Skip to content

Commit 0e67265

Browse files
sallyomsallyom
committed
remove unnecessary/unrelated changes, keep only langfuse changes
Signed-off-by: sallyom <[email protected]>
1 parent 21251e7 commit 0e67265

File tree

5 files changed

+1
-102
lines changed

5 files changed

+1
-102
lines changed

‎components/backend/handlers/sessions.go‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -770,14 +770,10 @@ func MintSessionGitHubToken(c *gin.Context) {
770770
tr := &authnv1.TokenReview{Spec: authnv1.TokenReviewSpec{Token: token}}
771771
rv, err := K8sClient.AuthenticationV1().TokenReviews().Create(c.Request.Context(), tr, v1.CreateOptions{})
772772
if err != nil {
773-
log.Printf("GitHub token mint: TokenReview API call failed for session %s/%s (token len=%d): %v",
774-
project, sessionName, len(token), err)
775773
c.JSON(http.StatusInternalServerError, gin.H{"error": "token review failed"})
776774
return
777775
}
778776
if rv.Status.Error != "" || !rv.Status.Authenticated {
779-
log.Printf("GitHub token mint: TokenReview authentication failed for session %s/%s: authenticated=%v, error=%q",
780-
project, sessionName, rv.Status.Authenticated, rv.Status.Error)
781777
c.JSON(http.StatusUnauthorized, gin.H{"error": "unauthenticated"})
782778
return
783779
}

‎components/backend/server/server.go‎

Lines changed: 1 addition & 73 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,6 @@ import (
1010

1111
"github.com/gin-contrib/cors"
1212
"github.com/gin-gonic/gin"
13-
authnv1 "k8s.io/api/authentication/v1"
14-
v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
1513
)
1614

1715
// RouterFunc is a function that can register routes on a Gin router
@@ -65,11 +63,9 @@ func Run(registerRoutes RouterFunc) error {
6563
return nil
6664
}
6765

68-
// forwardedIdentityMiddleware populates Gin context from common OAuth proxy headers.
69-
// Fallback: if OAuth headers are not present, performs TokenReview on Authorization Bearer token.
66+
// forwardedIdentityMiddleware populates Gin context from common OAuth proxy headers
7067
func forwardedIdentityMiddleware() gin.HandlerFunc {
7168
return func(c *gin.Context) {
72-
// Try OAuth proxy headers first (production with oauth-proxy)
7369
if v := c.GetHeader("X-Forwarded-User"); v != "" {
7470
c.Set("userID", v)
7571
}
@@ -87,74 +83,6 @@ func forwardedIdentityMiddleware() gin.HandlerFunc {
8783
if v := c.GetHeader("X-Forwarded-Groups"); v != "" {
8884
c.Set("userGroups", strings.Split(v, ","))
8985
}
90-
91-
// Fallback: if no OAuth headers, try TokenReview on Authorization token
92-
// This enables development/testing without oauth-proxy and service account auth
93-
if c.GetString("userID") == "" {
94-
if auth := c.GetHeader("Authorization"); auth != "" {
95-
parts := strings.SplitN(auth, " ", 2)
96-
if len(parts) == 2 && strings.EqualFold(parts[0], "Bearer") {
97-
token := strings.TrimSpace(parts[1])
98-
if token != "" {
99-
// Check if K8sClient is initialized
100-
if K8sClient == nil {
101-
log.Printf("Warning: K8sClient not initialized, cannot perform TokenReview")
102-
c.Next()
103-
return
104-
}
105-
106-
// Perform TokenReview on every request (no caching)
107-
// Rationale:
108-
// - Security: Validates token hasn't been revoked or expired
109-
// - Simplicity: Avoids complex cache invalidation logic
110-
// - Performance: TokenReview is lightweight (~5-10ms) and runs only in fallback path
111-
// (production uses oauth-proxy with X-Forwarded-* headers, bypassing this code)
112-
// - Short-lived tokens: ServiceAccount tokens can be rotated frequently
113-
// If TokenReview becomes a bottleneck, consider adding TTL-based cache with 1-minute expiry
114-
tr := &authnv1.TokenReview{Spec: authnv1.TokenReviewSpec{Token: token}}
115-
rv, err := K8sClient.AuthenticationV1().TokenReviews().Create(c.Request.Context(), tr, v1.CreateOptions{})
116-
if err != nil {
117-
// Log TokenReview API error with context for debugging
118-
log.Printf("TokenReview API call failed (token len=%d): %v", len(token), err)
119-
} else if !rv.Status.Authenticated {
120-
// Log authentication failure with reason
121-
log.Printf("TokenReview authentication failed: authenticated=false, error=%q, audiences=%v",
122-
rv.Status.Error, rv.Status.Audiences)
123-
} else if rv.Status.Error != "" {
124-
// Log authentication error from Kubernetes
125-
log.Printf("TokenReview returned error: %q (authenticated=%v)", rv.Status.Error, rv.Status.Authenticated)
126-
}
127-
if err == nil && rv.Status.Authenticated && rv.Status.Error == "" {
128-
username := strings.TrimSpace(rv.Status.User.Username)
129-
if username != "" {
130-
// Parse username: "system:serviceaccount:namespace:sa-name" or regular username
131-
if strings.HasPrefix(username, "system:serviceaccount:") {
132-
// ServiceAccount: extract namespace and SA name
133-
parts := strings.Split(username, ":")
134-
if len(parts) >= 4 {
135-
namespace := parts[2]
136-
saName := parts[3]
137-
// Use namespace/sa-name as userID for uniqueness
138-
c.Set("userID", fmt.Sprintf("%s/%s", namespace, saName))
139-
c.Set("userName", saName)
140-
}
141-
} else {
142-
// Regular user from OAuth/OIDC
143-
c.Set("userID", username)
144-
c.Set("userName", username)
145-
}
146-
147-
// Extract groups if available
148-
if len(rv.Status.User.Groups) > 0 {
149-
c.Set("userGroups", rv.Status.User.Groups)
150-
}
151-
}
152-
}
153-
}
154-
}
155-
}
156-
}
157-
15886
// Also expose access token if present
15987
auth := c.GetHeader("Authorization")
16088
if auth != "" {

‎components/manifests/overlays/e2e/operator-config.yaml‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,3 @@ data:
1111
CLOUD_ML_REGION: ""
1212
ANTHROPIC_VERTEX_PROJECT_ID: ""
1313
GOOGLE_APPLICATION_CREDENTIALS: ""
14-
15-
# Note: Langfuse observability configuration is stored in the 'ambient-admin-langfuse-secret'
16-
# Secret (platform-admin managed). For e2e testing, Langfuse is typically disabled.

‎components/manifests/overlays/local-dev/operator-config-crc.yaml‎

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -11,14 +11,3 @@ data:
1111
CLOUD_ML_REGION: ""
1212
ANTHROPIC_VERTEX_PROJECT_ID: ""
1313
GOOGLE_APPLICATION_CREDENTIALS: ""
14-
15-
# Note: Langfuse observability configuration is stored in the 'ambient-admin-langfuse-secret'
16-
# Secret (platform-admin managed). All LANGFUSE_* config is in one place.
17-
# For local dev, Langfuse is typically disabled. To enable, create the secret with:
18-
#
19-
# kubectl create secret generic ambient-admin-langfuse-secret \
20-
# --from-literal=LANGFUSE_PUBLIC_KEY=pk-lf-... \
21-
# --from-literal=LANGFUSE_SECRET_KEY=sk-lf-... \
22-
# --from-literal=LANGFUSE_HOST=http://langfuse-web.langfuse.svc.cluster.local:3000 \
23-
# --from-literal=LANGFUSE_ENABLED=true \
24-
# -n ambient-code

‎components/manifests/overlays/production/operator-config-openshift.yaml‎

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -11,14 +11,3 @@ data:
1111
CLOUD_ML_REGION: "global"
1212
ANTHROPIC_VERTEX_PROJECT_ID: "ambient-code-platform"
1313
GOOGLE_APPLICATION_CREDENTIALS: "/app/vertex/ambient-code-key.json"
14-
15-
# Note: Langfuse observability configuration (LANGFUSE_ENABLED, LANGFUSE_HOST,
16-
# LANGFUSE_PUBLIC_KEY, LANGFUSE_SECRET_KEY) is stored in the 'ambient-admin-langfuse-secret'
17-
# Secret (platform-admin managed). All LANGFUSE_* config is in one place.
18-
#
19-
# Create the secret with: kubectl create secret generic ambient-admin-langfuse-secret \
20-
# --from-literal=LANGFUSE_PUBLIC_KEY=pk-lf-... \
21-
# --from-literal=LANGFUSE_SECRET_KEY=sk-lf-... \
22-
# --from-literal=LANGFUSE_HOST=http://langfuse-web.langfuse.svc.cluster.local:3000 \
23-
# --from-literal=LANGFUSE_ENABLED=true \
24-
# -n ambient-code

0 commit comments

Comments
 (0)