Add JWT token validation with user context extraction for file uploads

[Copilot]

External services need to authenticate and track user context (user ID, space ID, file type) when uploading files. Previously only service tokens were supported, which lacked user attribution.

Changes

Authentication

• Added JWTAuthMiddleware validating sub (GUID), type (string), and optional spaceId (GUID) claims
• Implemented CombinedAuthMiddleware accepting either x-api-token or Authorization: Bearer headers
• Updated upload endpoint to use combined authentication

Data Model

• Extended File model with nullable UserSub, SpaceId, FileType fields
• Updated Postgres and Scylla repositories to persist/retrieve JWT claims
• Modified UpdateFile, GetFileByID, GetFileByName, ListFiles queries

Migrations

• Postgres: Added user_sub, space_id, file_type columns
• Scylla: Separated into three migrations due to single-column ALTER restriction

Configuration

• Added jwt_secret parameter (flag/env/config file)

Usage

// External service generates JWT
claims := JWTClaims{
    Sub:     "550e8400-e29b-41d4-a716-446655440000",
    SpaceId: &"660e8400-e29b-41d4-a716-446655440001", // optional
    Type:    "avatar",
}

// Upload with JWT
req.Header.Set("Authorization", "Bearer " + signedToken)
// File record now includes user_sub, space_id, file_type

Service token authentication remains unchanged for backward compatibility.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• dario.cat
  • Triggering command: /update-job-proxy /update-job-proxy io.containerd.rushow =1 ux_amd64/vet --ro�� 6_add_file_type.down.sql --log ux_amd64/vet (dns block)
  • Triggering command: /update-job-proxy /update-job-proxy ACCEPT --alternate-refs/home/dependabot/go/pkg/mod/cache/vcs/7d314923ef34c8dcc5ae2aed0a0aa313627e4cf88db142be752f8f42a2dd7b17/shallow.lock git -c f225814414e9ca2d--stdin log /home/dependabot--alternate-refs -n1 --format=format:-c refs/tags/v0.7.6log.showsignature=false git conf�� =2 e/git /bin/git ock om/aws/aws-sdk-g--wait 0:refs/tags/v0.5-t /usr/bin/git (dns block)
• dl.min.io
  • Triggering command: /usr/bin/minio minio server /data ux_amd64/vet -I o-v2@v1.41.1/int-errorsas WnDucx-vv ux_amd64/vet --gdwarf-5 /singleflight -o ux_amd64/vet ortc�� /semver/semver.go x64/src/debug/dwarf/attr_string.-ifaceassert ux_amd64/vet 0183971/b187/ ernal/sdk (dns block)
  • Triggering command: /usr/bin/minio minio server /data (dns block)
  • Triggering command: /usr/bin/minio minio server /data /run/containerd/io.containerd.runtime.v2.task/moby/2bf87787a1e9d38ccdfa39f0eb297ed679c9ed661677ae594dea1fbfb9284bfe --pid-file /run/containerd/io.containerd.runtime.v2.task/moby/2bf87787a1e9d38ccdfa39f0eb297ed679c9ed661677ae594dea1fbfb9284bfe/init.pid 2bf87787a1e9d38ccdfa39f0eb297ed679c9ed661677ae594dea1fbfb9284bfe g_ctl ntime.v2.task/mobash ntime.v2.task/mo--norc 093b291bfd3e5d18--noprofile 8c6/log.json list�� y --no-legend ntime.v2.task/mo--dport g_.a ntime.v2.task/mo/usr/bin/runc 093b291bfd3e5d18--root /usr/bin/docker-/var/run/docker/runtime-runc/moby (dns block)
• go.googlesource.com
  • Triggering command: /update-job-proxy /update-job-proxy io.containerd.rushow =1 ux_amd64/vet --ro�� 6_add_file_type.down.sql --log ux_amd64/vet (dns block)
• go.opentelemetry.io
  • Triggering command: /update-job-proxy /update-job-proxy io.containerd.rushow =1 ux_amd64/vet --ro�� 6_add_file_type.down.sql --log ux_amd64/vet (dns block)
• go.uber.org
  • Triggering command: /update-job-proxy /update-job-proxy io.containerd.rushow =1 ux_amd64/vet --ro�� 6_add_file_type.down.sql --log ux_amd64/vet (dns block)
• go.yaml.in
  • Triggering command: /update-job-proxy /update-job-proxy io.containerd.rushow =1 ux_amd64/vet --ro�� 6_add_file_type.down.sql --log ux_amd64/vet (dns block)
• google.golang.org
  • Triggering command: /update-job-proxy /update-job-proxy io.containerd.rushow =1 ux_amd64/vet --ro�� 6_add_file_type.down.sql --log ux_amd64/vet (dns block)
• gopkg.in
  • Triggering command: /update-job-proxy /update-job-proxy io.containerd.rushow =1 ux_amd64/vet --ro�� 6_add_file_type.down.sql --log ux_amd64/vet (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

The service has user tokens, you need to add an additional functionality for ability external services to generate JWT tokens to replace user tokens and service KineticaFS to ability validate thier token, so that it would be possible to log and store information about users in KineticaFS, the fields that need to be extracted from the JWT token are sub (GUID), spaceId (GUID nullable, i.e. optional) and type (string) it's just a "scope" in which type of uploaded file, avatar, profileHeader, stickers, etc.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}