HelixObs / gateway / 26134624194

91%

push

github

add JWT auth: /auth/token endpoint, Bearer middleware, gRPC interceptor

Implements Phase A authentication for HelixObs:

- internal/auth: pluggable per-instrument auth backends (secret via
  SHA-256 hash, token_introspection via remote /verify endpoint)
- POST /auth/token issues 24h HelixObs JWTs signed with JWT_SECRET
- BearerAuth HTTP middleware wraps all /api/v1/* routes
- gRPC UnaryInterceptor validates Bearer tokens on OTLP ingestion
- Multi-key JWT_SECRET (comma-separated) for zero-downtime rotation
- Empty JWT_SECRET = auth disabled (dev mode, safe rollout)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

0 of 226 new or added lines in 4 files covered. (0.0%)

1885 of 2293 relevant lines covered (82.21%)

1982.38 hits per line