Merged
Conversation
This returns a HS256 signed JWT that can be used to authenticate with standard claims attached alongside custom claims such as given and family name that can be customised later for more information While a secret is OK for the moment, we should move it to pub/priv keys in the future
Contributor
There was a problem hiding this comment.
Pull Request Overview
This PR adds local authentication support using JWT tokens and updates API documentation to reflect new OAuth2Password security requirements. Key changes include updating the CORS configuration to allow the Authorization header, introducing a new JWT middleware alongside new authentication endpoints, and updating Swagger annotations for secured endpoints.
Reviewed Changes
Copilot reviewed 32 out of 32 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| internal/api/server.go | Updated CORS configuration with the Authorization header. |
| internal/api/middleware/auth.go | Added a new JWT middleware for token validation. |
| internal/api/handler/* | Updated Swagger documentation for 401 responses and security annotations. |
| auth/* | Added new authentication endpoints and JWT token generation. |
| cmd/*, Makefile, .env.example | Introduced key generation and user management command changes. |
s0nny78
pushed a commit
that referenced
this pull request
Aug 29, 2025
* Initial user creation * Add sensible output if error is passd back * Add endpoint for authentication with username/password This returns a HS256 signed JWT that can be used to authenticate with standard claims attached alongside custom claims such as given and family name that can be customised later for more information While a secret is OK for the moment, we should move it to pub/priv keys in the future * Change signing to RSA keypairs * Implement JWKs * Update helpers to load keys from the fs * Refactor authn functions to seperate package * Add middleware to validate tokens * Authenticate integration tests * Update Swgger to use authentication * (core) swagger comment fmt * (chore) go mod tidy * (chore) Fix spelling mistake * Whitespace consistency and other minor nits * go fmt --------- Co-authored-by: ian <ian.miell@container-solutions.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.