zeekay 387fe26bcc feat(ingress): IAM-gate hosts via shared iamauth pkg; add goproxy.hanzo.ai ...

Extract edge IAM validation — JWKS cache, JWT validation, token extraction
(Bearer + HTTP Basic password for go/.netrc + cookie), and the identity-header
trust boundary — into package iamauth, the single implementation shared by the
gin/KrakenD gateway middleware and the lightweight cmd/ingress host router. The
gateway middleware delegates via auth_compat.go; behavior unchanged, security
tests intact.

cmd/ingress gains optional per-host "auth": true — validates a Hanzo IAM token,
strips client identity headers, injects X-User-*, and drops the credential
before proxying. Wire goproxy.hanzo.ai (Athens module proxy) as the first
IAM-gated host; declare AUTH_* on the hanzo-ingress Deployment.

iamauth has unit tests (extraction precedence, strip⊇mint contract, identity
injection). go.sum gains the pinned go-jose/v4 v4.0.5 hash (completion, no bump).

2026-06-17 10:25:52 -07:00

..

hanzo

feat(ingress): IAM-gate hosts via shared iamauth pkg; add goproxy.hanzo.ai

2026-06-17 10:25:52 -07:00

lux

chore(rebrand): v2.13.0 — de-kraken gateway (strip KrakenD branding) (#10)

2026-04-21 13:07:55 -07:00