Machine account login

backend/Cargo.toml

@@ -17,21 +17,21 @@ async-trait = { version = "0.1.89" }
 anyhow = { version = "1.0.100" }
 clap = { version = "4.5.49", features = ["derive", "env"] }
 chrono = { version = "0.4.42" }
-derive_more = { version = "2.0.1" , features = [
+derive_more = { version = "2.0.1", features = [
     "deref",
     "deref_mut",
     "from",
     "from_str",
     "into",
-]}
+] }
 axum-reverse-proxy = { version = "1.3.0" }
 dotenvy = { version = "0.15.7" }
 mockito = { version = "1.7.0" }
 reqwest = { version = "0.12.15", default-features = false, features = [
     "rustls-tls",
     "json",
     "blocking",
-    "stream"
+    "stream",
 ] }
 serde = { version = "1.0.228", features = ["derive"] }
 serde_json = { version = "1.0.145" }
@@ -48,24 +48,41 @@ tracing-subscriber = { version = "0.3.20" }
 url = { version = "2.5.4" }
 k8s-openapi = { version = "0.28.0", features = ["v1_35"] }
 kube = { version = "4.2.0", features = ["runtime", "derive"] }
-ldap3 = { version = "0.11.5", default-features = false, features = ["tls-rustls"] }
-sqlx = { version = "0.8.6", default-features = false, features = ["runtime-tokio", "tls-rustls", "mysql", "time"] }
+ldap3 = { version = "0.11.5", default-features = false, features = [
+    "tls-rustls",
+] }
+sqlx = { version = "0.8.6", default-features = false, features = [
+    "runtime-tokio",
+    "tls-rustls",
+    "mysql",
+    "time",
+] }
 strum = { version = "0.27.2", features = ["derive"] }
 time = { version = "0.3.47" }
 openidconnect = "4.0.1"
 opentelemetry = { version = "0.32.0" }
 opentelemetry_sdk = { version = "0.32.1", features = ["rt-tokio"] }
-opentelemetry-otlp = { version = "0.32.0", features = ["metrics", "grpc-tonic"] }
+opentelemetry-otlp = { version = "0.32.0", features = [
+    "metrics",
+    "grpc-tonic",
+] }
 opentelemetry-semantic-conventions = "0.32.0"
 tracing-opentelemetry = { version = "0.33.0" }
 axum = { version = "0.8.6" }
+axum-extra = { version = "0.12.6", features = ["typed-header"] }
 regex = "1.12.2"
 rustls = "0.23.35"
 testcontainers = { version = "0.27.2", features = ["http_wait_plain"] }
 tower-http = { version = "0.6.6", features = ["cors"] }
-sea-orm = { version = "2.0.0-rc", features = [ "sqlx-postgres", "runtime-tokio-rustls", "macros", "with-chrono" ] }
+sea-orm = { version = "2.0.0-rc", features = [
+    "sqlx-postgres",
+    "runtime-tokio-rustls",
+    "macros",
+    "with-chrono",
+] }
 tokio-tungstenite = "0.28.0"
 tower = "0.5.3"
 moka = { version = "0.12.11", features = ["future"] }
 env_logger = "0.11.8"
 axum-test = "18.4.1"
+jsonwebtoken = { version = "11.1.0", features = ["aws_lc_rs"] }

backend/auth-core/Cargo.toml

@@ -15,20 +15,26 @@ publish = false
 
 [dependencies]
 anyhow = { workspace = true, features = ["backtrace"] }
-async-trait = {workspace = true }
+async-trait = { workspace = true }
 axum = { workspace = true, features = ["macros"] }
+axum-extra = { workspace = true }
 base64 = "0.22.1"
 chrono = { workspace = true }
 http-body-util = "0.1.3"
+jsonwebtoken = { workspace = true }
 migration = { version = "0.1.0", path = "migration" }
 oauth2 = "5.0.0"
-openidconnect = { workspace = true, features = ["timing-resistant-secret-traits"] }
+openidconnect = { workspace = true, features = [
+    "timing-resistant-secret-traits",
+] }
+reqwest.workspace = true
+rstest = "0.28.0"
 rustls = { workspace = true, features = ["aws-lc-rs"] }
 sea-orm = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
 serde_yaml = { workspace = true }
 sodiumoxide = "0.2.7"
-thiserror = { workspace = true }
+testcontainers = { workspace = true }
 tokio = { workspace = true, features = ["full"] }
 tracing = { workspace = true }

backend/auth-core/src/lib.rs

@@ -6,6 +6,8 @@ pub mod healthcheck;
 pub mod middleware;
 pub mod oidc;
 pub mod request;
+pub mod test_oidc_server;
+pub mod validate_token;
 pub use async_trait;
 pub use base64;
 pub use oauth2;

backend/graph-proxy/src/test_oidc_server.rs → backend/auth-core/src/test_oidc_server.rs

@@ -2,8 +2,8 @@ use std::time::Duration;
 
 use anyhow::Context;
 use axum_extra::headers::Authorization;
-use testcontainers::core::wait::HttpWaitStrategy;
 use testcontainers::core::WaitFor;
+use testcontainers::core::wait::HttpWaitStrategy;
 use testcontainers::runners::AsyncRunner;
 use testcontainers::{ContainerAsync, GenericImage, ImageExt};
 

backend/graph-proxy/src/validate_token.rs → backend/auth-core/src/validate_token.rs

@@ -1,20 +1,20 @@
 use axum::http::Uri;
-use axum_extra::headers::{authorization::Bearer, Authorization};
-use jsonwebtoken::{decode, decode_header, jwk::JwkSet, Algorithm, DecodingKey, Validation};
+use axum_extra::headers::{Authorization, authorization::Bearer};
+use jsonwebtoken::{Algorithm, DecodingKey, Validation, decode, decode_header, jwk::JwkSet};
 use openidconnect::{
-    core::CoreClient, AccessToken, ClientId, ClientSecret, EndpointMaybeSet, EndpointNotSet,
-    EndpointSet, IntrospectionUrl, IssuerUrl, TokenIntrospectionResponse,
+    AccessToken, ClientId, ClientSecret, EndpointMaybeSet, EndpointNotSet, EndpointSet,
+    IntrospectionUrl, IssuerUrl, TokenIntrospectionResponse, core::CoreClient,
 };
 
 use serde::{Deserialize, Serialize};
 
 use openidconnect::{
+    AdditionalProviderMetadata, ProviderMetadata,
     core::{
         CoreAuthDisplay, CoreClaimName, CoreClaimType, CoreClientAuthMethod, CoreGrantType,
         CoreJsonWebKey, CoreJweContentEncryptionAlgorithm, CoreJweKeyManagementAlgorithm,
         CoreResponseMode, CoreResponseType, CoreSubjectIdentifierType,
     },
-    AdditionalProviderMetadata, ProviderMetadata,
 };
 use serde_json::Value;