auth: remove role management, rely on CMID and IDP (#30)

auth: remove role scoping, using CMID only

Author: trly

AGENTS.md

@@ -19,7 +19,7 @@
 
 ## Protocol Boundaries
 
-- The server is an OAuth 2.0 protected resource; list/download routes are public and mutations require operation-specific scopes.
+- The server is an OAuth 2.0 protected resource; list/download routes are public and mutations require operation-specific scopes. Identity-provider client restrictions, not local user/role mappings, determine who receives those scopes.
 - The CLI discovers RFC 9728 protected-resource metadata and then OIDC metadata. Generic RFC 8414-only providers and direct endpoint overrides are unsupported.
 - Keep OAuth mechanics in `golang.org/x/oauth2`, OIDC discovery/validation in `go-oidc`, URL trust rules in `internal/urlpolicy`, and authorization policy in `internal/auth`.
 - `PKGDEPOT_OIDC_*` configures the server; `PKGDEPOT_OAUTH_*` configures CLI clients. Do not interchange them.

README.md

@@ -85,23 +85,26 @@ client specified with `PKGDEPOT_OAUTH_CLIENT_ID`. Pre-registered clients must
 allow these loopback callbacks:
 
 ```text
-http://127.0.0.1:8085/oauth/callback
-http://127.0.0.1:8086/oauth/callback
-http://127.0.0.1:8087/oauth/callback
-http://127.0.0.1:8088/oauth/callback
-http://127.0.0.1:8089/oauth/callback
+http://127.0.0.1/oauth/callback
+http://[::1]/oauth/callback
 ```
 
-Delegated access tokens need both the requested OAuth scope and a role mapped to
-that scope. By default, roles are read from the `pkgdepot_roles` claim:
+The CLI selects IPv4 or IPv6 and binds an ephemeral port for each login. Do not
+register fixed ports; the provider matches these loopback redirect URIs with a
+variable port.
 
-```json
-{"pkgdepot_roles":["publisher"]}
-```
+Authorization is controlled by the identity provider's client restrictions and
+resource scopes. pkgdepot publishes two CIMD clients:
+
+| Client | CIMD client ID path | Intended group | Scopes |
+| --- | --- | --- | --- |
+| Publisher | `/oauth/clients/cli-publisher` | `pkgdepot publishers` | `package:publish` |
+| Admin | `/oauth/clients/cli-admin` | `pkgdepot administrators` | All mutation scopes |
 
-The built-in `admin` role grants every mutation scope. `publisher` grants only
-`package:publish`. Configure a different claim or mapping with
-`PKGDEPOT_ROLE_CLAIM` and `PKGDEPOT_ROLE_SCOPES`.
+Restrict each client to its corresponding provider group. pkgdepot does not
+read user roles or map role claims; a validated access token with the requested
+operation scope is authorized. The token audience remains the canonical
+`PKGDEPOT_URL`, not either CIMD client ID.
 
 ### Delegated CLI login
 
@@ -111,22 +114,22 @@ HTTPS deployment with a provider that supports CIMD:
 ```sh
 export PKGDEPOT_URL=https://packages.example.com
 
-pkgdepot login --scope repo:create --scope package:publish
+pkgdepot login --access admin --scope repo:create --scope package:publish
 pkgdepot repo create stable
 pkgdepot package publish stable ./example-1.0-1-x86_64.pkg.tar.zst
 ```
 
-The CLI prints URLs for identity verification and scope selection. Run
-`pkgdepot logout` to delete its cached delegated token. For a provider without
-CIMD, set `PKGDEPOT_OAUTH_CLIENT_ID` to a registered client ID before login.
-For the default local HTTP URL, a pre-registered client ID is always required.
+The CLI prints URLs for identity verification and scope selection. Use
+`--access publisher` or `--access admin` to select a CIMD client; administrative
+scopes select the admin client automatically. Run `pkgdepot logout` to delete
+cached delegated tokens. For a provider without CIMD, set
+`PKGDEPOT_OAUTH_CLIENT_ID` to a registered client ID before login. For the
+default local HTTP URL, a pre-registered client ID is always required.
 
 ### Automation with client credentials
 
 For headless or containerized automation, configure a confidential client. The
-server must set `PKGDEPOT_CLIENT_CREDENTIALS_SUBJECT_TEMPLATE` to the format of
-the provider's client-credentials subject, for example `client-{client_id}`.
-The client needs an ID, secret, and issuer pin:
+client needs an ID, secret, issuer pin, and the required operation scopes:
 
 ```sh
 PKGDEPOT_URL=https://packages.example.com \
@@ -147,13 +150,12 @@ To use Pocket ID with client credentials:
 1. Create a `pkgdepot` API whose resource is the exact public `PKGDEPOT_URL`.
 2. Add the required operation scopes, such as `package:publish` and `package:remove`.
 3. Create a confidential OIDC client and grant its API access under **Client access**.
-4. Start pkgdepot with the Pocket ID issuer and a matching subject template.
+4. Start pkgdepot with the Pocket ID issuer.
 5. Configure the CLI with the confidential client credentials as shown above.
 
 ```sh
 PKGDEPOT_URL=https://packages.example.com \
 PKGDEPOT_OIDC_ISSUER=https://id.example.com \
-PKGDEPOT_CLIENT_CREDENTIALS_SUBJECT_TEMPLATE=client-{client_id} \
 pkgdepot serve
 ```
 
@@ -228,15 +230,12 @@ sudo pacman -Syu example
 | `PKGDEPOT_OIDC_AUDIENCE` | `PKGDEPOT_URL` | Expected access-token audience. |
 | `PKGDEPOT_OIDC_JWT_ALGORITHMS` | `RS256` | Allowed access-token signing algorithms. |
 | `PKGDEPOT_OIDC_JWT_CACHE_LIFETIME` | `15m` | Maximum signing-key-set trust lifetime. |
-| `PKGDEPOT_ROLE_CLAIM` | `pkgdepot_roles` | Access-token claim containing roles. |
-| `PKGDEPOT_ROLE_SCOPES` | Built-in admin/publisher mapping | JSON object mapping roles to operation scopes. |
-| `PKGDEPOT_CLIENT_CREDENTIALS_SUBJECT_TEMPLATE` | Disabled | Client-credentials subject format containing one `{client_id}`. |
 
 ### CLI OAuth
 
 | Variable | Default | Description |
 | --- | --- | --- |
-| `PKGDEPOT_OAUTH_CLIENT_ID` | Empty | Required for client credentials and delegated clients without CIMD. HTTPS delegated clients with CIMD derive the server metadata URL when it is empty. |
+| `PKGDEPOT_OAUTH_CLIENT_ID` | Empty | Required for client credentials and delegated clients without CIMD. HTTPS delegated clients with CIMD derive the publisher or admin CIMD URL. |
 | `PKGDEPOT_OAUTH_CLIENT_SECRET` | Empty | Enables client-credentials authentication; omit for delegated login. |
 | `PKGDEPOT_OAUTH_ISSUER` | Required with a client secret | Expected issuer pin before credentials are sent. |
 

cmd/pkgdepot/login.go

@@ -19,13 +19,17 @@ func loginCommand() *cli.Command {
 			Name:  "scope",
 			Usage: "OAuth scope to request; may be repeated",
 			Value: append([]string(nil), defaultOAuthScopes...),
+		}, &cli.StringFlag{
+			Name:  "access",
+			Usage: "OAuth access profile (publisher or admin)",
 		}),
 		Action: login,
 	}
 }
 
 func login(ctx context.Context, cmd *cli.Command) error {
 	client := httpclient.New(ctx, cmd.String("url"))
+	client.OAuth.Access = cmd.String("access")
 	token, err := client.Login(ctx, cmd.StringSlice("scope"))
 	if err != nil {
 		return err

cmd/pkgdepot/serve.go

@@ -71,7 +71,7 @@ func resourceServer(cfg config.Config) (*auth.ResourceServer, error) {
 		audience = resourceURL
 	}
 	discoveryCtx := oidc.ClientContext(context.Background(), &http.Client{Timeout: cfg.HTTPTimeout})
-	validator, err := auth.NewOIDCValidator(discoveryCtx, auth.OIDCOptions{Issuer: cfg.Auth.Issuer, Audience: audience, Algorithms: cfg.Auth.Algorithms, KeyCacheLifetime: cfg.Auth.KeyCacheLifetime, RoleClaim: cfg.Auth.RoleClaim})
+	validator, err := auth.NewOIDCValidator(discoveryCtx, auth.OIDCOptions{Issuer: cfg.Auth.Issuer, Audience: audience, Algorithms: cfg.Auth.Algorithms, KeyCacheLifetime: cfg.Auth.KeyCacheLifetime})
 	if err != nil {
 		return nil, err
 	}
@@ -94,7 +94,7 @@ func resourceServerWithValidator(cfg config.Config, validator auth.Validator) *a
 			BearerMethodsSupported: []string{"header"},
 		},
 		Authorize: func(claims auth.Claims, scope, _, _ string) bool {
-			return auth.AuthorizeRoles(claims, scope, cfg.Auth.RoleScopes, cfg.Auth.ClientCredentialsSubjectTemplate)
+			return auth.HasScope(claims, scope)
 		},
 	}
 }

cmd/pkgdepot/serve_test.go

@@ -22,12 +22,12 @@ func TestResourceServerDefaultsAudienceToResourceURL(t *testing.T) {
 		})
 	}))
 	defer issuer.Close()
-	resource, err := resourceServer(config.Config{URL: "https://packages.example", HTTPTimeout: time.Second, Auth: config.OIDCConfig{Issuer: issuer.URL, RoleScopes: map[string][]string{"publisher": {auth.ScopePublish}}, ClientCredentialsSubjectTemplate: "{client_id}"}})
+	resource, err := resourceServer(config.Config{URL: "https://packages.example", HTTPTimeout: time.Second, Auth: config.OIDCConfig{Issuer: issuer.URL}})
 	if err != nil {
 		t.Fatal(err)
 	}
-	if resource.Metadata.Resource != "https://packages.example" || !resource.Authorize(auth.Claims{Roles: []string{"publisher"}, Scopes: []string{auth.ScopePublish}}, auth.ScopePublish, "stable", "x86_64") {
-		t.Fatal("resource server did not wire role authorization")
+	if resource.Metadata.Resource != "https://packages.example" || !resource.Authorize(auth.Claims{Scopes: []string{auth.ScopePublish}}, auth.ScopePublish, "stable", "x86_64") {
+		t.Fatal("resource server did not wire scope authorization")
 	}
 	if !resource.Authorize(auth.Claims{Scopes: []string{auth.ScopePublish}, Subject: "app", ClientID: "app"}, auth.ScopePublish, "stable", "x86_64") {
 		t.Fatal("resource server rejected a client-credentials scope")

internal/auth/AGENTS.md

@@ -5,16 +5,14 @@
 - Validate RFC 9068 access tokens, not generic JWTs or ID tokens. Require a three-part JWT with case-insensitive `typ` exactly `at+jwt` or `application/at+jwt`.
 - Enforce issuer, audience, expiry, signature, allowed algorithms, and nonempty `sub`, `client_id`, and `jti`, plus a positive numeric `iat`. The default algorithm is RS256 only.
 - `scp` must be a JSON string array; `scope` is whitespace-delimited. An absent `scp` is valid, but a scalar is not.
-- The role claim defaults to `pkgdepot_roles`. Missing or `null` means no roles; any other present non-string-array value invalidates the token.
 - Do not expose verifier details: log the underlying cause and return `ErrInvalidToken`.
 - Signing-key trust expires from key-set creation and defaults to 15 minutes. Replace the remote key set once under its mutex; do not extend trust on successful traffic.
 
 ## Authorization
 
-- Delegated tokens need both the requested OAuth scope and a role mapped to it. A mapped role alone is insufficient; unknown roles grant nothing.
-- Role-less tokens are denied unless the configured client-credentials subject template exactly matches `sub` after `{client_id}` substitution. Tokens with roles always use role mapping.
+- Authorization is scope-only: a validated token is allowed when it contains the requested operation scope. User/group and client restrictions belong to the identity provider.
 - Bearer parsing distinguishes missing credentials from malformed credentials; HTTP integration relies on that distinction for challenges and OAuth error codes.
-- Preserve the five mutation scope constants and built-in mapping: `admin` gets all; `publisher` gets only `package:publish`.
+- Preserve the five mutation scope constants.
 
 ## Tests
 

internal/auth/auth.go

@@ -22,25 +22,15 @@ const (
 	ScopeRepositoryCreate = "repo:create"
 	ScopeRepositoryRemove = "repo:remove"
 	ScopeRepositoryRename = "repo:rename"
-	DefaultRoleClaim      = "pkgdepot_roles"
 )
 
 // Claims are the access-token claims relevant to a protected resource server.
 type Claims struct {
 	Scopes   []string
-	Roles    []string
 	Subject  string
 	ClientID string
 }
 
-// DefaultRoleScopes returns the built-in roles for a new PKGdepot server.
-func DefaultRoleScopes() map[string][]string {
-	return map[string][]string{
-		"admin":     {ScopePublish, ScopeRemove, ScopeRepositoryCreate, ScopeRepositoryRemove, ScopeRepositoryRename},
-		"publisher": {ScopePublish},
-	}
-}
-
 type Validator interface {
 	Validate(context.Context, string) (Claims, error)
 }
@@ -51,7 +41,6 @@ type OIDCOptions struct {
 	Audience         string
 	Algorithms       []string
 	KeyCacheLifetime time.Duration
-	RoleClaim        string
 }
 
 // NewOIDCValidator creates an OIDC-discovered signed JWT access-token validator.
@@ -80,38 +69,6 @@ func HasScope(claims Claims, scope string) bool {
 	return slices.Contains(claims.Scopes, scope)
 }
 
-// AuthorizeRoles reports whether the claims grant the requested scope. User
-// tokens must have both the OAuth scope and a role that permits it. Role-less
-// client-credentials tokens may authorize from their OAuth scopes when their
-// subject matches subjectTemplate.
-func AuthorizeRoles(claims Claims, scope string, roleScopes map[string][]string, subjectTemplate string) bool {
-	if len(claims.Roles) == 0 {
-		if subjectTemplate == "" || !MatchClientCredentialsSubject(claims, subjectTemplate) {
-			return false
-		}
-		return HasScope(claims, scope)
-	}
-	if !HasScope(claims, scope) {
-		return false
-	}
-	for _, role := range claims.Roles {
-		if slices.Contains(roleScopes[role], scope) {
-			return true
-		}
-	}
-	return false
-}
-
-// MatchClientCredentialsSubject reports whether the token subject matches the
-// configured client-credentials template. The template must contain exactly one
-// {client_id} placeholder, which is expanded to the signed client_id claim.
-func MatchClientCredentialsSubject(claims Claims, subjectTemplate string) bool {
-	if claims.Subject == "" || subjectTemplate == "" {
-		return false
-	}
-	return claims.Subject == strings.ReplaceAll(subjectTemplate, "{client_id}", claims.ClientID)
-}
-
 func BearerToken(header string) (string, error) {
 	if strings.TrimSpace(header) == "" {
 		return "", ErrMissingCredentials

internal/auth/auth_test.go

@@ -29,38 +29,3 @@ func TestHasScope(t *testing.T) {
 		t.Fatal("undeclared scope was authorized")
 	}
 }
-
-func TestAuthorizeRoles(t *testing.T) {
-	roleScopes := map[string][]string{
-		"admin":     {auth.ScopePublish, auth.ScopeRemove},
-		"publisher": {auth.ScopePublish},
-		"viewer":    {},
-	}
-	for name, test := range map[string]struct {
-		roles           []string
-		scopes          []string
-		subject         string
-		clientID        string
-		subjectTemplate string
-		scope           string
-		want            bool
-	}{
-		"role grants scope":              {roles: []string{"publisher"}, scopes: []string{auth.ScopePublish}, scope: auth.ScopePublish, want: true},
-		"role grant without token scope": {roles: []string{"publisher"}, scope: auth.ScopePublish},
-		"role lacks scope":               {roles: []string{"publisher"}, scope: auth.ScopeRemove},
-		"one of multiple roles":          {roles: []string{"viewer", "admin"}, scopes: []string{auth.ScopeRemove}, scope: auth.ScopeRemove, want: true},
-		"unknown role":                   {roles: []string{"unknown"}, scope: auth.ScopePublish},
-		"no roles":                       {scope: auth.ScopePublish},
-		"client credentials scope":       {subject: "app", clientID: "app", subjectTemplate: "{client_id}", scopes: []string{auth.ScopePublish}, scope: auth.ScopePublish, want: true},
-		"pocket id client credentials":   {subject: "client-app", clientID: "app", subjectTemplate: "client-{client_id}", scopes: []string{auth.ScopePublish}, scope: auth.ScopePublish, want: true},
-		"delegated scope forbidden":      {subject: "user-1", clientID: "app", subjectTemplate: "{client_id}", scopes: []string{auth.ScopePublish}, scope: auth.ScopePublish},
-		"template disabled":              {subject: "app", clientID: "app", subjectTemplate: "", scopes: []string{auth.ScopePublish}, scope: auth.ScopePublish},
-		"mismatched subject forbidden":   {subject: "other", clientID: "app", subjectTemplate: "{client_id}", scopes: []string{auth.ScopePublish}, scope: auth.ScopePublish},
-	} {
-		t.Run(name, func(t *testing.T) {
-			if got := auth.AuthorizeRoles(auth.Claims{Roles: test.roles, Scopes: test.scopes, Subject: test.subject, ClientID: test.clientID}, test.scope, roleScopes, test.subjectTemplate); got != test.want {
-				t.Fatalf("AuthorizeRoles() = %t, want %t", got, test.want)
-			}
-		})
-	}
-}

internal/auth/jwt.go

@@ -18,8 +18,7 @@ type oidcVerifier interface {
 }
 
 type discoveredVerifier struct {
-	verifier  *oidc.IDTokenVerifier
-	roleClaim string
+	verifier *oidc.IDTokenVerifier
 }
 
 const defaultKeyCacheLifetime = 15 * time.Minute
@@ -100,15 +99,11 @@ func newOIDCVerifier(ctx context.Context, options OIDCOptions) (*discoveredVerif
 	if len(algorithms) == 0 {
 		algorithms = []string{"RS256"}
 	}
-	roleClaim := options.RoleClaim
-	if roleClaim == "" {
-		roleClaim = DefaultRoleClaim
-	}
 	keySet := newExpiringKeySet(ctx, metadata.JWKSURL, options.KeyCacheLifetime)
 	return &discoveredVerifier{verifier: oidc.NewVerifier(options.Issuer, keySet, &oidc.Config{
 		ClientID:             options.Audience,
 		SupportedSigningAlgs: algorithms,
-	}), roleClaim: roleClaim}, nil
+	})}, nil
 }
 
 func (v *discoveredVerifier) Verify(ctx context.Context, value string) (Claims, error) {
@@ -136,26 +131,7 @@ func (v *discoveredVerifier) Verify(ctx context.Context, value string) (Claims,
 	if issuedAt, err := raw.IssuedAt.Int64(); err != nil || issuedAt <= 0 {
 		return Claims{}, fmt.Errorf("access token has an invalid iat claim")
 	}
-	var allClaims map[string]json.RawMessage
-	if err := token.Claims(&allClaims); err != nil {
-		return Claims{}, err
-	}
-	roles, err := stringSliceClaim(allClaims[v.roleClaim])
-	if err != nil {
-		return Claims{}, fmt.Errorf("access token has an invalid %q claim: %w", v.roleClaim, err)
-	}
-	return Claims{Scopes: append(raw.Scopes, strings.Fields(raw.Scope)...), Roles: roles, Subject: raw.Subject, ClientID: raw.ClientID}, nil
-}
-
-func stringSliceClaim(value json.RawMessage) ([]string, error) {
-	if len(value) == 0 || string(value) == "null" {
-		return nil, nil
-	}
-	var values []string
-	if err := json.Unmarshal(value, &values); err != nil {
-		return nil, err
-	}
-	return values, nil
+	return Claims{Scopes: append(raw.Scopes, strings.Fields(raw.Scope)...), Subject: raw.Subject, ClientID: raw.ClientID}, nil
 }
 
 func validateAccessTokenHeader(value string) error {