foxhunt/AGENT_373_TOKEN_GENERATION_ANALYSIS.md

Agent 373: Test Token Generation Flow Analysis

Mission Summary

Analyzed JWT token generation in test helpers and compared against API Gateway validation to identify authentication failures.

Analysis Results

✅ Token Generation Flow (Integration Tests)

Location: /home/jgrusewski/Work/foxhunt/services/integration_tests/tests/common/auth_helpers.rs

Function: create_test_jwt() (Lines 231-259)

pub fn create_test_jwt(config: TestAuthConfig) -> Result<String> {
    let now = Utc::now();
    let claims = TestJwtClaims {
        jti: Uuid::new_v4().to_string(),
        sub: config.user_id,
        iat: now.timestamp() as u64,
        exp: (now + config.expiry_duration).timestamp() as u64,
        iss: "foxhunt-api-gateway".to_string(),    // ← CORRECT
        aud: "foxhunt-services".to_string(),       // ← CORRECT
        roles: config.roles,
        permissions: config.permissions,
        token_type: "access".to_string(),
        session_id: Some(Uuid::new_v4().to_string()),
    };

    let jwt_secret = get_test_jwt_secret();
    let token = encode(
        &Header::new(Algorithm::HS256),             // ← CORRECT ALGORITHM
        &claims,
        &EncodingKey::from_secret(jwt_secret.as_ref()),
    )?;
    Ok(token)
}

Function: get_test_jwt_secret() (Lines 175-187)

pub fn get_test_jwt_secret() -> String {
    std::env::var("JWT_SECRET").expect(
        "FATAL: JWT_SECRET must be set in .env file for E2E tests"
    )
}

❌ CRITICAL MISMATCH FOUND: Trading Service Tests

Location: /home/jgrusewski/Work/foxhunt/services/trading_service/tests/common/auth_helpers.rs

Function: create_test_jwt() (Lines 205-228)

pub fn create_test_jwt(config: TestAuthConfig) -> Result<String> {
    let now = Utc::now();
    let claims = TestJwtClaims {
        sub: config.user_id,
        exp: (now + config.expiry_duration).timestamp() as usize,
        iat: now.timestamp() as usize,
        iss: "foxhunt-trading".to_string(),        // ❌ WRONG ISSUER
        aud: "trading-api".to_string(),            // ❌ WRONG AUDIENCE
        roles: config.roles,
        permissions: config.permissions,
        jti: Uuid::new_v4().to_string(),
        token_type: "access".to_string(),
        session_id: Some(Uuid::new_v4().to_string()),
    };

    let jwt_secret = get_test_jwt_secret();
    let token = encode(
        &Header::new(Algorithm::HS256),             // ✅ Algorithm correct
        &claims,
        &EncodingKey::from_secret(jwt_secret.as_ref()),
    )?;
    Ok(token)
}

Function: get_test_jwt_secret() (Lines 122-127)

pub fn get_test_jwt_secret() -> String {
    std::env::var("JWT_SECRET")
        .unwrap_or_else(|_| DEFAULT_TEST_JWT_SECRET.to_string())
}

✅ API Gateway Validation Configuration

JWT Service (/home/jgrusewski/Work/foxhunt/services/api_gateway/src/auth/jwt/service.rs):

• Algorithm: Algorithm::HS256 (Line 314) ✅
• Issuer: "foxhunt-trading" (Line 103) ⚠️
• Audience: "trading-api" (Line 104) ⚠️

Interceptor (/home/jgrusewski/Work/foxhunt/services/api_gateway/src/auth/interceptor.rs):

• Algorithm: Algorithm::HS256 (Line 589) ✅
• Validation: Strict expiry, nbf, issuer, audience checks ✅

Issues Identified

🔴 Issue 1: Inconsistent Issuer/Audience Claims

Two competing standards exist:

1. Legacy (Trading Service):

   • Issuer: "foxhunt-trading"
   • Audience: "trading-api"

2. Modern (Integration Tests):

   • Issuer: "foxhunt-api-gateway"
   • Audience: "foxhunt-services"

API Gateway JWT Service expects: Legacy values (foxhunt-trading / trading-api)

Integration test helpers generate: Modern values (foxhunt-api-gateway / foxhunt-services)

Result: 🔴 TOKEN MISMATCH - Integration tests fail authentication

🟢 Issue 2: Algorithm Consistency (No Problem)

All components use Algorithm::HS256:

• ✅ Integration test helper: Header::new(Algorithm::HS256)
• ✅ Trading service test helper: Header::new(Algorithm::HS256)
• ✅ API Gateway JWT service: Validation::new(Algorithm::HS256)
• ✅ API Gateway interceptor: Validation::new(Algorithm::HS256)

Status: ✅ CORRECT - No algorithm mismatch

🟢 Issue 3: Encoding Key (No Problem)

All components use same secret source:

• ✅ Integration tests: std::env::var("JWT_SECRET") (fail-fast pattern)
• ✅ Trading service tests: std::env::var("JWT_SECRET") (with fallback)
• ✅ API Gateway: JwtConfig::load_jwt_secret() (from env or file)

Status: ✅ CORRECT - All use same secret

Root Cause Analysis

Why Tests Are Failing

Sequence of Events:

1. Integration test calls create_test_jwt() from integration_tests/tests/common/auth_helpers.rs
2. Token generated with claims:
   • iss: "foxhunt-api-gateway"
   • aud: "foxhunt-services"
3. Test sends gRPC request to API Gateway with token
4. API Gateway interceptor validates token with JwtService
5. JwtService expects:
   • iss: "foxhunt-trading"
   • aud: "trading-api"
6. Validation fails - Issuer/Audience mismatch
7. Test receives Status::unauthenticated("Invalid or expired token")

Evidence from Code

API Gateway JWT Service Configuration (Line 103-104):

jwt_issuer: "foxhunt-trading".to_string(),
jwt_audience: "trading-api".to_string(),

Validation Setup (implied from Validation::new()):

validation.set_issuer(&[&issuer]);      // Expected: "foxhunt-trading"
validation.set_audience(&[&audience]);  // Expected: "trading-api"

Integration Test Token Claims (Line 244-245):

iss: "foxhunt-api-gateway".to_string(),  // ❌ Does not match
aud: "foxhunt-services".to_string(),     // ❌ Does not match

Recommendations

Option A: Update Integration Test Helpers (Quick Fix)

File: /home/jgrusewski/Work/foxhunt/services/integration_tests/tests/common/auth_helpers.rs

Change Lines 244-245:

// FROM:
iss: "foxhunt-api-gateway".to_string(),
aud: "foxhunt-services".to_string(),

// TO:
iss: "foxhunt-trading".to_string(),
aud: "trading-api".to_string(),

Impact:

• ✅ Immediate fix (2 lines changed)
• ✅ Aligns with API Gateway expectations
• ⚠️ Maintains legacy naming (not ideal long-term)

Option B: Update API Gateway Configuration (Proper Fix)

File: /home/jgrusewski/Work/foxhunt/services/api_gateway/src/auth/jwt/service.rs

Change Lines 103-104:

// FROM:
jwt_issuer: "foxhunt-trading".to_string(),
jwt_audience: "trading-api".to_string(),

// TO:
jwt_issuer: "foxhunt-api-gateway".to_string(),
jwt_audience: "foxhunt-services".to_string(),

Impact:

• ✅ Modern, accurate naming (API Gateway is the issuer)
• ✅ Aligns with integration test expectations
• ⚠️ May break Trading Service tests (need to update their helpers too)

Option C: Comprehensive Standardization (Best Practice)

Strategy: Standardize on modern naming across ALL components

Files to Update:

1. /home/jgrusewski/Work/foxhunt/services/api_gateway/src/auth/jwt/service.rs

   • Lines 103-104: Change to foxhunt-api-gateway / foxhunt-services

2. /home/jgrusewski/Work/foxhunt/services/trading_service/tests/common/auth_helpers.rs

   • Lines 208-209: Change to foxhunt-api-gateway / foxhunt-services

3. /home/jgrusewski/Work/foxhunt/services/api_gateway/tests/auth_*.rs

   • Verify all test tokens use new values

Impact:

• ✅ Consistent naming across entire codebase
• ✅ Accurate (API Gateway IS the JWT issuer)
• ✅ Future-proof
• ⚠️ Requires testing all auth flows (integration + unit tests)

Decision Matrix

Option	Lines Changed	Risk	Test Coverage	Long-term	Recommendation
A	2	Low	Integration	Poor	Quick fix only
B	2	Medium	Need Trading tests	Good	Better
C	6-8	Medium	All tests	Best	✅ RECOMMENDED

Validation Plan

After implementing fix, verify:

1. ✅ Integration tests pass (15/15)
2. ✅ Trading service unit tests pass
3. ✅ API Gateway unit tests pass
4. ✅ JWT validation works end-to-end
5. ✅ Token revocation still works

Summary

Token Generation: ✅ CORRECT

• Algorithm: HS256 ✅
• Encoding key: JWT_SECRET ✅
• Claims structure: Complete ✅

Token Validation: ❌ ISSUER/AUDIENCE MISMATCH

• Test helper generates: foxhunt-api-gateway / foxhunt-services
• API Gateway expects: foxhunt-trading / trading-api
• Result: Authentication fails

Root Cause: Configuration inconsistency between test helpers and API Gateway

Recommended Fix: Option C (comprehensive standardization to modern naming)

---

Agent 373 Status: ✅ ANALYSIS COMPLETE Next Agent: Should implement Option C (standardize issuer/audience claims)