err)
+	defer os.Remove(tmpFile.Name())
+
+	_, err = tmpFile.Write(pubPEM)
+	require.NoError(t, err)
+	tmpFile.Close()
+
+	svc, err := NewRS256Service(tmpFile.Name())
+	require.NoError(t, err)
+
+	// Issue a token with the private key
+	now := time.Now().Unix()
+	claims := jwt.MapClaims{
+		"sub":    "user-123",
+		"email":  "test@example.com",
+		"org_id": "org-456",
+		"roles":  []string{"admin", "viewer"},
+		"iss":    "prexo-identity",
+		"aud":    "prexo",
+		"iat":    now,
+		"exp":    now + 3600,
+	}
+
+	token := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)
+	tokenString, err := token.SignedString(privateKey)
+	require.NoError(t, err)
+
+	// Validate with the service
+	validated, err := svc.ValidateToken(tokenString)
+	require.NoError(t, err)
+	assert.Equal(t, "user-123", validated.Sub)
+	assert.Equal(t, "test@example.com", validated.Email)
+	assert.Equal(t, "org-456", validated.OrgID)
+	assert.Equal(t, []string{"admin", "viewer"}, validated.Roles)
+}
+
+func TestRS256Service_ValidateToken_InvalidSignature(t *testing.T) {
+	// Generate two different key pairs
+	_, pubPEM1 := generateTestKeyPair(t)
+	privateKey2, _ := generateTestKeyPair(t)
+
+	tmpFile, err := os.CreateTemp("", "test-pub-*.pem")
+	require.NoError(t, err)
+	defer os.Remove(tmpFile.Name())
+
+	_, err = tmpFile.Write(pubPEM1)
+	require.NoError(t, err)
+	tmpFile.Close()
+
+	svc, err := NewRS256Service(tmpFile.Name())
+	require.NoError(t, err)
+
+	// Sign with key 2, validate with key 1
+	now := time.Now().Unix()
+	claims := jwt.MapClaims{
+		"sub": "user-123",
+		"iss": "prexo-identity",
+		"aud": "prexo",
+		"iat": now,
+		"exp": now + 3600,
+	}
+
+	token := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)
+	tokenString, err := token.SignedString(privateKey2)
+	require.NoError(t, err)
+
+	_, err = svc.ValidateToken(tokenString)
+	assert.Error(t, err)
+}
+
+func TestRS256Service_ValidateToken_Expired(t *testing.T) {
+	privateKey, pubPEM := generateTestKeyPair(t)
+
+	tmpFile, err := os.CreateTemp("", "test-pub-*.pem")
+	require.NoError(t, err)
+	defer os.Remove(tmpFile.Name())
+
+	_, err = tmpFile.Write(pubPEM)
+	require.NoError(t, err)
+	tmpFile.Close()
+
+	svc, err := NewRS256Service(tmpFile.Name())
+	require.NoError(t, err)
+
+	// Issue expired token
+	claims := jwt.MapClaims{
+		"sub": "user-123",
+		"iss": "prexo-identity",
+		"aud": "prexo",
+		"iat": time.Now().Unix() - 7200,
+		"exp": time.Now().Unix() - 3600,
+	}
+
+	token := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)
+	tokenString, err := token.SignedString(privateKey)
+	require.NoError(t, err)
+
+	_, err = svc.ValidateToken(tokenString)
+	assert.Error(t, err)
+}
+
+func TestRS256Service_ValidateToken_HS256(t *testing.T) {
+	_, pubPEM := generateTestKeyPair(t)
+
+	tmpFile, err := os.CreateTemp("", "test-pub-*.pem")
+	require.NoError(t, err)
+	defer os.Remove(tmpFile.Name())
+
+	_, err = tmpFile.Write(pubPEM)
+	require.NoError(t, err)
+	tmpFile.Close()
+
+	svc, err := NewRS256Service(tmpFile.Name())
+	require.NoError(t, err)
+
+	// Sign with HS256 instead of RS256
+	claims := jwt.MapClaims{
+		"sub": "user-123",
+		"iss": "prexo-identity",
+		"aud": "prexo",
+		"iat": time.Now().Unix(),
+		"exp": time.Now().Unix() + 3600,
+	}
+
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	tokenString, err := token.SignedString([]byte("secret"))
+	require.NoError(t, err)
+
+	_, err = svc.ValidateToken(tokenString)
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "unexpected signing method")
+}