mirror of
https://github.com/hanzoai/agent.git
synced 2026-09-11 21:08:51 +00:00
zeekay
5d7b7e4262
DELETES:
internal/server/middleware/iam_auth.go (317 LOC)
internal/server/routes/auth.go (278 LOC)
internal/server/routes/ (now empty)
ADDS:
internal/server/middleware/identity.go (~95 LOC, gin adapter)
internal/server/middleware/identity_test.go
Net deletion: ~500 LOC of in-binary userinfo proxy + token cache +
OAuth callback + JWKS fetch — all of which hanzoai/gateway already
does. The gateway is now the trust boundary: it validates the IAM
JWT, strips client-supplied identity headers, and emits X-Org-Id /
X-User-Id / X-User-Email after verification. The binary trusts
those headers (per ~/work/hanzo/HANZO_BINARY.md).
server.go now wires:
- middleware.RequireIdentity(envBool("AGENTD_REQUIRE_IDENTITY"))
- middleware.APIKeyAuth(...) only when the operator pins one
Same shape ~/work/hanzo/tasks uses. The fused 'hanzo' binary will
import pkg/auth.RequireIdentity once and route every service
through the same middleware.
pkg/auth.WithOrgContext is now the single source of truth for the
org context key; pkg/agents.WithOrgContext delegates. Exactly one
way.