Custom channel auth for Eve

Eve authorizes inbound requests with a list of authenticators on the channel. Put Authdog's issuer and audience in oidc() and pass that function as the only entry. Session routes then require a bearer JWT Eve can verify from the issuer's discovery document.

Getting started, including the runnable sample, is Eve. This is who may open a session. Outbound tool sign-in is a separate Eve concern and stays off this walk.

The authenticator

agent/channels/authdog-oidc.mjs reads the environment and returns Eve's OIDC authenticator:

import { oidc } from "eve/channels/auth";

export function authdogOidc() {
  const issuer = process.env.AUTHDOG_ISSUER;
  const audience = process.env.AUTHDOG_AUDIENCE;
  if (!issuer || !audience) {
    throw new Error("AUTHDOG_ISSUER and AUTHDOG_AUDIENCE are required");
  }
  return oidc({
    issuer,
    audiences: [audience],
  });
}

Mount it alone:

import { eveChannel } from "eve/channels/eve";
import { authdogOidc } from "./authdog-oidc.mjs";

export default eveChannel({
  auth: [authdogOidc()],
});

oidc() verifies the bearer as a JWT against the issuer discovery document: signature, issuer, expiry, and audience. An opaque token fails this check. Mint a JWT from the same issuer, and set AUTHDOG_AUDIENCE to the aud that token carries.

The Eve process holds no client secret and no PK_AUTHDOG. Identity lives on the channel. defineAgent stays the model.

What else stays off the list

Leave localDev(), none(), and another vendor's workload identity off auth. A laptop process is not an Authdog subject. The sample's test fails if the channel lists those next to authdogOidc().

Eve's health route does not use this walk. A public health check is expected. POST /eve/v1/session with no Authorization header returns 401.

Related