Feat: Add CPEX plugin #493
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,43 @@ | ||
| package contracts | ||
|
|
||
| // ClaimsCarrier is an optional capability interface a pipeline.Identity | ||
| // may implement to expose richer claim data than the minimal | ||
| // pipeline.Identity surface (Subject / ClientID / Scopes). | ||
| // | ||
| // It exists so consumers that want issuer / audience / auth-method / | ||
| // curated claims — chiefly the cpex plugin building a policy-input | ||
| // document — can read them without growing pipeline.Identity (which | ||
| // stays deliberately minimal so any auth shape can satisfy it). Mirrors | ||
| // the ContentSource pattern: consumers type-assert to this interface and | ||
| // simply skip the enrichment when the concrete identity doesn't | ||
| // implement it. | ||
| // | ||
| // if cc, ok := pctx.Identity.(contracts.ClaimsCarrier); ok { | ||
| // authMethod = cc.AuthMethod() | ||
| // claims = cc.Claims() | ||
| // } | ||
| // | ||
| // Producers (e.g. jwt-validation's claims adapter) curate what Claims | ||
| // returns — a small, safe-to-forward set (issuer, audience, expiry), NOT | ||
| // the full raw claim map. The session API and CPEX traces both surface | ||
| // this data, so producers must keep it free of secrets. | ||
| type ClaimsCarrier interface { | ||
| // Issuer is the token issuer (`iss`), or "" when not applicable. | ||
| Issuer() string | ||
|
|
||
| // Audience is the token audience list (`aud`), or nil. | ||
| Audience() []string | ||
|
|
||
| // AuthMethod names how the caller authenticated — "jwt", "mtls", | ||
| // "spiffe", etc. Drives policies that branch on authentication | ||
| // strength. "" when the producer can't classify it. | ||
| AuthMethod() string | ||
|
|
||
| // Claims returns a curated, string-valued claim set safe to forward | ||
| // into policy context and observability surfaces. Producers pick the | ||
| // keys (conventionally "issuer", "audience", "exp"); they MUST NOT | ||
| // dump the full raw claim map, which may contain secrets or PII. | ||
| // Values are strings so the set maps cleanly onto CPEX's | ||
| // SubjectExtension.Claims (map[string]string) without lossy coercion. | ||
| Claims() map[string]string | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Non-blocking / procedural note (the one standing item on this PR).
This adds
authbridge-cpexto the build matrix, so the image is unconditionally built and pushed toghcr.io/kagenti/kagenti-extensions/and taggedlatestonmain. The-tags cpexisolation correctly keeps the CGO/libcpex_ffi.abackend out of the three default pure-Go binaries — but it does not gate this separately-built image, which (with its FFI blob) flows into the midstream → RHOAI sync by default.If/when the org defines the research-vs-production boundary, this line is the lever: gate the image behind the experimental-tier / sync-exclude mechanism (or label it not-for-production). Purely a downstream-exposure governance call — the code itself is good to go.