84877e5146
Backend (Rust): - Create proto/auth.proto with Login and RefreshToken RPCs - Implement AuthGrpcService in services/api with JWT issuance - Register as unauthenticated service in main.rs (pre-auth) - Update JWT issuer from foxhunt-api-gateway to foxhunt-api Dashboard (TypeScript): - Install @connectrpc/connect-web + @bufbuild/protobuf - Generate TypeScript proto clients via buf (src/gen/) - Create grpc.ts transport with JWT interceptor - Rewrite all useApi hooks to typed gRPC calls - Replace WebSocket with useGrpcStream server-streaming hooks - Migrate all 6 pages + 6 components to grpc-web - Delete api.ts, websocket.ts, useWebSocket.ts Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
35 lines
1.1 KiB
Rust
35 lines
1.1 KiB
Rust
//! Authentication module for API Gateway
|
|
//!
|
|
//! Provides comprehensive 6-layer authentication for all incoming gRPC requests:
|
|
//! 1. mTLS client certificate validation (tonic-tls)
|
|
//! 2. JWT extraction from Authorization header
|
|
//! 3. JWT revocation check (Redis-backed)
|
|
//! 4. JWT signature and expiration validation
|
|
//! 5. RBAC permission check (cached)
|
|
//! 6. Rate limiting (in-memory atomic counters)
|
|
//! 7. User context injection (gRPC metadata)
|
|
//! 8. Async audit logging (non-blocking)
|
|
//!
|
|
//! Performance targets:
|
|
//! - Total overhead: <10μs per request
|
|
//! - JWT validation: <1μs (cached decoding key)
|
|
//! - Revocation check: <500ns (Redis in same AZ)
|
|
//! - Authorization: <100ns (in-memory cache)
|
|
//! - Rate limiting: <50ns (atomic counters)
|
|
|
|
pub mod grpc_login;
|
|
pub mod interceptor;
|
|
pub mod jwt;
|
|
#[cfg(feature = "mfa")]
|
|
pub mod mfa;
|
|
pub mod mtls;
|
|
|
|
// Re-export core authentication types
|
|
pub use interceptor::{
|
|
AuditLogger, AuthInterceptor, AuthzService, CacheStats, Jti, JwtClaims, JwtService,
|
|
RateLimiter, RevocationService, UserContext,
|
|
};
|
|
|
|
// Re-export mTLS types
|
|
pub use mtls::{ApiGatewayTlsConfig, TlsInterceptor, TlsProtocolVersion};
|