03b5de300c
Implements cross-IdP token verification for the AGNTCY ecosystem: - Migration 015: federation_partners table (issuer, jwks_uri, allowed_organizations JSONB, status, expires_at) - FederationService: registerPartner (JWKS validation at registration), listPartners, getPartner, updatePartner, deletePartner, verifyFederatedToken (alg:none rejected, RS256/ES256 only, allowedOrganizations filter, expiry enforcement) - JWKS caching in Redis (TTL: FEDERATION_JWKS_CACHE_TTL_SECONDS); cache invalidated on partner delete and jwks_uri change - FederationController + routes: 5 admin:orgs endpoints + POST /federation/verify (agents:read) - OPA policy: 5 federation admin endpoint → admin:orgs mappings - 499 unit tests passing; 94.69% statement coverage on FederationService Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
18 lines
1.1 KiB
SQL
18 lines
1.1 KiB
SQL
-- federation_partners: trusted external identity providers whose tokens this IdP will accept.
|
|
-- A partner is identified by its issuer URL. Its JWKS are fetched from jwks_uri and cached.
|
|
-- allowed_organizations is an optional allowlist of organization_id values from the partner's tokens.
|
|
-- An empty array means all organizations from this partner are accepted.
|
|
CREATE TABLE IF NOT EXISTS federation_partners (
|
|
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
name VARCHAR(255) NOT NULL,
|
|
issuer VARCHAR(512) NOT NULL UNIQUE,
|
|
jwks_uri VARCHAR(512) NOT NULL,
|
|
allowed_organizations JSONB NOT NULL DEFAULT '[]',
|
|
status VARCHAR(32) NOT NULL DEFAULT 'active', -- 'active' | 'suspended' | 'expired'
|
|
created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
|
|
updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
|
|
expires_at TIMESTAMPTZ -- NULL means never expires
|
|
);
|
|
CREATE INDEX IF NOT EXISTS idx_federation_partners_issuer ON federation_partners(issuer);
|
|
CREATE INDEX IF NOT EXISTS idx_federation_partners_status ON federation_partners(status);
|