Implement Token-Based Authentication System (#75)

Implement authentication system enabling secure connections to remote
Construct daemons while preserving local Unix socket simplicity.

Core authentication flows:
- Unix socket connections: implicit admin via OS permissions
- TCP connections: Bearer token validation with database lookup
- Setup codes: secure bootstrap mechanism for token distribution

Token security model:
- 256-bit cryptographic randomness (crypto/rand)
- SHA-256 hashing (plaintext never stored)
- Configurable expiration (90 day default, 365 day max)
- One-time display at creation

Setup code bootstrap:
- Short-lived codes (20 minute default expiry)
- Single-use consumption with automatic deletion
- Case-insensitive for usability
- Thread-safe in-memory storage

API additions:
- AuthService with 5 RPCs (CreateToken, CreateSetupCode, ListTokens, 
  RevokeToken, ExchangeSetupCode)
- ConnectRPC interceptor for authentication enforcement

Co-authored-by: construct-agent <noreply@construct.sh>

Author: Furisto

api/go/client/client.go

@@ -21,6 +21,7 @@ type Client struct {
 	agent         v1connect.AgentServiceClient
 	task          v1connect.TaskServiceClient
 	message       v1connect.MessageServiceClient
+	auth          v1connect.AuthServiceClient
 }
 
 type ClientOptions struct {
@@ -104,6 +105,7 @@ func NewClient(endpointContext EndpointContext, options ...ClientOption) (*Clien
 		agent:         v1connect.NewAgentServiceClient(opts.HTTPClient, baseURL, opts.ConnectOptions...),
 		task:          v1connect.NewTaskServiceClient(opts.HTTPClient, baseURL, opts.ConnectOptions...),
 		message:       v1connect.NewMessageServiceClient(opts.HTTPClient, baseURL, opts.ConnectOptions...),
+		auth:          v1connect.NewAuthServiceClient(opts.HTTPClient, baseURL, opts.ConnectOptions...),
 	}, nil
 }
 
@@ -127,12 +129,17 @@ func (c *Client) Message() v1connect.MessageServiceClient {
 	return c.message
 }
 
+func (c *Client) Auth() v1connect.AuthServiceClient {
+	return c.auth
+}
+
 type MockClient struct {
 	ModelProvider *mocks.MockModelProviderServiceClient
 	Model         *mocks.MockModelServiceClient
 	Agent         *mocks.MockAgentServiceClient
 	Task          *mocks.MockTaskServiceClient
 	Message       *mocks.MockMessageServiceClient
+	Auth          *mocks.MockAuthServiceClient
 }
 
 func NewMockClient(ctrl *gomock.Controller) *MockClient {
@@ -142,6 +149,7 @@ func NewMockClient(ctrl *gomock.Controller) *MockClient {
 		Agent:         mocks.NewMockAgentServiceClient(ctrl),
 		Task:          mocks.NewMockTaskServiceClient(ctrl),
 		Message:       mocks.NewMockMessageServiceClient(ctrl),
+		Auth:          mocks.NewMockAuthServiceClient(ctrl),
 	}
 }
 
@@ -152,6 +160,7 @@ func (c *MockClient) Client() *Client {
 		agent:         c.Agent,
 		task:          c.Task,
 		message:       c.Message,
+		auth:          c.Auth,
 	}
 }
 

api/go/client/mocks/auth.connect_mock.go

@@ -13,6 +13,7 @@ import (
 
 	"github.com/furisto/construct/api/go/v1/v1connect"
 	"github.com/furisto/construct/backend/analytics"
+	"github.com/furisto/construct/backend/api/auth"
 	"github.com/furisto/construct/backend/event"
 	"github.com/furisto/construct/backend/memory"
 	"github.com/furisto/construct/backend/secret"
@@ -31,14 +32,17 @@ type Server struct {
 }
 
 func NewServer(runtime AgentRuntime, listener net.Listener, eventBus *event.Bus, analyticsClient analytics.Client) *Server {
+	tokenProvider := auth.NewTokenProvider()
+
 	apiHandler := NewHandler(
 		HandlerOptions{
-			DB:           runtime.Memory(),
-			Encryption:   runtime.Encryption(),
-			AgentRuntime: runtime,
-			MessageHub:   runtime.EventHub(),
-			EventBus:     eventBus,
-			Analytics:    analyticsClient,
+			DB:            runtime.Memory(),
+			Encryption:    runtime.Encryption(),
+			AgentRuntime:  runtime,
+			MessageHub:    runtime.EventHub(),
+			EventBus:      eventBus,
+			Analytics:     analyticsClient,
+			TokenProvider: tokenProvider,
 		},
 	)
 
@@ -60,6 +64,13 @@ func (s *Server) ListenAndServe(ctx context.Context) error {
 		BaseContext: func(l net.Listener) context.Context {
 			return ctx
 		},
+		ConnContext: func(ctx context.Context, c net.Conn) context.Context {
+			transport := auth.TransportTCP
+			if _, ok := c.(*net.UnixConn); ok {
+				transport = auth.TransportUnix
+			}
+			return auth.WithTransport(ctx, transport)
+		},
 	}
 
 	return s.server.Serve(s.listener)
@@ -70,9 +81,10 @@ func (s *Server) Shutdown(ctx context.Context) error {
 }
 
 type HandlerOptions struct {
-	DB           *memory.Client
-	Encryption   *secret.Encryption
-	AgentRuntime AgentRuntime
+	DB            *memory.Client
+	Encryption    *secret.Encryption
+	AgentRuntime  AgentRuntime
+	TokenProvider *auth.TokenProvider
 
 	EventBus   *event.Bus
 	MessageHub *event.MessageHub
@@ -90,20 +102,25 @@ func NewHandler(opts HandlerOptions) *Handler {
 		mux: http.NewServeMux(),
 	}
 
+	connectOpts := append([]connect.HandlerOption{connect.WithInterceptors(auth.NewAuthInterceptor(opts.DB, opts.TokenProvider))}, opts.RequestOptions...)
+
+	authHandler := NewAuthHandler(opts.DB, opts.TokenProvider)
+	handler.mux.Handle(v1connect.NewAuthServiceHandler(authHandler, connectOpts...))
+
 	modelProviderHandler := NewModelProviderHandler(opts.DB, opts.Encryption)
-	handler.mux.Handle(v1connect.NewModelProviderServiceHandler(modelProviderHandler, opts.RequestOptions...))
+	handler.mux.Handle(v1connect.NewModelProviderServiceHandler(modelProviderHandler, connectOpts...))
 
 	modelHandler := NewModelHandler(opts.DB)
-	handler.mux.Handle(v1connect.NewModelServiceHandler(modelHandler, opts.RequestOptions...))
+	handler.mux.Handle(v1connect.NewModelServiceHandler(modelHandler, connectOpts...))
 
 	agentHandler := NewAgentHandler(opts.DB, opts.Analytics)
-	handler.mux.Handle(v1connect.NewAgentServiceHandler(agentHandler, opts.RequestOptions...))
+	handler.mux.Handle(v1connect.NewAgentServiceHandler(agentHandler, connectOpts...))
 
 	taskHandler := NewTaskHandler(opts.DB, opts.MessageHub, opts.EventBus, opts.AgentRuntime, opts.Analytics)
-	handler.mux.Handle(v1connect.NewTaskServiceHandler(taskHandler, opts.RequestOptions...))
+	handler.mux.Handle(v1connect.NewTaskServiceHandler(taskHandler, connectOpts...))
 
 	messageHandler := NewMessageHandler(opts.DB, opts.AgentRuntime, opts.MessageHub, opts.EventBus)
-	handler.mux.Handle(v1connect.NewMessageServiceHandler(messageHandler, opts.RequestOptions...))
+	handler.mux.Handle(v1connect.NewMessageServiceHandler(messageHandler, connectOpts...))
 
 	return handler
 }