[TaylorMutch]

Superseded by draft #4963. GitHub automatically marked this PR merged into its former SDK base during publication of the reordered stack. Main was unchanged. Review #4963 for the isolated gateway application authentication change.

Summary

Authenticate and authorize gateway-mediated application HTTP requests and WebSocket upgrades before connecting upstream. Support browser login/session access and separate gateway credentials from application-owned bearer tokens and cookies.

Stacked on the Go SDK discovery PR. This commit excludes the example Kubernetes controller.

Related Issue

Closes #4722.

The linked issue currently has no state:accepted label; the author has verified repository ADMIN access.

Changes

• Use configured gateway authenticators or verified TLS identity, workspace access, and the existing TCP-forwarding role/scope policy; reject internal and anonymous principals in authenticated deployments.
• Add a control-plane browser login workflow with single-use state-bound bootstrap codes and distinct host-only Secure/HttpOnly/SameSite=Strict sessions, bounded lifetime, and authorization on each request.
• Store original session credentials through the configured credential driver; support shared-store logout and application credential revocation across gateway replicas.
• Support separate gateway bearer credentials through X-OpenShell-Authorization, preserve application-owned credentials, and strip reserved gateway headers/cookies from both application paths.
• Require origin/Fetch Metadata protections for ambient-cookie/mTLS unsafe requests and WebSocket upgrades, and document explicit unauthenticated local development.

Release Notes

Breaking behavior: authenticated gateways now require gateway authentication for application requests with the app listener enabled or disabled. Direct app-listener authentication remains the ingress provider's responsibility. Browser users start login at the control-plane /auth/services?service_origin=... endpoint.

Testing

• Full gateway library suite passed: 2,401 tests, 22 ignored; focused final access tests also passed.
• Direct supervisor app-listener tests (13), server/supervisor Clippy, Rust formatting, JS syntax, and strict documentation checks passed.
• Signed OIDC and independent gateway-state tests cover sessions, credential separation, roles/scopes, CSRF, logout/revocation, expiry, and membership removal.
• Actual upstream HTTP and production TLS fixtures cover credential stripping and verified mTLS with both app-listener settings.
• The optional real-Chrome cross-site browser test was explicitly run and passed, including Strict/HttpOnly sessions, authenticated POST, and logout.
• Publication audit verified that removing the controller parent preserved the auth patch exactly, apart from the changed documentation blob IDs.

Operational semantics

Credential revocation affects subsequent application requests and upgrades across gateway replicas. Existing WebSockets retain authentication at upgrade; external IdP token revocation is subject to the gateway's offline verifier semantics unless the gateway application-revocation endpoint is used. These endpoints do not revoke control-plane RPC credentials or external IdP issuance.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture/configuration/API documentation updated where applicable

RFC 0017 draft stack: #4936 → #4940 → #4941 → #4956 → #4957 → #4958 → #4959. The example Kubernetes HTTPRoute controller remains on a separate branch outside this stack.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-4959.docs.buildwithfern.com/openshell