From d25100ed6a3633918e82b845f37cfe24d329b80d Mon Sep 17 00:00:00 2001 From: ben-fornefeld Date: Wed, 22 Jul 2026 20:28:54 +0200 Subject: [PATCH] feat(auth): re-export OIDC and provider verifiers through the public facade External consumers (belt) previously imported pkg/auth/oidc directly (oidc.NewVerifier, oidc.IdentityLookup, oidc.ErrIdentityNotFound) and used auth.Verifier/auth.NewVerifier from the old facade. Both surfaces were removed in #3314, which breaks belt's daily infra sync at go mod tidy (module found, but does not contain package .../pkg/auth/oidc) and at compile time in argus-api. Expose the equivalents on the auth facade so all consumers use auth.*: - IdentityLookup, ErrIdentityNotFound - OIDCVerifier, NewOIDCVerifier (single issuer) - ProviderVerifier, NewProviderVerifier (multi-issuer, keeps the (nil, nil) no-provider semantics of the old auth.NewVerifier) Config/issuer types were already re-exported as JWTConfig/JWTIssuer. --- packages/auth/pkg/auth/token.go | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/packages/auth/pkg/auth/token.go b/packages/auth/pkg/auth/token.go index 12886609d2..c103e03efe 100644 --- a/packages/auth/pkg/auth/token.go +++ b/packages/auth/pkg/auth/token.go @@ -6,6 +6,7 @@ import ( "github.com/e2b-dev/infra/packages/auth/internal/token" "github.com/e2b-dev/infra/packages/auth/internal/token/jwks" + "github.com/e2b-dev/infra/packages/auth/internal/token/oidc" ) type ProviderConfig = token.ProviderConfig @@ -27,3 +28,34 @@ func ParseProviderConfig(value string) (ProviderConfig, error) { func NewAdminVerifier(ctx context.Context, config ProviderConfig, httpClient *http.Client) (*AdminVerifier, error) { return token.NewAdminVerifier(ctx, config, httpClient) } + +// IdentityLookup resolves an OIDC identity (issuer + subject) to an internal +// user UUID. Implementations should return ErrIdentityNotFound when no +// matching identity exists. +type IdentityLookup = oidc.IdentityLookup + +// OIDCVerifier verifies auth-provider user JWTs for a single issuer and +// resolves the internal user identity through an IdentityLookup. +type OIDCVerifier = oidc.Verifier + +// ErrIdentityNotFound is returned by OIDC verification when the token is +// valid but no matching identity exists. +var ErrIdentityNotFound = oidc.ErrIdentityNotFound + +// NewOIDCVerifier constructs an OIDCVerifier for the given issuer config. +// External consumers (e.g. belt) use this to verify auth-provider tokens with +// their own identity storage. +func NewOIDCVerifier(ctx context.Context, config JWTConfig, httpClient *http.Client, identities IdentityLookup) (*OIDCVerifier, error) { + return oidc.NewVerifier(ctx, config, httpClient, identities) +} + +// ProviderVerifier verifies auth-provider user JWTs across every issuer in a +// ProviderConfig. +type ProviderVerifier = token.ProviderVerifier + +// NewProviderVerifier constructs a ProviderVerifier for the given provider +// config. When the config has no JWT issuers it returns (nil, nil); a nil +// ProviderVerifier denies all verification attempts at runtime. +func NewProviderVerifier(ctx context.Context, config ProviderConfig, httpClient *http.Client, identities IdentityLookup) (*ProviderVerifier, error) { + return token.NewProviderVerifier(ctx, config, httpClient, identities) +}