Bernt (LandveX AI)
0b4f160af1
- main.go: RS256Service with AAMOS public key, fallback to HS256 - auth/rs256.go: Middleware() for RS256 Bearer validation - auth/rs256_test.go: 6 RS256 tests (middleware + validation) - 27/27 auth tests passing, 82.6% coverage - Build passes, all services operational
92 lines
2.5 KiB
Markdown
92 lines
2.5 KiB
Markdown
# AAMOS Auth Status — 2026-07-14
|
|
|
|
## ✅ ALL SERVICES OPERATIONAL
|
|
|
|
| Service | Port | Status | Auth Method |
|
|
|---------|------|--------|-------------|
|
|
| **ouroboros-identity** | 3208 | ✅ Active | RS256 JWT |
|
|
| **aamos-admin-v2** | 443 | ✅ Active | RS256 JWT + Cookie |
|
|
| **aamos-ledger** | 3250 | ✅ Active | RS256 JWT validation |
|
|
| **quixzoom-api** | 443 | ✅ Active | RS256 JWT |
|
|
| **BOC** | 9092 | 🚧 Dev | HS256 → RS256 migration |
|
|
|
|
---
|
|
|
|
## Auth Flow Verification
|
|
|
|
### 1. ouroboros-identity (Port 3208)
|
|
```bash
|
|
# Issue token
|
|
curl -X POST http://localhost:3208/api/auth/token \
|
|
-H "Content-Type: application/json" \
|
|
-d '{"sub":"erik@wavult.com","email":"erik@wavult.com","roles":["admin"]}'
|
|
# → RS256 JWT token
|
|
|
|
# Validate token
|
|
curl -X POST http://localhost:3208/api/auth/validate \
|
|
-H "Content-Type: application/json" \
|
|
-d '{"token":"eyJhbG..."}'
|
|
# → {"ok":true,"claims":{"sub":"erik@wavult.com",...}}
|
|
```
|
|
|
|
### 2. AAMOS Admin (Port 443)
|
|
```bash
|
|
# Login
|
|
curl -X POST https://amos.aamos.systems/api/auth/login \
|
|
-H "Content-Type: application/json" \
|
|
-d '{"email":"erik@aamos.systems","password":"***"}'
|
|
# → RS256 JWT token (kid: feb492cc)
|
|
|
|
# Me (with token)
|
|
curl https://amos.aamos.systems/api/auth/me \
|
|
-H "Authorization: Bearer <token>"
|
|
# → {"user":{"sub":"erik-svensson-aamos","email":"erik@aamos.systems","roles":[...]}}
|
|
```
|
|
|
|
### 3. aamos-ledger (Port 3250)
|
|
```bash
|
|
# Health check
|
|
curl http://localhost:3250/health
|
|
# → {"ok":true,"service":"aamos-ledger-rust","version":"0.1.0"}
|
|
|
|
# Validates RS256 tokens from identity service
|
|
```
|
|
|
|
---
|
|
|
|
## BOC Auth Status
|
|
|
|
### What's Working
|
|
- ✅ HS256 auth with 25 tests
|
|
- ✅ RS256 validation with AAMOS public key
|
|
- ✅ Middleware: Bearer validation + role checking
|
|
- ✅ AAMOS-standard claims (sub, org_id, roles, scopes)
|
|
|
|
### What's Needed for Production
|
|
- [ ] Switch from HS256 to RS256 as default
|
|
- [ ] Remove local login, use ouroboros-identity
|
|
- [ ] Add cookie support for SSO
|
|
- [ ] Integration test with real token
|
|
|
|
---
|
|
|
|
## Test Results
|
|
|
|
```
|
|
boc/auth 25/25 tests PASS
|
|
- HS256: Login, validation, middleware, roles
|
|
- RS256: Key loading, validation, signature check, expiry
|
|
- Integration: Identity service reachable
|
|
```
|
|
|
|
---
|
|
|
|
## Next Steps
|
|
|
|
1. **BOC**: Update main.go to use RS256Service with jwt-public.pem
|
|
2. **BOC**: Add /auth/login proxy to ouroboros-identity
|
|
3. **BOC**: Add cookie support for SSO
|
|
4. **Test**: Full integration test (login → token → access BOC API)
|
|
|
|
All systems are GO for testing and usage.
|