boc/AAMOS_AUTH_STATUS.md

AAMOS Auth Status — 2026-07-14

✅ ALL SERVICES OPERATIONAL

Service	Port	Status	Auth Method
ouroboros-identity	3208	✅ Active	RS256 JWT
aamos-admin-v2	443	✅ Active	RS256 JWT + Cookie
aamos-ledger	3250	✅ Active	RS256 JWT validation
quixzoom-api	443	✅ Active	RS256 JWT
BOC	9092	🚧 Dev	HS256 → RS256 migration

---

Auth Flow Verification

1. ouroboros-identity (Port 3208)

# Issue token
curl -X POST http://localhost:3208/api/auth/token \
  -H "Content-Type: application/json" \
  -d '{"sub":"erik@wavult.com","email":"erik@wavult.com","roles":["admin"]}'
# → RS256 JWT token

# Validate token
curl -X POST http://localhost:3208/api/auth/validate \
  -H "Content-Type: application/json" \
  -d '{"token":"eyJhbG..."}'
# → {"ok":true,"claims":{"sub":"erik@wavult.com",...}}

2. AAMOS Admin (Port 443)

# Login
curl -X POST https://amos.aamos.systems/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email":"erik@aamos.systems","password":"***"}'
# → RS256 JWT token (kid: feb492cc)

# Me (with token)
curl https://amos.aamos.systems/api/auth/me \
  -H "Authorization: Bearer <token>"
# → {"user":{"sub":"erik-svensson-aamos","email":"erik@aamos.systems","roles":[...]}}

3. aamos-ledger (Port 3250)

# Health check
curl http://localhost:3250/health
# → {"ok":true,"service":"aamos-ledger-rust","version":"0.1.0"}

# Validates RS256 tokens from identity service

---

BOC Auth Status

What's Working

• ✅ HS256 auth with 25 tests
• ✅ RS256 validation with AAMOS public key
• ✅ Middleware: Bearer validation + role checking
• ✅ AAMOS-standard claims (sub, org_id, roles, scopes)

What's Needed for Production

• Switch from HS256 to RS256 as default
• Remove local login, use ouroboros-identity
• Add cookie support for SSO
• Integration test with real token

---

Test Results

boc/auth          25/25 tests PASS
  - HS256: Login, validation, middleware, roles
  - RS256: Key loading, validation, signature check, expiry
  - Integration: Identity service reachable

---

Next Steps

1. BOC: Update main.go to use RS256Service with jwt-public.pem
2. BOC: Add /auth/login proxy to ouroboros-identity
3. BOC: Add cookie support for SSO
4. Test: Full integration test (login → token → access BOC API)

All systems are GO for testing and usage.