vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-nats-auth: give issued user JWTs an exp

Browse source 
The user JWT the callout issues carried no exp, so nats-server armed no
expiry timer and a connection kept its grant until the client dropped it:
a deleted or re-minted agent queue secret, a removed OIDC client or an
expired access token never reached a live connection.

Every issued user JWT now expires at the presented OIDC token's exp
(read from the introspection answer) or an hour after issue, whichever
is sooner; the agent queue-secret path has no exp of its own and gets
the hour. Every queue client reconnects through an auth callback that
re-reads or re-mints its credential, so the forced reconnect presents a
current one.

Fixes #5432
This commit is contained in:
atlas 2026-10-17 15:09:06 +02:00 • committed by mara
commit e405c2b098
9 changed files with 245 additions and 69 deletions
Download patch file Download diff file Expand all files Collapse all files

7
swarm-queue-client/README.md
View file

@ -19,9 +19,10 @@ unix socket.
## The two properties that constrain the code
**A token expires.** Authelia issues `client_credentials` access tokens with
`expires_in: 3599`. Authentication happens at CONNECT, so a long-lived
connection is fine — but a _reconnect_ an hour later needs a token minted an
hour later.
`expires_in: 3599`. Authentication happens at CONNECT, and the user JWT
`swarm-nats-auth` issues expires no later than the token does, so the server
closes the connection within the hour and the _reconnect_ needs a token
minted after it.
**The refresh therefore lives in the auth callback, not in a timer.**
`async-nats` invokes it per connection attempt, so there is no window in which

7
swarm-queue-client/src/lib.rs
View file

@ -16,9 +16,10 @@
//! Two things about that shape drive everything here:
//!
//! - **A token expires.** Authelia issues `client_credentials` access tokens
//! with `expires_in: 3599`. Authentication happens at CONNECT, so a
//! long-lived connection is fine — but a *reconnect* an hour later needs a
//! token that was minted an hour later.
//! with `expires_in: 3599`. Authentication happens at CONNECT, and the user
//! JWT `swarm-nats-auth` issues expires no later than the token does, so
//! the server closes the connection within the hour and the *reconnect*
//! needs a token minted after it.
//! - **`async-nats` re-runs an auth callback per connection attempt** (it is
//! handed that attempt's nonce). So the refresh belongs in the callback and
//! not in a timer: there is no window in which the client presents a token