fix: forward per-user auth headers to chatbot service (#56)

* fix: forward per-user auth headers from Express proxy to chatbot service

The chatbot pod calls the backend API (backend:3001) to fetch roster and
metrics data, but proxySecretGuard rejects those calls with 401 because
they lack auth headers. This forwards the authenticated user's identity
through the full request chain so the chatbot's backend API calls carry
per-user auth, preventing data leaks from a service account having
broader access than the actual user.

Express side:
- Add buildProxyHeaders() helper that forwards X-Proxy-Secret (from
  context.secrets) and X-Forwarded-Email (from req.userEmail) to the
  chatbot service on both /chat and /chat/stream endpoints
- Declare PROXY_AUTH_SECRET in module.json secrets (Hard Constraint #9)

Chatbot side:
- Add _extract_auth() to validate X-Proxy-Secret and X-Forwarded-Email
  on /agent/chat and /agent/chat/stream (returns 401 if missing)
- Add PerRequestClient wrapper that injects per-user auth headers into
  every backend API call while reusing the shared httpx connection pool
- Each request gets an independent cache (no cross-user contamination)
- Health endpoint remains unauthenticated (K8s probes unaffected)

Deployment:
- Add PROXY_AUTH_SECRET env var to chatbot-deployment.yaml from the same
  proxy-auth-secret Secret used by backend and frontend pods

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: validate proxy secret value in chatbot service

Add timing-safe comparison of the received X-Proxy-Secret header against
the expected PROXY_AUTH_SECRET env var, matching the backend's defense-in-depth
pattern.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>

Author: 3 people

deploy/openshift/base/chatbot-deployment.yaml

@@ -70,6 +70,12 @@ spec:
                   name: chatbot-secrets
                   key: CHATBOT_EMBEDDING_API_KEY
                   optional: true
+            - name: PROXY_AUTH_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: proxy-auth-secret
+                  key: secret
+                  optional: false
           readinessProbe:
             httpGet:
               path: /health

modules/chatbot/module.json

@@ -14,7 +14,8 @@
   },
   "secrets": {
     "module": [
-      { "key": "CHATBOT_SERVICE_URL", "description": "URL of the chatbot microservice (e.g. http://localhost:8002)", "required": true }
+      { "key": "CHATBOT_SERVICE_URL", "description": "URL of the chatbot microservice (e.g. http://localhost:8002)", "required": true },
+      { "key": "PROXY_AUTH_SECRET", "description": "Shared secret for internal service-to-service auth (must match backend)", "required": false }
     ]
   }
 }

modules/chatbot/server/index.js

@@ -12,6 +12,18 @@ module.exports = function registerRoutes(router, context) {
     return (secrets.CHATBOT_SERVICE_URL || '').replace(/\/$/, '')
   }
 
+  function buildProxyHeaders(req) {
+    const headers = { 'Content-Type': 'application/json' }
+    const proxySecret = secrets.PROXY_AUTH_SECRET
+    if (proxySecret) {
+      headers['X-Proxy-Secret'] = proxySecret
+    }
+    if (req.userEmail) {
+      headers['X-Forwarded-Email'] = req.userEmail
+    }
+    return headers
+  }
+
   function validateChatBody(body) {
     if (!body || typeof body.message !== 'string' || !body.message.trim()) {
       return 'message is required and must be a non-empty string'
@@ -70,7 +82,7 @@ module.exports = function registerRoutes(router, context) {
     try {
       const response = await fetch(`${serviceUrl}/agent/chat`, {
         method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
+        headers: buildProxyHeaders(req),
         body: JSON.stringify(pickChatFields(req.body)),
       })
 
@@ -129,7 +141,7 @@ module.exports = function registerRoutes(router, context) {
     try {
       const response = await fetch(`${serviceUrl}/agent/chat/stream`, {
         method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
+        headers: buildProxyHeaders(req),
         body: JSON.stringify(pickChatFields(req.body)),
       })
 

services/chatbot/routers/chat.py

@@ -1,13 +1,16 @@
 """Chat endpoints with SSE streaming support."""
 
 import asyncio
+import hmac
 import json
 import logging
 import math
+import os
 import time
 import uuid
 
 from fastapi import APIRouter, Request
+from fastapi.responses import JSONResponse
 from starlette.responses import StreamingResponse
 
 from pydantic_ai.messages import (
@@ -31,6 +34,7 @@
 )
 from models import ChatRequest, ChatResponse
 from prompts.system import SYSTEM_PROMPT
+from services.org_pulse_client import PerRequestClient
 from structured_logging import log_event
 from tools import ALL_TOOLS, retry_events
 
@@ -50,6 +54,24 @@
     "Please contact an administrator."
 )
 
+_AUTH_MISSING_MESSAGE = (
+    "Authentication headers missing. The chatbot must be accessed through the main application."
+)
+
+
+_EXPECTED_PROXY_SECRET = os.environ.get("PROXY_AUTH_SECRET", "")
+
+
+def _extract_auth(http_request: Request) -> tuple[str, str] | None:
+    """Extract and validate proxy auth headers. Returns (proxy_secret, user_email) or None."""
+    proxy_secret = http_request.headers.get("x-proxy-secret", "").strip()
+    user_email = http_request.headers.get("x-forwarded-email", "").strip()
+    if not proxy_secret or not user_email:
+        return None
+    if _EXPECTED_PROXY_SECRET and not hmac.compare_digest(proxy_secret, _EXPECTED_PROXY_SECRET):
+        return None
+    return proxy_secret, user_email
+
 
 # ---------------------------------------------------------------------------
 # Helpers
@@ -315,15 +337,20 @@ def _llm_error_message(exc: Exception) -> str:
 async def chat(request: ChatRequest, http_request: Request):
     request_id = uuid.uuid4().hex[:12]
 
+    auth = _extract_auth(http_request)
+    if not auth:
+        return JSONResponse(status_code=401, content={"error": _AUTH_MISSING_MESSAGE})
+    proxy_secret, user_email = auth
+
     agent = http_request.app.state.agent
     if not agent:
         return ChatResponse(message=_NOT_CONFIGURED_MESSAGE, trace={"request_id": request_id})
 
     retries: list[dict] = []
     retry_events.set(retries)
 
-    org_pulse_client = http_request.app.state.org_pulse_client
-    org_pulse_client.clear_cache()
+    shared_client = http_request.app.state.org_pulse_client
+    org_pulse_client = PerRequestClient(shared_client, proxy_secret, user_email)
     message_history = _convert_history(request.history)
     turn = _count_turns(request.history) + 1
 
@@ -455,6 +482,11 @@ async def chat(request: ChatRequest, http_request: Request):
 async def chat_stream(request: ChatRequest, http_request: Request):
     request_id = uuid.uuid4().hex[:12]
 
+    auth = _extract_auth(http_request)
+    if not auth:
+        return JSONResponse(status_code=401, content={"error": _AUTH_MISSING_MESSAGE})
+    proxy_secret, user_email = auth
+
     agent = http_request.app.state.agent
     if not agent:
         async def _not_configured():
@@ -515,8 +547,8 @@ async def _refusal_stream():
     else:
         run_toolsets, tool_selection, selector_ms = await selector_coro
 
-    org_pulse_client = http_request.app.state.org_pulse_client
-    org_pulse_client.clear_cache()
+    shared_client = http_request.app.state.org_pulse_client
+    org_pulse_client = PerRequestClient(shared_client, proxy_secret, user_email)
     message_history = _convert_history(request.history)
     turn = _count_turns(request.history) + 1
 

services/chatbot/services/org_pulse_client.py

@@ -42,9 +42,9 @@ def clear_cache(self):
     async def close(self):
         await self._client.aclose()
 
-    async def _get(self, path: str, params: dict | None = None) -> dict | list | None:
+    async def _get(self, path: str, params: dict | None = None, extra_headers: dict | None = None) -> dict | list | None:
         try:
-            resp = await self._client.get(path, params=params)
+            resp = await self._client.get(path, params=params, headers=extra_headers)
             resp.raise_for_status()
             return resp.json()
         except httpx.HTTPStatusError as exc:
@@ -76,3 +76,31 @@ async def get_github_contributions(self) -> dict | None:
 
     async def get_gitlab_contributions(self) -> dict | None:
         return await self._get("/api/modules/team-tracker/gitlab/contributions")
+
+
+class PerRequestClient(OrgPulseClient):
+    """Wrapper that adds per-request auth headers to a shared OrgPulseClient.
+
+    Inherits all data-fetching methods from OrgPulseClient so new methods are
+    automatically available. Overrides _get() to inject X-Proxy-Secret and
+    X-Forwarded-Email via the shared client's connection pool. Maintains its
+    own independent cache so concurrent requests with different user identities
+    don't cross-contaminate.
+    """
+
+    def __init__(self, shared_client: OrgPulseClient, proxy_secret: str, user_email: str):
+        # Skip OrgPulseClient.__init__ — we don't create our own httpx client
+        self._shared = shared_client
+        self._extra_headers = {
+            "X-Proxy-Secret": proxy_secret,
+            "X-Forwarded-Email": user_email,
+        }
+        self._cache: dict = {}
+
+    async def _get(self, path: str, params: dict | None = None, extra_headers: dict | None = None) -> dict | list | None:
+        # Always use our per-request auth headers, ignore any passed extra_headers
+        return await self._shared._get(path, params=params, extra_headers=self._extra_headers)
+
+    async def close(self):
+        # No-op — the shared client owns the connection pool
+        pass