As a practitioner, I can authenticate on the Koinos backend via Zitadel #9

New issue

Open

opened 2026-04-14 20:41:19 +00:00 by claude-desktop · 0 comments

claude-desktop commented

2026-04-14 20:41:19 +00:00

Collaborator

User story

As a practitioner, I want the Koinos backend to accept my Zitadel-issued tokens, so that I can call Koinos APIs with a single SSO session.

Acceptance criteria

Backend

koinos-auth module validating JWTs from Zitadel (JWKS-based, with caching).
Axum extractor AuthedUser yielding sub, roles, preferred_username, amr, home_instance.
GET /api/me returns the current user profile.
401 for invalid/expired tokens, 403 for insufficient roles.
Token audience and issuer validated against configured values.

Policy foundations

Role-based guard implemented (helper require_role(...)).
Step-up check helper reading amr from the token (used later for prescriptions).

Tests

Unit tests covering token validation edge cases (expiry, wrong audience, wrong issuer, missing roles).
Integration test using a mock OIDC server minting test tokens.

Out of scope

Web client login UI (issue #10).
FHIR SMART-on-FHIR scoped tokens (later).
PSC federation (v0.2).

References

spec/03-architecture/03-identity-auth.md §5–§6.
spec/08-roadmap-mvp.md — step #9.

## User story **As a practitioner**, I want the Koinos backend to accept my Zitadel-issued tokens, **so that** I can call Koinos APIs with a single SSO session. ## Acceptance criteria ### Backend - [ ] `koinos-auth` module validating JWTs from Zitadel (JWKS-based, with caching). - [ ] Axum extractor `AuthedUser` yielding `sub`, `roles`, `preferred_username`, `amr`, `home_instance`. - [ ] `GET /api/me` returns the current user profile. - [ ] `401` for invalid/expired tokens, `403` for insufficient roles. - [ ] Token audience and issuer validated against configured values. ### Policy foundations - [ ] Role-based guard implemented (helper `require_role(...)`). - [ ] Step-up check helper reading `amr` from the token (used later for prescriptions). ### Tests - [ ] Unit tests covering token validation edge cases (expiry, wrong audience, wrong issuer, missing roles). - [ ] Integration test using a mock OIDC server minting test tokens. ## Out of scope - Web client login UI (issue #10). - FHIR SMART-on-FHIR scoped tokens (later). - PSC federation (v0.2). ## References - `spec/03-architecture/03-identity-auth.md` §5–§6. - `spec/08-roadmap-mvp.md` — step #9.

claude-desktop added this to the v0.1 milestone

2026-04-14 20:41:19 +00:00

claude-desktop added the

area:backend

area:identity

type:user-story

labels

2026-04-14 20:41:19 +00:00