feat: auth SIWE login service + config#353
Conversation
Self-contained, reusable auth building blocks with no app wiring: - Issuer: mint short-lived RS256 JWTs; publish the public key as JWKS - Validator: verify bearer JWTs (in-process key or remote JWKS) - SIWEVerifier: validate EIP-4361 login messages and recover the signer - RequireAuth: bearer-token HTTP middleware - ParseRSAPrivateKey: load the base64-PEM signing key Folds in the previously-dead auth.JWTValidator (relocated from pkg/auth/jwt.go).
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #353 +/- ##
=======================================
Coverage ? 33.64%
=======================================
Files ? 163
Lines ? 12565
Branches ? 0
=======================================
Hits ? 4228
Misses ? 8001
Partials ? 336
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a new authentication service (pkg/auth) implementing Sign-In with Ethereum (SIWE) login, nonce management, and JWKS token validation, replacing the previous basic JWKS configuration. Feedback on these changes highlights a potential nil pointer dereference on resp in the login logging decorator when ls.svc.Login returns a nil response with a nil error. Additionally, a slight inconsistency in expiration logic was identified in the in-memory nonce provider, where purgeExpired uses now.After(e.expiry) while Issue and Consume check now.Before(e.expiry).
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
sadiq1971
changed the title
Address review: guard against a thundering-herd of JWKS fetches on concurrent cache misses (refreshMu + double-check), and replace the key map on refresh so rotated-out keys stop being trusted.
9100c55 to
c8d567f
Compare
|
Addressed Gemini's review in
|
The orchestration layer over pkg/auth/jwt, plus the config type. Not wired into the server and not enabled in any deployment yet (that is the integration change), so it is reviewable as pure business logic. - pkg/auth/service: login flow (nonce -> SIWE verify -> issue JWT), HTTP handlers, log decorator (guards a nil response), consumer interfaces + mockery mocks - pkg/auth/service/nonce_provider: address-keyed in-memory nonce store (reuse per address; reject-when-full; purge boundary matches Issue/Consume) - pkg/auth/config.go, pkg/auth/types.go: Config + wire DTOs - pkg/config: add optional Auth block; remove the dead JWKS type/field (and its now-orphaned jwks: blocks from the default configs)
c8d567f to
77ee61c
Compare
dhyaniarun1993
left a comment
dhyaniarun1993
left a comment
There was a problem hiding this comment.
Do we have a separate issue for moving nonce to a common store so that we can run multiple instances of api?
I will create the issue - the plan is to move it to postgress later on when we might need to move to multiple instances |
3 participants
2 of 3 — read-API authentication. Base:
feat/auth-jwt.The orchestration layer over
pkg/auth/jwt, plus the config type. Not wired into the server yet (inert until PR 3), so it's reviewable as pure business logic.pkg/auth/service— login flow (nonce → SIWE verify → issue JWT), HTTP handlers, log decorator, consumer interfaces (Verifier/Issuer/NonceStore/UserLookup) + mockery mockspkg/auth/service/nonce_provider— address-keyed in-memory nonce store (reuse per address; reject-when-full, never evicts a live nonce)pkg/auth/config.go,pkg/auth/types.go—Config+ wire DTOspkg/config— add optionalauthblock; remove the deadJWKStype/field (and itsjwks:blocks from the default configs)