feat(dashboard): enforce OIDC verifier on the dashboard + /api router, fail-closed (JEF-487)

[thejefflarson]

Wires the JEF-485 OIDC verifier (ADR-0030) into the live dashboard router as a content-negotiating, fail-closed access gate — closing the port-forward hole where any in-cluster caller (kubectl port-forward / any pod on the pod network) reads the entire security graph unauthenticated.

What changed

• auth/enforce.rs (new) — the Enforcer + enforce axum middleware. Verification is NOT re-implemented: it routes through a shared auth::authenticate seam that require_oidc also uses. Content-negotiated denials by route class:
  • /api/*.json (path prefix — authoritative) or a JSON-preferring Accept → 401 {"error":"unauthenticated"}, never 302 (a redirected fetch dies on CSP connect-src 'self').
  • document GET / → 302 to login (from OidcConfig.issuer / PROTECTOR_DASHBOARD_OIDC_LOGIN_URL).
  • valid token below the configured minimum tier → 403.
  • JWKS-unreachable → 503 (both classes) — matches the verifier's AuthError::status; never a bypass.
  • Every denial is no-store; the gate mounts under the CSP layer so the strict CSP rides every rejection.
• Config threading (run_loop.rs) — build_dashboard_auth() builds the config + enforcer. Issuer configured → enforce; issuer absent → serve edge-trust-only with a loud startup WARN (the single §6 bypass); misconfig (issuer set, audience/alg wrong) → dashboard NOT served (fail-closed, never unauthenticated).
• Server-derived auth-mode (oidc / edge-only) on StatusStripProps for the JEF-489 pill — mirrors exactly what is enforced; the client derives nothing.
• Helm — engine.dashboard.oidc.{issuer,audience,tierClaim} → env in the deployment.

AuthError → status

JwksUnreachable → 503 (both classes); below-tier → 403 (both); every other verification failure → 401 for /api, 302→login for a document. /api-never-302 is guaranteed by the authoritative path-prefix rule in route_class and asserted by two tests (with and without a JSON Accept).

Tests

auth/enforce_tests.rs drives the real dashboard::router with a configured Enforcer over an in-memory JWKS (zero egress, via the JEF-485 test_support seam, extracted here so both suites share one fixture): no/tampered/expired token → 401; valid → 200 (+ auth-mode: oidc); GET / → 302; /api never 302'd; 403 below-tier; 503 JWKS-down; CSP + no-store on rejections; unconfigured router serves without rejecting. Full suite green (856 unit + integration), cargo fmt/clippy -D warnings clean, helm template renders with and without the oidc block, no file >1000 lines.

DECISION NEEDED (ratify)

Namespaced the dashboard-auth env vars as PROTECTOR_DASHBOARD_OIDC_* rather than the ticket's literal PROTECTOR_OIDC_*. PROTECTOR_OIDC_ISSUER is already consumed by the cosign signature-verification path (run_loop.rs::cosign_observer_parts, main.rs, cosign.rs) — the cert-identity issuer, set unconditionally by the chart to token.actions.githubusercontent.com. Sharing the name would flip every existing deploy into fail-closed dashboard auth against the wrong issuer and lock operators out on upgrade — the exact regression ADR-0030 §6 forbids. Distinct namespace resolves it cleanly.

Human follow-ups (separate ../cluster repo — not touched here)

• Cloudflare Access application in front of the tunnel + the engine→IdP NetworkPolicy (sanctioned JWKS lane).

Closes JEF-487

🤖 Generated with Claude Code

https://claude.ai/code/session_01VtjoJttCvBY4dzCoE4f9vP