refactor(auth): remove sandbox token revocation

Author: TaylorMutch

architecture/gateway.md

@@ -46,6 +46,13 @@ Sandbox supervisor RPCs authenticate with either mTLS material or a sandbox
 secret depending on the runtime and deployment mode. User-facing mutations are
 authorized by role policy when OIDC or edge identity is enabled.
 
+Sandbox secrets are gateway-signed JWTs bound to a single sandbox ID. Docker,
+Podman, and VM drivers deliver the initial token through supervisor-only
+runtime material; Kubernetes supervisors exchange a projected ServiceAccount
+token through `IssueSandboxToken`. Supervisors renew gateway JWTs in memory
+before expiry. Older tokens are not server-revoked; deployments bound replay
+exposure with short `gateway_jwt.ttl_secs` lifetimes.
+
 ## API Surface
 
 The gateway API is organized around platform objects and operational streams:

crates/openshell-core/src/config.rs

@@ -342,7 +342,7 @@ pub struct GatewayJwtConfig {
     /// hostname-or-`openshell` placeholder if unset.
     #[serde(default = "default_gateway_id")]
     pub gateway_id: String,
-    /// Token lifetime in seconds. Defaults to 24 hours.
+    /// Token lifetime in seconds. Defaults to 1 hour.
     #[serde(default = "default_sandbox_token_ttl_secs")]
     pub ttl_secs: u64,
 }
@@ -352,7 +352,7 @@ fn default_gateway_id() -> String {
 }
 
 const fn default_sandbox_token_ttl_secs() -> u64 {
-    86_400
+    3_600
 }
 
 fn default_roles_claim() -> String {

crates/openshell-sandbox/src/debug_rpc.rs

@@ -7,7 +7,7 @@
 //! flow (issue #1354). A `docker exec` (or `kubectl exec`) into a
 //! running sandbox can issue raw sandbox-class gRPC calls without
 //! standing up a custom binary inside the sandbox image — useful for
-//! confirming the cross-sandbox IDOR guard and refresh semantics.
+//! confirming the cross-sandbox IDOR guard and renewal semantics.
 //!
 //! Subcommands:
 //! - `get-sandbox-config --sandbox-id <id>` — call `GetSandboxConfig`
@@ -53,7 +53,7 @@ usage: openshell-sandbox debug-rpc <command> [options]
 
 commands:
   get-sandbox-config --sandbox-id <UUID>  call GetSandboxConfig
-  refresh                                 call RefreshSandboxToken
+  refresh                                 renew the gateway JWT
   show-token                              print raw gateway JWT
   show-principal                          print decoded JWT claims
 

crates/openshell-sandbox/src/grpc_client.rs

@@ -43,15 +43,15 @@ use tracing::{debug, info, warn};
 pub type AuthedChannel = InterceptedService<Channel, AuthInterceptor>;
 
 /// Shared, refreshable Bearer header. All [`AuthInterceptor`] clones read
-/// the same slot, so the PR-5 refresh task can rotate the token in place
-/// without rebuilding the channel.
+/// the same slot, so the renewal task can replace the token in place without
+/// rebuilding the channel.
 type TokenSlot = Arc<RwLock<AsciiMetadataValue>>;
 
 /// Process-wide token slot. Initialized by the first [`connect_channel`]
-/// call and shared with every subsequent client + the refresh loop.
+/// call and shared with every subsequent client and the renewal loop.
 static TOKEN_SLOT: OnceLock<TokenSlot> = OnceLock::new();
 
-/// One-shot guard so the refresh loop spawns at most once per process.
+/// One-shot guard so the renewal loop spawns at most once per process.
 static REFRESH_SPAWNED: OnceLock<()> = OnceLock::new();
 
 fn install_token_slot(token: &str) -> Result<TokenSlot> {
@@ -68,8 +68,8 @@ fn install_token_slot(token: &str) -> Result<TokenSlot> {
 }
 
 /// gRPC interceptor that injects `authorization: Bearer <token>` on every
-/// outbound request. The token lives in a shared [`TokenSlot`] so the
-/// PR-5 refresh task can replace it without rebuilding clients.
+/// outbound request. The token lives in a shared [`TokenSlot`] so the renewal
+/// task can replace it without rebuilding clients.
 #[derive(Clone)]
 pub struct AuthInterceptor {
     bearer: TokenSlot,
@@ -162,9 +162,9 @@ async fn build_plain_channel(endpoint: &str) -> Result<Channel> {
 /// First call per process resolves the sandbox JWT via the three-step
 /// lookup (env → file → K8s SA bootstrap exchange) and installs it into
 /// the process-wide [`TOKEN_SLOT`]. Subsequent calls reuse the cached
-/// slot — the refresh loop keeps the value fresh, so re-running the
+/// slot — the renewal loop keeps the value fresh, so re-running the
 /// bootstrap is both unnecessary and (on the K8s SA path) expensive
-/// (one apiserver round-trip per call). The refresh loop itself is
+/// (one apiserver round-trip per call). The renewal loop itself is
 /// spawned once per process via [`REFRESH_SPAWNED`].
 async fn connect_channel(endpoint: &str) -> Result<AuthedChannel> {
     let channel = build_plain_channel(endpoint).await?;
@@ -250,7 +250,7 @@ pub async fn connect_channel_pub(endpoint: &str) -> Result<AuthedChannel> {
     connect_channel(endpoint).await
 }
 
-/// Background task that rotates the sandbox JWT at ~80% of its remaining
+/// Background task that renews the sandbox JWT at ~80% of its remaining
 /// lifetime. The new token replaces the value in [`TOKEN_SLOT`], so all
 /// in-flight and future clients pick it up on their next request. The
 /// loop never panics: every failure is logged and re-attempted after a
@@ -270,7 +270,7 @@ async fn refresh_token_loop(channel: AuthedChannel, slot: TokenSlot) {
                     Ok(value) => {
                         if let Ok(mut guard) = slot.write() {
                             *guard = value;
-                            info!("rotated gateway sandbox JWT in-place");
+                            info!("renewed gateway sandbox JWT in-place");
                         }
                     }
                     Err(e) => warn!(error = %e, "refreshed JWT contained invalid header bytes"),

crates/openshell-server/src/auth/guard.rs

@@ -89,7 +89,6 @@ mod tests {
             sandbox_id: id.to_string(),
             source: SandboxIdentitySource::BootstrapJwt {
                 issuer: "openshell-gateway:test".to_string(),
-                jti: "j-1".to_string(),
             },
             trust_domain: Some("openshell".to_string()),
         })

crates/openshell-server/src/auth/mod.rs

@@ -16,7 +16,6 @@ pub mod identity;
 pub mod k8s_sa;
 pub mod oidc;
 pub mod principal;
-pub mod revocation;
 pub mod sandbox_jwt;
 
 pub use http::router;

crates/openshell-server/src/auth/principal.rs

@@ -70,7 +70,7 @@ pub struct SandboxPrincipal {
 pub enum SandboxIdentitySource {
     /// Gateway-minted JWT validated against the gateway's signing key.
     /// Produced by [`super::sandbox_jwt::SandboxJwtAuthenticator`].
-    BootstrapJwt { issuer: String, jti: String },
+    BootstrapJwt { issuer: String },
     /// Per-sandbox client certificate. Reserved for the v2 channel-bound
     /// identity follow-up.
     BootstrapCert { fingerprint: String },