mirror of
https://github.com/trustgraph-ai/trustgraph.git
synced 2026-04-25 00:16:23 +02:00
67b2fc448f
Replaces the legacy GATEWAY_SECRET shared-token gate with an IAM-backed
identity and authorisation model. The gateway no longer has an
"allow-all" or "no auth" mode; every request is authenticated via the
IAM service, authorised against a capability model that encodes both
the operation and the workspace it targets, and rejected with a
deliberately-uninformative 401 / 403 on any failure.
IAM service (trustgraph-flow/trustgraph/iam, trustgraph-base/schema/iam)
-----------------------------------------------------------------------
* New backend service (iam-svc) owning users, workspaces, API keys,
passwords and JWT signing keys in Cassandra. Reached over the
standard pub/sub request/response pattern; gateway is the only
caller.
* Operations: bootstrap, resolve-api-key, login, get-signing-key-public,
rotate-signing-key, create/list/get/update/disable/delete/enable-user,
change-password, reset-password, create/list/get/update/disable-
workspace, create/list/revoke-api-key.
* Ed25519 JWT signing (alg=EdDSA). Key rotation writes a new kid and
retires the previous one; validation is grace-period friendly.
* Passwords: PBKDF2-HMAC-SHA-256, 600k iterations, per-user salt.
* API keys: 128-bit random, SHA-256 hashed. Plaintext returned once.
* Bootstrap is explicit: --bootstrap-mode {token,bootstrap} is a
required startup argument with no permissive default. Masked
"auth failure" errors hide whether a refused bootstrap request was
due to mode, state, or authorisation.
Gateway authentication (trustgraph-flow/trustgraph/gateway/auth.py)
-------------------------------------------------------------------
* IamAuth replaces the legacy Authenticator. Distinguishes JWTs
(three-segment dotted) from API keys by shape; verifies JWTs
locally using the cached IAM public key; resolves API keys via
IAM with a short-TTL hash-keyed cache. Every failure path
surfaces the same 401 body ("auth failure") so callers cannot
enumerate credential state.
* Public key is fetched at gateway startup with a bounded retry loop;
traffic does not begin flowing until auth has started.
Capability model (trustgraph-flow/trustgraph/gateway/capabilities.py)
---------------------------------------------------------------------
* Roles have two dimensions: a capability set and a workspace scope.
OSS ships reader / writer / admin; the first two are workspace-
assigned, admin is cross-workspace ("*"). No "cross-workspace"
pseudo-capability — workspace permission is a property of the role.
* check(identity, capability, target_workspace=None) is the single
authorisation test: some role must grant the capability *and* be
active in the target workspace.
* enforce_workspace validates a request-body workspace against the
caller's role scopes and injects the resolved value. Cross-
workspace admin is permitted by role scope, not by a bypass.
* Gateway endpoints declare a required capability explicitly — no
permissive default. Construction fails fast if omitted. Enterprise
editions can replace the role table without changing the wire
protocol.
WebSocket first-frame auth (dispatch/mux.py, endpoint/socket.py)
----------------------------------------------------------------
* /api/v1/socket handshake unconditionally accepts; authentication
runs on the first WebSocket frame ({"type":"auth","token":"..."})
with {"type":"auth-ok","workspace":"..."} / {"type":"auth-failed"}.
The socket stays open on failure so the client can re-authenticate
— browsers treat a handshake-time 401 as terminal, breaking
reconnection.
* Mux.receive rejects every non-auth frame before auth succeeds,
enforces the caller's workspace (envelope + inner payload) using
the role-scope resolver, and supports mid-session re-auth.
* Flow import/export streaming endpoints keep the legacy ?token=
handshake (URL-scoped short-lived transfers; no re-auth need).
Auth surface
------------
* POST /api/v1/auth/login — public, returns a JWT.
* POST /api/v1/auth/bootstrap — public; forwards to IAM's bootstrap
op which itself enforces mode + tables-empty.
* POST /api/v1/auth/change-password — any authenticated user.
* POST /api/v1/iam — admin-only generic forwarder for the rest of
the IAM API (per-op REST endpoints to follow in a later change).
Removed / breaking
------------------
* GATEWAY_SECRET / --api-token / default_api_token and the legacy
Authenticator.permitted contract. The gateway cannot run without
IAM.
* ?token= on /api/v1/socket.
* DispatcherManager and Mux both raise on auth=None — no silent
downgrade path.
CLI tools (trustgraph-cli)
--------------------------
tg-bootstrap-iam, tg-login, tg-create-user, tg-list-users,
tg-disable-user, tg-enable-user, tg-delete-user, tg-change-password,
tg-reset-password, tg-create-api-key, tg-list-api-keys,
tg-revoke-api-key, tg-create-workspace, tg-list-workspaces. Passwords
read via getpass; tokens / one-time secrets written to stdout with
operator context on stderr so shell composition works cleanly.
AsyncSocketClient / SocketClient updated to the first-frame auth
protocol.
Specifications
--------------
* docs/tech-specs/iam.md updated with the error policy, workspace
resolver extension point, and OSS role-scope model.
* docs/tech-specs/iam-protocol.md (new) — transport, dataclasses,
operation table, error taxonomy, bootstrap modes.
* docs/tech-specs/capabilities.md (new) — capability vocabulary, OSS
role bundles, agent-as-composition note, enforcement-boundary
policy, enterprise extensibility.
Tests
-----
* test_auth.py (rewritten) — IamAuth + JWT round-trip with real
Ed25519 keypairs + API-key cache behaviour.
* test_capabilities.py (new) — role table sanity, check across
role x workspace combinations, enforce_workspace paths,
unknown-cap / unknown-role fail-closed.
* Every endpoint test construction now names its capability
explicitly (no permissive defaults relied upon). New tests pin
the fail-closed invariants: DispatcherManager / Mux refuse
auth=None; i18n path-traversal defense is exercised.
* test_socket_graceful_shutdown rewritten against IamAuth.
|
||
|---|---|---|
| .. | ||
| tech-specs | ||
| api-gateway-changes-v1.8-to-v2.1.ar.md | ||
| api-gateway-changes-v1.8-to-v2.1.es.md | ||
| api-gateway-changes-v1.8-to-v2.1.he.md | ||
| api-gateway-changes-v1.8-to-v2.1.hi.md | ||
| api-gateway-changes-v1.8-to-v2.1.pt.md | ||
| api-gateway-changes-v1.8-to-v2.1.ru.md | ||
| api-gateway-changes-v1.8-to-v2.1.sw.md | ||
| api-gateway-changes-v1.8-to-v2.1.tr.md | ||
| api-gateway-changes-v1.8-to-v2.1.zh-cn.md | ||
| api.html | ||
| cli-changes-v1.8-to-v2.1.ar.md | ||
| cli-changes-v1.8-to-v2.1.es.md | ||
| cli-changes-v1.8-to-v2.1.he.md | ||
| cli-changes-v1.8-to-v2.1.hi.md | ||
| cli-changes-v1.8-to-v2.1.pt.md | ||
| cli-changes-v1.8-to-v2.1.ru.md | ||
| cli-changes-v1.8-to-v2.1.sw.md | ||
| cli-changes-v1.8-to-v2.1.tr.md | ||
| cli-changes-v1.8-to-v2.1.zh-cn.md | ||
| contributor-licence-agreement.ar.md | ||
| contributor-licence-agreement.es.md | ||
| contributor-licence-agreement.he.md | ||
| contributor-licence-agreement.hi.md | ||
| contributor-licence-agreement.md | ||
| contributor-licence-agreement.pt.md | ||
| contributor-licence-agreement.ru.md | ||
| contributor-licence-agreement.sw.md | ||
| contributor-licence-agreement.tr.md | ||
| contributor-licence-agreement.zh-cn.md | ||
| generate-api-docs.py | ||
| lang-index-ar.md | ||
| lang-index-es.md | ||
| lang-index-he.md | ||
| lang-index-hi.md | ||
| lang-index-pt.md | ||
| lang-index-ru.md | ||
| lang-index-sw.md | ||
| lang-index-tr.md | ||
| lang-index-zh-cn.md | ||
| python-api.ar.md | ||
| python-api.es.md | ||
| python-api.he.md | ||
| python-api.hi.md | ||
| python-api.md | ||
| python-api.pt.md | ||
| python-api.ru.md | ||
| python-api.sw.md | ||
| python-api.tr.md | ||
| python-api.zh-cn.md | ||
| README.api-docs.ar.md | ||
| README.api-docs.es.md | ||
| README.api-docs.he.md | ||
| README.api-docs.hi.md | ||
| README.api-docs.md | ||
| README.api-docs.pt.md | ||
| README.api-docs.ru.md | ||
| README.api-docs.sw.md | ||
| README.api-docs.tr.md | ||
| README.api-docs.zh-cn.md | ||
| README.ar.md | ||
| README.cats | ||
| README.challenger | ||
| README.es.md | ||
| README.he.md | ||
| README.hi.md | ||
| README.md | ||
| README.pt.md | ||
| README.ru.md | ||
| README.sw.md | ||
| README.tr.md | ||
| README.zh-cn.md | ||
| websocket.html | ||
| layout | title | nav_order |
|---|---|---|
| default | Home | 1 |
TrustGraph Documentation
Welcome to TrustGraph! For comprehensive documentation, please visit:
📖 https://docs.trustgraph.ai
The main documentation site includes:
- Overview - Introduction to TrustGraph concepts and architecture
- Guides - Step-by-step tutorials and how-to guides
- Deployment - Deployment options and configuration
- Reference - API specifications and CLI documentation
Getting Started
New to TrustGraph? Start with the Overview to understand the system.
Ready to deploy? Check out the Deployment Guide.
Integrating with code? See the API Reference for REST, WebSocket, and SDK documentation.