feat(peerservice): add admission token provider#685
Draft
ZanzyTHEbar wants to merge 6 commits into
Draft
Conversation
Introduce provider-neutral admission config and verifier types for future federated network admission support. The new config is disabled by default and does not change handshake behavior.
Add a static JWKS-backed AdmissionVerifier implementation for provider-neutral federated admission. The verifier validates token signature, issuer, audience, expiry, network id, Anytype identity binding, subject, and required claims without wiring it into the handshake yet.
Add an additive handshake credentials field for provider-neutral admission tokens and propagate it through secureservice contexts. This only carries tokens for future admission enforcement; it does not validate tokens or change existing handshake behavior.
Add provider-neutral inbound admission enforcement by composing AdmissionVerifier with credential checking. Admission remains disabled by default, config-only enablement fails fast until verifier construction is wired, and callers can inject a verifier through NewWithAdmissionVerifier.
Build the JWT admission verifier from secure-service admission config when admission is enabled and no verifier was injected. JWKS retrieval is bounded, sanitized, and skipped for disabled admission or explicit verifier injection.
Allow an optional provider component to supply outbound admission tokens before dialing peers. Caller-provided tokens take precedence, provider errors fail closed, and no OIDC or token storage implementation is introduced.
Author
|
/oc please review this draft stacked PR, focusing on the delta after #684 |
This was referenced May 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stack
This is the sixth PR in the federated admission stack and is intended to be reviewed after:
It is draft until the lower stack lands.
Summary
AdmissionTokenProviderfor outbound handshake tokens.peerservicediscover an optional provider component and inject its token before transport dialing.CtxWithOutboundAdmissionTokenvalues and fail closed on provider errors.Scope
Validation
go test -buildvcs=false ./net/secureservice ./net/secureservice/handshake ./net/peerservicego test -buildvcs=false ./net/pool ./net/transport/quic ./net/transport/webtransport ./net/transport/yamuxgo test -buildvcs=false ./... -run '^$'go test -buildvcs=false ./...fails only in pre-existing unrelatednet/rpc/limiter TestLimiter_Concurrent_Bursts(40not <=38).