Class OidcBypassAugmentor

java.lang.Object
ai.pipestream.connector.intake.security.OidcBypassAugmentor
All Implemented Interfaces:
io.quarkus.security.identity.SecurityIdentityAugmentor
@ApplicationScoped public class OidcBypassAugmentor extends Object implements io.quarkus.security.identity.SecurityIdentityAugmentor
Makes the intake security annotations (@RolesAllowed(INTAKE_ROLE) on the HTTP resources and the gRPC service) inert while OIDC is disabled, which is the default. This is what lets OIDC ship "off by default": the annotations are always present and compiled in, but enforcement only happens once an operator flips intake.oidc.enabled=true.

Disabled (default): every request — including the anonymous identity synthesized when no credential is presented — is granted INTAKE_ROLE on a synthetic principal, so the role checks pass unconditionally. The real gate stays exactly what it was before OIDC existed: the x-api-key validated inside each handler (HTTP resolveConfig, gRPC CrawlSessionRpcService) and the signed tracking token on status reads. Behavior is byte-identical to the pre-OIDC service.

Enabled: this augmentor is a pass-through. The identity is whatever the OIDC bearer mechanism established — a valid token carrying INTAKE_ROLE (mapped from the configured claim) is required, an anonymous or under-privileged caller is rejected by the role check. OIDC then layers on top of the existing api-key/token gates rather than replacing them.

Augmentors are applied to the anonymous identity too, which is precisely why this works as an off-switch without touching any handler logic.

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    static final String
    INTAKE_ROLE
    The single application role required by every secured intake endpoint.

  • Constructor Summary

    Constructors
    Constructor
    Description
    OidcBypassAugmentor()
    CDI.

  • Method Summary

    Modifier and Type
    Method
    Description
    io.smallrye.mutiny.Uni<io.quarkus.security.identity.SecurityIdentity>
    augment(io.quarkus.security.identity.SecurityIdentity identity, io.quarkus.security.identity.AuthenticationRequestContext context)
     

    Methods inherited from class Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    Methods inherited from interface io.quarkus.security.identity.SecurityIdentityAugmentor

    augment, priority

  • Field Details

    • INTAKE_ROLE

      public static final String INTAKE_ROLE
      The single application role required by every secured intake endpoint. Used both as the @RolesAllowed value and as the role granted by the bypass, so the two can never drift. When OIDC is enabled, map the external IdP claim/group onto this role via quarkus.oidc.roles.role-claim-path.
      See Also:

  • Constructor Details

    • OidcBypassAugmentor

      public OidcBypassAugmentor()
      CDI.

  • Method Details

    • augment

      public io.smallrye.mutiny.Uni<io.quarkus.security.identity.SecurityIdentity> augment(io.quarkus.security.identity.SecurityIdentity identity, io.quarkus.security.identity.AuthenticationRequestContext context)
      Specified by:
      augment in interface io.quarkus.security.identity.SecurityIdentityAugmentor