03b5de300c
Implements cross-IdP token verification for the AGNTCY ecosystem: - Migration 015: federation_partners table (issuer, jwks_uri, allowed_organizations JSONB, status, expires_at) - FederationService: registerPartner (JWKS validation at registration), listPartners, getPartner, updatePartner, deletePartner, verifyFederatedToken (alg:none rejected, RS256/ES256 only, allowedOrganizations filter, expiry enforcement) - JWKS caching in Redis (TTL: FEDERATION_JWKS_CACHE_TTL_SECONDS); cache invalidated on partner delete and jwks_uri change - FederationController + routes: 5 admin:orgs endpoints + POST /federation/verify (agents:read) - OPA policy: 5 federation admin endpoint → admin:orgs mappings - 499 unit tests passing; 94.69% statement coverage on FederationService Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
30 lines
1.9 KiB
JSON
30 lines
1.9 KiB
JSON
{
|
|
"endpoint_permissions": {
|
|
"GET:/api/v1/agents": ["agents:read"],
|
|
"GET:/api/v1/agents/:id": ["agents:read"],
|
|
"POST:/api/v1/agents": ["agents:write"],
|
|
"PATCH:/api/v1/agents/:id": ["agents:write"],
|
|
"DELETE:/api/v1/agents/:id": ["agents:write"],
|
|
"GET:/api/v1/agents/:id/credentials": ["agents:read"],
|
|
"POST:/api/v1/agents/:id/credentials": ["agents:write"],
|
|
"POST:/api/v1/agents/:id/credentials/:credId/rotate": ["agents:write"],
|
|
"DELETE:/api/v1/agents/:id/credentials/:credId": ["agents:write"],
|
|
"POST:/api/v1/token/introspect": ["tokens:read"],
|
|
"POST:/api/v1/token/revoke": ["tokens:read"],
|
|
"GET:/api/v1/audit": ["audit:read"],
|
|
"GET:/api/v1/audit/:id": ["audit:read"],
|
|
"POST:/api/v1/organizations": ["admin:orgs"],
|
|
"GET:/api/v1/organizations": ["admin:orgs"],
|
|
"GET:/api/v1/organizations/:id": ["admin:orgs"],
|
|
"PATCH:/api/v1/organizations/:id": ["admin:orgs"],
|
|
"DELETE:/api/v1/organizations/:id": ["admin:orgs"],
|
|
"POST:/api/v1/organizations/:id/members": ["admin:orgs"],
|
|
"GET:/api/v1/agents/:agentId/did/resolve": ["agents:read"],
|
|
"POST:/api/v1/federation/trust": ["admin:orgs"],
|
|
"GET:/api/v1/federation/partners": ["admin:orgs"],
|
|
"GET:/api/v1/federation/partners/:id": ["admin:orgs"],
|
|
"PATCH:/api/v1/federation/partners/:id": ["admin:orgs"],
|
|
"DELETE:/api/v1/federation/partners/:id": ["admin:orgs"]
|
|
}
|
|
}
|