/goal /ultracode-workflows [RBAC-2] forwardAuth platform-auth service + Traefik middleware (apps private by Forgejo permission, zero app auth code) #29

New issue

Closed

opened 2026-07-01 02:03:44 +00:00 by plat · 0 comments

plat commented

2026-07-01 02:03:44 +00:00

Owner

Track/Wave: RBAC-2 · Wave G3 · Size L
Repos: mcp, gitops
Depends on: RBAC-1, DOM-1b

Why

Today any Forgejo-authenticated user can use any app regardless of repo access; there is no platform auth proxy. This makes 'private by default' real and removes per-app auth code.

Scope

A small service (separate from the MCP pod) implementing /forward: read the sealed session cookie, call the RBAC-1 probe, branch the four-tier table (anon→login, none+private→403 request-access, none+internal→read, read→allow, write→manage), inject X-Plat-User/Perm/Manage headers. Render the Traefik Middleware per app in the overlay renderer. FIX the hardcoded-plat owner-label bug (derive owner/repo from the namespace name owner--app--env). Close header-spoofing (strip X-Plat-* on any non-Traefik path).

Acceptance

On the staging platform: anon→Forgejo login; a logged-in user with no repo access on a private app→403 request-access with a working link; a read collaborator gets in; a write collaborator sees X-Plat-Manage:1; a non-Traefik path cannot inject honored spoofed headers.

Notes

Seam B (overlay renderer) — after DOM-1b.

Part of the First Client Deploy → Governance roadmap. The owning agent may recurse into its own subagent team (ultracode workflow) if the task warrants. Honor the seam-serialization: land on a shared seam by rebase, and don't start a seam position until the prior one has merged.

**Track/Wave:** `RBAC-2` · Wave **G3** · Size **L** **Repos:** `mcp`, `gitops` **Depends on:** RBAC-1, DOM-1b ## Why Today any Forgejo-authenticated user can use any app regardless of repo access; there is no platform auth proxy. This makes 'private by default' real and removes per-app auth code. ## Scope A small service (separate from the MCP pod) implementing /forward: read the sealed session cookie, call the RBAC-1 probe, branch the four-tier table (anon→login, none+private→403 request-access, none+internal→read, read→allow, write→manage), inject X-Plat-User/Perm/Manage headers. Render the Traefik Middleware per app in the overlay renderer. FIX the hardcoded-`plat` owner-label bug (derive owner/repo from the namespace name owner--app--env). Close header-spoofing (strip X-Plat-* on any non-Traefik path). ## Acceptance On the staging platform: anon→Forgejo login; a logged-in user with no repo access on a private app→403 request-access with a working link; a read collaborator gets in; a write collaborator sees X-Plat-Manage:1; a non-Traefik path cannot inject honored spoofed headers. ## Notes **Seam B (overlay renderer) — after DOM-1b.** --- *Part of the **First Client Deploy → Governance** roadmap. The owning agent may recurse into its own subagent team (ultracode workflow) if the task warrants. Honor the seam-serialization: land on a shared seam by rebase, and don't start a seam position until the prior one has merged.*

plat added this to the Client Deploy → Governance Roadmap milestone

2026-07-01 02:03:44 +00:00

plat added the

horizon:governance

roadmap

goal

labels

2026-07-01 02:03:44 +00:00

plat added a new dependency

2026-07-01 02:04:44 +00:00

#28 /goal /ultracode-workflows [RBAC-1] repo-permission authz in MCP (swap org-membership for the …/permission probe)

plat added a new dependency