master

GGitHubfeat(auth): internal service auth (#7167)

65cc8328创建于 13 天前历史提交

文件	最后提交记录	最后更新时间
index.ts	feat(auth): internal service auth (#7167) Optional Bearer auth between internal services (orchestrator and jobs). Off by default; existing deploys are unchanged until operators set secrets and flip `NANGO_INTERNAL_AUTH_REQUIRED`. ## Summary - Orchestrator and jobs HTTP APIs accept `Authorization: Bearer`, except `GET /health`. - Control plane (server, jobs, orchestrator) uses a shared static token (`NANGO_INTERNAL_AUTH_TOKEN`). - Jobs mints HMAC JWTs for runners: task-bound for `putTask`/`heartbeat`, node-bound for register/idle. The signing key stays on jobs; runners never receive `NANGO_INTERNAL_AUTH_TOKEN` or `NANGO_INTERNAL_AUTH_SIGNING_KEY`. Rollout plan [here](https://linear.app/nango/issue/NAN-6634/add-internal-auth-middleware-to-orchestrator-and-jobs#zero-downtime-rollout-2e12b4cc) --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	13 天前
schemas.ts	feat(auth): internal service auth (#7167) Optional Bearer auth between internal services (orchestrator and jobs). Off by default; existing deploys are unchanged until operators set secrets and flip `NANGO_INTERNAL_AUTH_REQUIRED`. ## Summary - Orchestrator and jobs HTTP APIs accept `Authorization: Bearer`, except `GET /health`. - Control plane (server, jobs, orchestrator) uses a shared static token (`NANGO_INTERNAL_AUTH_TOKEN`). - Jobs mints HMAC JWTs for runners: task-bound for `putTask`/`heartbeat`, node-bound for register/idle. The signing key stays on jobs; runners never receive `NANGO_INTERNAL_AUTH_TOKEN` or `NANGO_INTERNAL_AUTH_SIGNING_KEY`. Rollout plan [here](https://linear.app/nango/issue/NAN-6634/add-internal-auth-middleware-to-orchestrator-and-jobs#zero-downtime-rollout-2e12b4cc) --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	13 天前