JWT validation
Public route, protected route và token-scope guard trong Go API Gateway.
JWT validation
Nguồn key
Gateway validate client JWT bằng Identity JWKS.
Trong local compose:
CENTEROS_JWT_JWKS_URL
→ http://centeros-identity-service:8081/.well-known/jwks.jsonGateway expected issuer/algorithm lấy từ env var:
CENTEROS_JWT_EXPECTED_ISSUERCENTEROS_JWT_EXPECTED_ALGORITHM
Không đặt private key hoặc token TTL ở Gateway. Những phần đó thuộc Identity Service.
Public routes
Source IsPublicRequest xác nhận các request này bypass auth:
| Route | Ghi chú |
|---|---|
OPTIONS | public; dùng cho CORS preflight |
GET /healthz | local Gateway health |
GET /readyz | local readiness, chưa là checkpoint closed |
GET /actuator/health | local handler, chưa là checkpoint closed |
GET /actuator/health/liveness | local handler, chưa là checkpoint closed |
GET /actuator/health/readiness | local handler, chưa là checkpoint closed |
GET /actuator/info | local handler, chưa là checkpoint closed |
POST /api/auth/login | proxy tới Identity Service |
POST /api/auth/refresh | proxy tới Identity Service |
POST /api/auth/logout | code public, chưa là checkpoint closed |
POST /api/payments/webhooks/payos | webhook public, chưa là checkpoint closed |
Checkpoint hiện tại chỉ đóng GET /healthz, POST /api/auth/login, POST /api/auth/refresh, POST /api/auth/select-branch.
Protected routes
Protected routes cần Bearer token trong Authorization.
Gateway reject:
- missing token
- malformed token
- invalid signature
- unsupported alg
- wrong issuer
refreshTokendùng như access token- non-access-like token
Route context guard
| Route family | Token/context rule |
|---|---|
/api/auth/select-branch | account token required |
/api/auth/me | account token hoặc branch token |
/api/system/* | system context required |
/api/admin/catalog/* | system context required |
/api/admin/navigation/* | system context required |
/api/workspaces/* | branch/platform context required |
/api/setup/* | branch/platform context required |
/api/navigation/* | branch/platform context required |
/api/entitlements/* | branch/platform context required |
/api/payments/* | branch/platform context required |
Normal business APIs dùng branch-scoped accessToken.
accountAccessToken dùng cho select/switch branch. Không dùng accountAccessToken cho normal business APIs.
Sau validation
Nếu token hợp lệ và route context pass:
JWT claims
→ Gateway trusted context
→ trusted headers
→ downstream serviceGateway chỉ làm coarse route guard. Domain permission, capability và entitlement check thuộc downstream service.
TODO
- Chưa đóng: validation docs cho route families ngoài auth/current-context.
- Chưa đóng: system route behavior bằng Bruno/checkpoint.