[ericcurtin]

Summary

Verify the Cloudflare Access token on every gRPC request, so bypassing the proxy no longer grants admin.

Related Issue

Closes #4813

Changes

• Add [openshell.gateway.edge_auth] and an EdgeAuthenticator.
• Reuse JwksCache for key fetch, rotation, and validation.
• Share RBAC policy construction between OIDC and edge.
• Refuse edge_auth with OIDC or allow_unauthenticated_users.
• Docs.

Without admin_role and user_role, every admitted caller is a platform admin (as with mTLS). Startup warns.

Release Notes

Gateways behind Cloudflare Access can verify the Access token with [openshell.gateway.edge_auth] instead of allow_unauthenticated_users.

Testing

• Checks appropriate to the affected code and behavior pass
• Unit tests added/updated (if applicable)
• E2E tests added/updated (if applicable)

Ran cargo fmt, cargo clippy -D warnings, cargo test for openshell-server and openshell-core, markdownlint, and fern check.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[ericcurtin]

@mrunalp @johntmyers PTAL, and /ok to test 1f7556b266831c0f2d94c08939ebd7c2a739f513 if it looks good. Thank you!