Skip to content

feat: personal access token auth #500

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
me-marcel merged 1 commit into from
Jul 21, 2026
Merged

feat: personal access token auth #500

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion apps/agenstra/backend-agent-controller/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -221,7 +221,7 @@ See the [library documentation](../../libs/domains/agenstra/backend/feature-agen

- `AUTHENTICATION_METHOD` - `api-key`, `keycloak`, or `users` (default: api-key when STATIC_API_KEY set, else keycloak)
- `STATIC_API_KEY` - Static API key (required when AUTHENTICATION_METHOD=api-key)
- `JWT_SECRET` - JWT signing secret (required when AUTHENTICATION_METHOD=users)
- `JWT_SECRET` - JWT signing secret (required when `AUTHENTICATION_METHOD=users` or `keycloak`; used for users sessions and PAT exchange)
- `KEYCLOAK_SERVER_URL` - Keycloak server URL (optional, used for server URL if different from auth server URL)
- `KEYCLOAK_AUTH_SERVER_URL` - Keycloak authentication server URL (required for Keycloak auth)
- `KEYCLOAK_REALM` - Keycloak realm name (required for Keycloak auth)
Expand Down
16 changes: 11 additions & 5 deletions apps/agenstra/backend-agent-controller/src/app/app.module.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,16 +3,19 @@ import {
IdentityEmailBridgeModule,
IdentityNotificationBridgeModule,
IdentityStatisticsBridgeModule,
AGENSTRA_PAT_SCOPES,
} from '@forepath/agenstra/backend/feature-agent-controller';
import { MonitoringModule } from '@forepath/shared/backend';
import {
BullBoardSkippingThrottlerGuard,
getAuthenticationMethod,
getHybridAuthGuards,
getKeycloakPatAuthGuards,
getRateLimitConfig,
KeycloakModule,
KeycloakService,
KeycloakUserSyncModule,
PatAuthModule,
UsersAuthModule,
} from '@forepath/identity/backend';
import { getTypeOrmOptionsForQueueRole } from '@forepath/shared/backend';
Expand All @@ -33,19 +36,22 @@ const authMethod = getAuthenticationMethod();
ControllerQueueModule,
ThrottlerModule.forRoot(getRateLimitConfig()),
...(authMethod === 'keycloak'
? [KeycloakModule, KeycloakConnectModule.registerAsync({ useExisting: KeycloakService }), KeycloakUserSyncModule]
? [
KeycloakModule,
KeycloakConnectModule.registerAsync({ useExisting: KeycloakService }),
KeycloakUserSyncModule,
PatAuthModule.register({ patScopeCatalog: AGENSTRA_PAT_SCOPES }),
]
: []),
...(authMethod === 'users' ? [UsersAuthModule] : []),
...(authMethod === 'users' ? [UsersAuthModule.register({ patScopeCatalog: AGENSTRA_PAT_SCOPES })] : []),
ClientsModule,
IdentityStatisticsBridgeModule,
IdentityNotificationBridgeModule,
IdentityEmailBridgeModule,
MonitoringModule,
],
// Use hybrid guards (checks STATIC_API_KEY to determine authentication method)
providers: [
...getHybridAuthGuards(),
// Apply rate limiting globally to all routes
...(authMethod === 'keycloak' ? getKeycloakPatAuthGuards() : getHybridAuthGuards()),
{
provide: APP_GUARD,
useClass: BullBoardSkippingThrottlerGuard,
Expand Down
2 changes: 2 additions & 0 deletions apps/agenstra/backend-agent-controller/src/typeorm.config.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,7 @@ import {
ClientUserEntity,
RevokedUserTokenEntity,
UserEntity,
UserPersonalAccessTokenEntity,
} from '@forepath/identity/backend';
import { DataSource, DataSourceOptions } from 'typeorm';

Expand Down Expand Up @@ -76,6 +77,7 @@ export const typeormConfig: DataSourceOptions = {
ProvisioningReferenceEntity,
UserEntity,
RevokedUserTokenEntity,
UserPersonalAccessTokenEntity,
StatisticsUserEntity,
StatisticsClientEntity,
StatisticsAgentEntity,
Expand Down
132 changes: 132 additions & 0 deletions apps/agenstra/frontend-agent-console/src/i18n/messages.de.xlf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1674,6 +1674,14 @@
<source>Users</source>
<target>Benutzer</target>
</trans-unit>
<trans-unit id="featureContainer-tokensTitle" datatype="html">
<source>Access Tokens</source>
<target>Zugriffstoken</target>
</trans-unit>
<trans-unit id="featureContainer-tokens" datatype="html">
<source>Tokens</source>
<target>Token</target>
</trans-unit>
<trans-unit id="featureContainer-filtersTitle" datatype="html">
<source>Filters</source>
<target>Filterregeln</target>
Expand Down Expand Up @@ -4064,6 +4072,10 @@
<source>User Management</source>
<target>Benutzerverwaltung</target>
</trans-unit>
<trans-unit id="featureAuth-tokensPage" datatype="html">
<source>Personal Access Tokens</source>
<target>Persönliche Zugriffstoken</target>
</trans-unit>
<trans-unit id="featureLogin-title" datatype="html">
<source>Login</source>
<target>Anmelden</target>
Expand Down Expand Up @@ -4128,6 +4140,10 @@
<source>Login</source>
<target>Anmelden</target>
</trans-unit>
<trans-unit id="featureLogin-patNotAllowed" datatype="html">
<source>Personal access tokens cannot be used to sign in to the console. Use your account password instead.</source>
<target>Persönliche Zugriffstoken können nicht zur Anmeldung an der Konsole verwendet werden. Verwenden Sie stattdessen Ihr Kontopasswort.</target>
</trans-unit>
<trans-unit id="featureOtpInput-ariaLabelCharacter" datatype="html">
<source>Character <x id="position" equiv-text="index + 1"/> of 6</source>
<target>Character <x id="position" equiv-text="index + 1"/> of 6</target>
Expand Down Expand Up @@ -4586,6 +4602,122 @@
<source>Delete</source>
<target>Löschen</target>
</trans-unit>
<trans-unit id="featureTokenManager-title" datatype="html">
<source>Personal Access Tokens</source>
<target>Persönliche Zugriffstoken</target>
</trans-unit>
<trans-unit id="featureTokenManager-addTokenTitle" datatype="html">
<source>Create token</source>
<target>Token erstellen</target>
</trans-unit>
<trans-unit id="featureTokenManager-searchPlaceholder" datatype="html">
<source>Search tokens</source>
<target>Token suchen</target>
</trans-unit>
<trans-unit id="featureTokenManager-loading" datatype="html">
<source>Loading tokens...</source>
<target>Token werden geladen...</target>
</trans-unit>
<trans-unit id="featureTokenManager-empty" datatype="html">
<source>No personal access tokens</source>
<target>Keine persönlichen Zugriffstoken</target>
</trans-unit>
<trans-unit id="featureTokenManager-scopes" datatype="html">
<source>scopes</source>
<target>Berechtigungen</target>
</trans-unit>
<trans-unit id="featureTokenManager-created" datatype="html">
<source>Created</source>
<target>Erstellt</target>
</trans-unit>
<trans-unit id="featureTokenManager-expires" datatype="html">
<source>Expires</source>
<target>Läuft ab</target>
</trans-unit>
<trans-unit id="featureTokenManager-noExpiry" datatype="html">
<source>No expiry</source>
<target>Kein Ablaufdatum</target>
</trans-unit>
<trans-unit id="featureTokenManager-lastUsed" datatype="html">
<source>Last used</source>
<target>Zuletzt verwendet</target>
</trans-unit>
<trans-unit id="featureTokenManager-revokeTitle" datatype="html">
<source>Revoke token</source>
<target>Token widerrufen</target>
</trans-unit>
<trans-unit id="featureTokenManager-createTitle" datatype="html">
<source>Create personal access token</source>
<target>Persönliches Zugriffstoken erstellen</target>
</trans-unit>
<trans-unit id="featureTokenManager-closeAriaLabel" datatype="html">
<source>Close</source>
<target>Schließen</target>
</trans-unit>
<trans-unit id="featureTokenManager-plaintextTitle" datatype="html">
<source>Token value</source>
<target>Tokenwert</target>
</trans-unit>
<trans-unit id="featureTokenManager-plaintextHint" datatype="html">
<source>Copy this token now. It will not be shown again.</source>
<target>Kopieren Sie dieses Token jetzt. Es wird nicht erneut angezeigt.</target>
</trans-unit>
<trans-unit id="featureTokenManager-copied" datatype="html">
<source>Copied</source>
<target>Kopiert</target>
</trans-unit>
<trans-unit id="featureTokenManager-copy" datatype="html">
<source>Copy</source>
<target>Kopieren</target>
</trans-unit>
<trans-unit id="featureTokenManager-done" datatype="html">
<source>Done</source>
<target>Fertig</target>
</trans-unit>
<trans-unit id="featureTokenManager-nameLabel" datatype="html">
<source>Name <x id="START_TAG_SPAN" ctype="x-span" equiv-text="&lt;span class=&quot;text-danger&quot;&gt;"/>*<x id="CLOSE_TAG_SPAN" ctype="x-span" equiv-text="&lt;/span&gt;"/></source>
<target>Name <x id="START_TAG_SPAN" ctype="x-span" equiv-text="&lt;span class=&quot;text-danger&quot;&gt;"/>*<x id="CLOSE_TAG_SPAN" ctype="x-span" equiv-text="&lt;/span&gt;"/></target>
</trans-unit>
<trans-unit id="featureTokenManager-expiresAtLabel" datatype="html">
<source>Expires at</source>
<target>Läuft ab am</target>
</trans-unit>
<trans-unit id="featureTokenManager-expiresAtHint" datatype="html">
<source>Optional. Leave empty for a token that does not expire.</source>
<target>Optional. Leer lassen für ein Token ohne Ablaufdatum.</target>
</trans-unit>
<trans-unit id="featureTokenManager-scopesLabel" datatype="html">
<source>Scopes <x id="START_TAG_SPAN" ctype="x-span" equiv-text="&lt;span class=&quot;text-danger&quot;&gt;"/>*<x id="CLOSE_TAG_SPAN" ctype="x-span" equiv-text="&lt;/span&gt;"/></source>
<target>Berechtigungen <x id="START_TAG_SPAN" ctype="x-span" equiv-text="&lt;span class=&quot;text-danger&quot;&gt;"/>*<x id="CLOSE_TAG_SPAN" ctype="x-span" equiv-text="&lt;/span&gt;"/></target>
</trans-unit>
<trans-unit id="featureTokenManager-loadingScopes" datatype="html">
<source>Loading scopes...</source>
<target>Berechtigungen werden geladen...</target>
</trans-unit>
<trans-unit id="featureTokenManager-noScopes" datatype="html">
<source>No scopes available</source>
<target>Keine Berechtigungen verfügbar</target>
</trans-unit>
<trans-unit id="featureTokenManager-create" datatype="html">
<source>Create</source>
<target>Erstellen</target>
</trans-unit>
<trans-unit id="featureTokenManager-revokeModalTitle" datatype="html">
<source>Revoke token</source>
<target>Token widerrufen</target>
</trans-unit>
<trans-unit id="featureTokenManager-revokeConfirm" datatype="html">
<source>Are you sure you want to revoke the token <x id="START_TAG_STRONG" ctype="x-strong" equiv-text="&lt;strong&gt;"/><x id="INTERPOLATION" equiv-text="{{ tokenToRevoke.name }}"/><x id="CLOSE_TAG_STRONG" ctype="x-strong" equiv-text="&lt;/strong&gt;"/>?</source>
<target>Möchten Sie das Token <x id="START_TAG_STRONG" ctype="x-strong" equiv-text="&lt;strong&gt;"/><x id="INTERPOLATION" equiv-text="{{ tokenToRevoke.name }}"/><x id="CLOSE_TAG_STRONG" ctype="x-strong" equiv-text="&lt;/strong&gt;"/> wirklich widerrufen?</target>
</trans-unit>
<trans-unit id="featureTokenManager-cannotUndo" datatype="html">
<source>This action cannot be undone.</source>
<target>Diese Aktion kann nicht rückgängig gemacht werden.</target>
</trans-unit>
<trans-unit id="featureTokenManager-revoke" datatype="html">
<source>Revoke</source>
<target>Widerrufen</target>
</trans-unit>
<trans-unit id="featureDocsBreadcrumbs-documentation" datatype="html">
<source>Documentation</source>
<target>Dokumentation</target>
Expand Down
108 changes: 108 additions & 0 deletions apps/agenstra/frontend-agent-console/src/i18n/messages.xlf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1239,6 +1239,12 @@
<trans-unit id="featureContainer-users" datatype="html">
<source>Users</source>
</trans-unit>
<trans-unit id="featureContainer-tokensTitle" datatype="html">
<source>Access Tokens</source>
</trans-unit>
<trans-unit id="featureContainer-tokens" datatype="html">
<source>Tokens</source>
</trans-unit>
<trans-unit id="featureContainer-filtersTitle" datatype="html">
<source>Filters</source>
</trans-unit>
Expand Down Expand Up @@ -2963,6 +2969,9 @@
<trans-unit id="featureAuth-usersPage" datatype="html">
<source>User Management</source>
</trans-unit>
<trans-unit id="featureAuth-tokensPage" datatype="html">
<source>Personal Access Tokens</source>
</trans-unit>
<trans-unit id="featureLogin-title" datatype="html">
<source>Login</source>
</trans-unit>
Expand Down Expand Up @@ -3011,6 +3020,9 @@
<trans-unit id="featureLogin-submit" datatype="html">
<source>Login</source>
</trans-unit>
<trans-unit id="featureLogin-patNotAllowed" datatype="html">
<source>Personal access tokens cannot be used to sign in to the console. Use your account password instead.</source>
</trans-unit>
<trans-unit id="identityLogoutConfirm-closeAria" datatype="html">
<source>Close</source>
</trans-unit>
Expand Down Expand Up @@ -3381,6 +3393,102 @@
<trans-unit id="featureUserManager-delete" datatype="html">
<source>Delete</source>
</trans-unit>
<trans-unit id="featureTokenManager-title" datatype="html">
<source>Personal Access Tokens</source>
</trans-unit>
<trans-unit id="featureTokenManager-addTokenTitle" datatype="html">
<source>Create token</source>
</trans-unit>
<trans-unit id="featureTokenManager-searchPlaceholder" datatype="html">
<source>Search tokens</source>
</trans-unit>
<trans-unit id="featureTokenManager-loading" datatype="html">
<source>Loading tokens...</source>
</trans-unit>
<trans-unit id="featureTokenManager-empty" datatype="html">
<source>No personal access tokens</source>
</trans-unit>
<trans-unit id="featureTokenManager-scopes" datatype="html">
<source>scopes</source>
</trans-unit>
<trans-unit id="featureTokenManager-created" datatype="html">
<source>Created</source>
</trans-unit>
<trans-unit id="featureTokenManager-expires" datatype="html">
<source>Expires</source>
</trans-unit>
<trans-unit id="featureTokenManager-noExpiry" datatype="html">
<source>No expiry</source>
</trans-unit>
<trans-unit id="featureTokenManager-lastUsed" datatype="html">
<source>Last used</source>
</trans-unit>
<trans-unit id="featureTokenManager-revokeTitle" datatype="html">
<source>Revoke token</source>
</trans-unit>
<trans-unit id="featureTokenManager-editButtonTitle" datatype="html">
<source>Edit token</source>
</trans-unit>
<trans-unit id="featureTokenManager-editModalTitle" datatype="html">
<source>Edit personal access token</source>
</trans-unit>
<trans-unit id="featureTokenManager-createTitle" datatype="html">
<source>Create personal access token</source>
</trans-unit>
<trans-unit id="featureTokenManager-closeAriaLabel" datatype="html">
<source>Close</source>
</trans-unit>
<trans-unit id="featureTokenManager-plaintextTitle" datatype="html">
<source>Token value</source>
</trans-unit>
<trans-unit id="featureTokenManager-plaintextHint" datatype="html">
<source>Copy this token now. It will not be shown again.</source>
</trans-unit>
<trans-unit id="featureTokenManager-copied" datatype="html">
<source>Copied</source>
</trans-unit>
<trans-unit id="featureTokenManager-copy" datatype="html">
<source>Copy</source>
</trans-unit>
<trans-unit id="featureTokenManager-done" datatype="html">
<source>Done</source>
</trans-unit>
<trans-unit id="featureTokenManager-nameLabel" datatype="html">
<source>Name <x id="START_TAG_SPAN" ctype="x-span" equiv-text="&lt;span class=&quot;text-danger&quot;&gt;"/>*<x id="CLOSE_TAG_SPAN" ctype="x-span" equiv-text="&lt;/span&gt;"/></source>
</trans-unit>
<trans-unit id="featureTokenManager-expiresAtLabel" datatype="html">
<source>Expires at</source>
</trans-unit>
<trans-unit id="featureTokenManager-expiresAtHint" datatype="html">
<source>Optional. Leave empty for a token that does not expire.</source>
</trans-unit>
<trans-unit id="featureTokenManager-scopesLabel" datatype="html">
<source>Scopes <x id="START_TAG_SPAN" ctype="x-span" equiv-text="&lt;span class=&quot;text-danger&quot;&gt;"/>*<x id="CLOSE_TAG_SPAN" ctype="x-span" equiv-text="&lt;/span&gt;"/></source>
</trans-unit>
<trans-unit id="featureTokenManager-loadingScopes" datatype="html">
<source>Loading scopes...</source>
</trans-unit>
<trans-unit id="featureTokenManager-noScopes" datatype="html">
<source>No scopes available</source>
</trans-unit>
<trans-unit id="featureTokenManager-create" datatype="html">
<source>Create</source>
</trans-unit>
<trans-unit id="featureTokenManager-update" datatype="html">
<source>Update</source>
</trans-unit>
<trans-unit id="featureTokenManager-revokeModalTitle" datatype="html">
<source>Revoke token</source>
</trans-unit>
<trans-unit id="featureTokenManager-revokeConfirm" datatype="html">
<source>Are you sure you want to revoke the token <x id="START_TAG_STRONG" ctype="x-strong" equiv-text="&lt;strong&gt;"/><x id="INTERPOLATION" equiv-text="{{ tokenToRevoke.name }}"/><x id="CLOSE_TAG_STRONG" ctype="x-strong" equiv-text="&lt;/strong&gt;"/>?</source>
</trans-unit>
<trans-unit id="featureTokenManager-cannotUndo" datatype="html">
<source>This action cannot be undone.</source>
</trans-unit>
<trans-unit id="featureTokenManager-revoke" datatype="html">
<source>Revoke</source>
</trans-unit>
<trans-unit id="featureDocsBreadcrumbs-documentation" datatype="html">
<source>Documentation</source>
</trans-unit>
Expand Down
5 changes: 4 additions & 1 deletion apps/decabill/backend-billing-manager/src/app/app.module.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,12 +2,14 @@ import {
BillingIdentityNotificationBridgeModule,
BillingKeycloakUserSyncModule,
BillingModule,
BillingPatAuthModule,
BillingUsersAuthModule,
} from '@forepath/decabill/backend';
import {
BullBoardSkippingThrottlerGuard,
getAuthenticationMethod,
getHybridAuthGuards,
getKeycloakPatAuthGuards,
getRateLimitConfig,
KeycloakModule,
KeycloakService,
Expand Down Expand Up @@ -36,13 +38,14 @@ const authMethod = getAuthenticationMethod();
KeycloakModule,
KeycloakConnectModule.registerAsync({ useExisting: KeycloakService }),
BillingKeycloakUserSyncModule,
BillingPatAuthModule,
]
: []),
...(authMethod === 'users' ? [BillingUsersAuthModule] : []),
MonitoringModule,
],
providers: [
...getHybridAuthGuards(),
...(authMethod === 'keycloak' ? getKeycloakPatAuthGuards() : getHybridAuthGuards()),
{
provide: APP_GUARD,
useClass: BullBoardSkippingThrottlerGuard,
Expand Down
Loading
Loading