mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-31 07:44:57 +08:00
Piotr Mlocek
5ae2ccd8cf
Make the public `extension` surface safe to extend before anything depends on it: - Mark `ExtensionCallerKind`, `AuthenticatedCaller`, and `VerificationError` `#[non_exhaustive]` so new caller kinds, claims, and failure modes are not breaking changes. - Stop exposing `jsonwebtoken` and `serde_json` error types in the public API; wrap them as opaque error sources. - Replace the positional constructors with a builder that accepts one or more trusted key sources and an optional SPIFFE trust domain instead of hard-coding `openshell` in the supervisor subject check. - Log the verification failure at `warn` before mapping it to the stable `Unauthenticated` status, since the extension is the only place an issuer or audience mismatch is observable. - Drop `required_spec_claims` entries that jsonwebtoken ignores and the redundant algorithm assignment. Add a drift test in `openshell-server` that mints gateway and supervisor extension tokens and verifies them with the SDK from both PEM and the published JWKS, and rejects a sandbox bootstrap token. The SDK keeps its own copy of the wire contract so it does not depend on the internal `openshell-extension-core` crate; this test is what enforces that the two stay aligned. Add the E2E middleware fixture to the fmt and check gates so its standalone lockfile is validated on every branch, and refresh the lockfile that had already drifted after merging main. Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>