fix: end-to-end credential flow fixes

[markturansky]

Summary

Six commits fixing the full credential flow from control-plane provisioning through runner token auth and session event streaming.

< /dev/null | Commit | Component | Fix |
|--------|-----------|-----|
| 085028b7 | control-plane | Credential rolebinding and project delete |
| a4cf9427 | control-plane | Default BackendURL to AMBIENT_API_SERVER_URL so runner pods reach the correct API server |
| f82422a2 | control-plane | Token refresh loop: iterate all projects (was calling ForProject("") → SDK rejected empty project) |
| 49dcf935 | control-plane | Refresh runner tokens immediately on startup (eliminates expiry gap after CP restart) |
| 2faf4424 | api-server | Lowercase session ID in runner service DNS hostname (session-{ID}.svc.cluster.local must be lowercase) |
| c16abb1d | control-plane | Reduce token refresh interval 10m → 4m (OIDC TTL is 15m; 10m left too small a margin for runner reconnects) |

Root Causes Fixed

• Runner couldn't reach API server: BACKEND_API_URL defaulted to wrong value; now falls back to AMBIENT_API_SERVER_URL
• Token refresh loop silently failed: ForProject("") was rejected by SDK; fixed by listing projects first
• Token expired after CP restart: Ticker reset on restart created a gap; fixed by refreshing immediately on goroutine start
• session events always 502: API server built DNS name with raw mixed-case session ID; K8s service names are lowercased by the control-plane
• Token expiry under load: 10-minute refresh interval left too little margin before 15-minute OIDC TTL; reduced to 4 minutes

Test plan

• Runner pod fetches credentials successfully (Successfully fetched github credentials from backend)
• acpctl session events <id> streams without 502
• Sessions running >15 min do not hit UNAUTHENTICATED: Token is expired on gRPC

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Added built-in roles seeded at startup.
  • Added JWT-based username extraction fallback for bearer tokens.

• Documentation

  • Major CLI README updates: login flow, project context commands, resource examples, declarative apply, and credentials/role-binding guides.

• Bug Fixes

  • Fail-fast session watch authorization for unauthenticated callers.
  • More frequent and multi-project token refresh with immediate refresh on start.
  • Normalize runner names for streaming URLs.

• Chores

  • Expanded test initialization imports to include additional plugins.

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

📝 Walkthrough

Walkthrough

Seeds built-in roles via a new DB migration; tightens session-watch authorization and normalizes runner CR names; adds JWT-based username extraction fallback for bearer tokens; updates CLI docs and backend URL fallback; and refactors token refresh to run per-project more frequently with immediate startup refresh.

Changes

Cohort / File(s)	Summary
Roles Migration & Plugin init components/ambient-api-server/plugins/credentials/migration.go, components/ambient-api-server/plugins/credentials/plugin.go	Adds rolesMigration() that JSON-encodes permissions, generates IDs, seeds two built-in role rows, and supports rollback (deletes seeded names). Registers the migration via db.RegisterMigration(...) in plugin init.
Test imports (plugin side-effects) components/ambient-api-server/plugins/credentials/testmain_test.go	Adds multiple blank imports to include additional plugins (agents, inbox, projectSettings, projects, rbac, roleBindings, roles, sessions, users, plus rh-trex-ai events/generic) so their init side-effects run during tests.
Session auth & runner URL normalization components/ambient-api-server/plugins/sessions/grpc_handler.go, components/ambient-api-server/plugins/sessions/handler.go	WatchSessionMessages now returns PermissionDenied when extracted username is empty; StreamRunnerEvents lowercases KubeCrName when building the runner host portion.
Bearer-token gRPC middleware (JWT fallback) components/ambient-api-server/pkg/middleware/bearer_token_grpc.go	Unary and stream interceptors now attempt usernameFromJWT(token) when bearer token ≠ expected token; a non-empty username is set into context. Implements unverified JWT parsing to prefer preferred_username, username, or sub (ignoring values containing :).
Control plane config fallback & CLI docs components/ambient-control-plane/internal/config/config.go, components/ambient-cli/README.md	BackendURL fallback now uses AMBIENT_API_SERVER_URL before defaulting to http://localhost:8000. README extensively updated: simplified login, acpctl apply declarative workflow, session/agent/credential/role-binding examples, and new CLI flags/options.
Token refresh loop & per-project traversal components/ambient-control-plane/internal/reconciler/kube_reconciler.go	Refresh interval reduced from 10m to 4m and performs an immediate refresh at start. Rewrote refresh logic to iterate projects, create per-project SDK clients, paginate project/session lists, and handle per-project failures without aborting the whole run.

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error, 2 warnings)

Check name	Status	Explanation	Resolution
Security And Secret Handling	❌ Error	Critical authentication bypass vulnerability: bearer_token_grpc.go accepts unverified JWTs, enabling identity spoofing and session authorization bypass.	Remove JWT fallback or implement proper verification with JWKS, signature, expiration, and issuer validation. Enforce consistent auth patterns across gRPC and HTTP middleware.
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Kubernetes Resource Safety	⚠️ Warning	Child Kubernetes resources lack ownerReferences, preventing automatic garbage collection and relying on less reliable label-selector cleanup.	Add ownerReferences to Secrets, Pods, ServiceAccounts, Services in kube_reconciler.go pointing to Session with blockOwnerDeletion: true.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	Title follows Conventional Commits format (fix: scope) and directly aligns with PR objectives addressing credential flow fixes.
Performance And Algorithmic Complexity	✅ Passed	Token refresh loop uses proper pagination for remote API calls and performs per-session operations against local Kubernetes cluster with bounded execution time.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/credential-flow-fixes

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch fix/credential-flow-fixes

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[markturansky]

hello world