Use JWT for Aquila Authentication

Cargo.toml

@@ -32,6 +32,7 @@ lru = "0.18.2"
 syn = { version = "3", features = ["full", "extra-traits"] }
 quote = "1"
 proc-macro2 = "1"
+jsonwebtoken = { version = "11.0.0", features = ["rust_crypto"] }
 
 [workspace.dependencies.taurus-core]
 path = "./crates/taurus-core"

crates/taurus/Cargo.toml

@@ -20,7 +20,8 @@ taurus-core = { workspace = true }
 taurus-provider = { workspace = true }
 uuid = { workspace = true }
 env_logger = { workspace = true }
+jsonwebtoken = { workspace = true }
+serde = { workspace = true }
 
 [dev-dependencies]
-serde = { workspace = true }
 serde_json = { workspace = true }

crates/taurus/src/app/definitions.rs

@@ -14,6 +14,7 @@ use tonic::{Extensions, Request};
 use tucana::aquila::{ModuleUpdateRequest, module_service_client::ModuleServiceClient};
 use tucana::shared::Module;
 
+use crate::auth::aquila_jwt;
 use crate::config::Config;
 use crate::telemetry::errors;
 
@@ -71,7 +72,9 @@ pub async fn push_definitions_until_success(config: &Config) {
     let mut retry_count = 1;
     loop {
         let request = Request::from_parts(
-            code0_flow::flow_service::auth::get_authorization_metadata(&config.aquila_token),
+            code0_flow::flow_service::auth::get_authorization_metadata(&aquila_jwt(
+                &config.aquila_token,
+            )),
             Extensions::new(),
             ModuleUpdateRequest {
                 modules: modules.clone(),

crates/taurus/src/auth.rs

@@ -0,0 +1,91 @@
+//! Mints the short-lived JWT Taurus presents to Aquila's gRPC services.
+//!
+//! Aquila's service configuration pre-provisions a secret per identity
+//! (still called `token` on both sides for historical reasons); Taurus signs
+//! an HS256 JWT with that secret instead of sending it as a plain bearer
+//! credential, so Aquila can verify the request without the secret itself
+//! ever crossing the wire.
+
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use jsonwebtoken::{Algorithm, EncodingKey, Header, encode};
+use serde::Serialize;
+
+/// The identity every `taurus-*` instance authenticates as - matches the
+/// `taurus` family identifier Aquila's service configuration registers a
+/// runtime secret under (see `ServiceConfiguration::extract_service_name`).
+const SUBJECT: &str = "taurus";
+
+/// How long a minted JWT stays valid. Short-lived since a fresh one is
+/// minted for every outgoing request rather than reused across a
+/// long-lived connection.
+const TTL_SECONDS: u64 = 60;
+
+#[derive(Serialize)]
+struct Claims {
+    sub: String,
+    exp: u64,
+}
+
+/// Encodes a fresh JWT authenticating Taurus to Aquila, signed with
+/// `aquila_token` (the shared secret from `Config::aquila_token`).
+pub fn aquila_jwt(aquila_token: &str) -> String {
+    let claims = Claims {
+        sub: SUBJECT.to_string(),
+        exp: now_unix_seconds().saturating_add(TTL_SECONDS),
+    };
+
+    encode(
+        &Header::new(Algorithm::HS256),
+        &claims,
+        &EncodingKey::from_secret(aquila_token.as_bytes()),
+    )
+    .unwrap_or_else(|error| panic!("failed to encode Aquila authentication JWT: {error}"))
+}
+
+fn now_unix_seconds() -> u64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map(|duration| duration.as_secs())
+        .unwrap_or(0)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use jsonwebtoken::{DecodingKey, Validation, decode};
+
+    #[derive(serde::Deserialize)]
+    struct DecodedClaims {
+        sub: String,
+        exp: u64,
+    }
+
+    #[test]
+    fn aquila_jwt_is_signed_with_the_given_secret_and_carries_the_taurus_subject() {
+        let token = aquila_jwt("shared-secret");
+
+        let data = decode::<DecodedClaims>(
+            &token,
+            &DecodingKey::from_secret(b"shared-secret"),
+            &Validation::new(Algorithm::HS256),
+        )
+        .unwrap();
+
+        assert_eq!(data.claims.sub, "taurus");
+        assert!(data.claims.exp > now_unix_seconds());
+    }
+
+    #[test]
+    fn aquila_jwt_does_not_verify_against_a_different_secret() {
+        let token = aquila_jwt("shared-secret");
+
+        let result = decode::<DecodedClaims>(
+            &token,
+            &DecodingKey::from_secret(b"wrong-secret"),
+            &Validation::new(Algorithm::HS256),
+        );
+
+        assert!(result.is_err());
+    }
+}

crates/taurus/src/client/runtime_execution.rs

@@ -15,6 +15,7 @@ use tucana::{
     shared::{ExecutionResult, execution_result},
 };
 
+use crate::auth::aquila_jwt;
 use crate::telemetry::errors;
 
 // tonic clients over `Channel` are cheap to clone (the channel itself is a
@@ -55,7 +56,7 @@ impl TaurusRuntimeExecutionService {
         normalize_execution_result(&mut runtime_execution);
 
         let request = Request::from_parts(
-            get_authorization_metadata(&self.aquila_token),
+            get_authorization_metadata(&aquila_jwt(&self.aquila_token)),
             Extensions::new(),
             ExecutionRequest {
                 execution_result: Some(runtime_execution),

crates/taurus/src/client/runtime_status.rs

@@ -15,6 +15,7 @@ use tucana::{
     shared::{ModuleStatus, module_status::StatusVariant},
 };
 
+use crate::auth::aquila_jwt;
 use crate::telemetry::errors;
 
 pub struct TaurusRuntimeStatusService {
@@ -51,7 +52,7 @@ impl TaurusRuntimeStatusService {
 
         for request in build_runtime_status_requests(&self.identifiers, status, timestamp) {
             let request = Request::from_parts(
-                get_authorization_metadata(&self.aquila_token),
+                get_authorization_metadata(&aquila_jwt(&self.aquila_token)),
                 Extensions::new(),
                 request,
             );

crates/taurus/src/main.rs

@@ -7,6 +7,7 @@
 //! for the environment-driven `Config` every other module reads from.
 
 mod app;
+mod auth;
 mod client;
 mod config;
 mod telemetry;