From 909762bbf7133527a3f71952fad20328d73066f6 Mon Sep 17 00:00:00 2001 From: akshayakumar-t Date: Sat, 1 Aug 2026 08:50:31 +0530 Subject: [PATCH 01/10] feat[OBE-11604] - Add JwtBearer auth strategy to sauth Wire jwt-bearer feature in sauth (smpl_jwt + reqwest with rustls-tls), update submodule pointer, and switch scol's sauth dependency from the old gcp feature to jwt-bearer. Co-Authored-By: Akshaya's Agent --- Cargo.lock | 3 +++ lib/observo/private | 2 +- lib/observo/sauth/Cargo.toml | 6 +++++- lib/observo/scol/Cargo.toml | 2 +- 4 files changed, 10 insertions(+), 3 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 0dc4e0c53..00a2619c8 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -9953,6 +9953,7 @@ dependencies = [ name = "sauth" version = "0.1.0" dependencies = [ + "base64 0.22.1", "headers 0.3.9", "http 0.2.9", "http 1.1.0", @@ -9967,12 +9968,14 @@ dependencies = [ "rand 0.8.6", "rcgen", "regex", + "reqwest 0.11.26", "rstest", "sauth", "serde", "serde_json", "serde_urlencoded", "serde_with", + "smpl_jwt", "tempfile", "thiserror 2.0.17", "tokio", diff --git a/lib/observo/private b/lib/observo/private index b90e4cf6d..60dad1f8f 160000 --- a/lib/observo/private +++ b/lib/observo/private @@ -1 +1 @@ -Subproject commit b90e4cf6d3e783b68b1e1929492975f9cfaea24a +Subproject commit 60dad1f8f4fcc86200000d9d736183656c4124c5 diff --git a/lib/observo/sauth/Cargo.toml b/lib/observo/sauth/Cargo.toml index f30a6caaa..43fd2c3c9 100644 --- a/lib/observo/sauth/Cargo.toml +++ b/lib/observo/sauth/Cargo.toml @@ -38,12 +38,16 @@ rand.workspace = true url = { workspace = true, optional = true } # this is a hack to enable tracing in hyper-util (debugging can be difficult without this) hyper-util = { version = "0.1.10", optional = true, features = ["full"] } +smpl_jwt = { version = "0.8.0", default-features = false, optional = true } +reqwest = { version = "0.11", optional = true, default-features = false, features = ["json", "rustls-tls"] } +base64 = { version = "0.22", optional = true } [features] default = [] +jwt-bearer = ["dep:smpl_jwt", "dep:reqwest"] test-support = ["dep:thiserror", "dep:poem", "dep:poem-derive", "dep:oxide-auth", "dep:oxide-auth-poem", "dep:tempfile", "dep:rcgen", "dep:serde_urlencoded", "dep:url", - "dep:hyper-util"] + "dep:hyper-util", "dep:base64"] [dev-dependencies] sauth = {features = ["test-support"], path = "."} diff --git a/lib/observo/scol/Cargo.toml b/lib/observo/scol/Cargo.toml index 87da6586a..31e300b5d 100644 --- a/lib/observo/scol/Cargo.toml +++ b/lib/observo/scol/Cargo.toml @@ -27,7 +27,7 @@ vector-config = { path = "../../vector-config", default-features = false } vector-config-macros = { path = "../../vector-config-macros", default-features = false } vector-core = { path = "../../vector-core", default-features = false } vector-lib = { path = "../../vector-lib", default-features = false, features = ["lua", "observo"] } -sauth = { path = "../sauth" } +sauth = { path = "../sauth", features = ["jwt-bearer"] } base64 = "0.13.1" async-channel = { version = "2.3.1" } serde_with.workspace = true From 44bc7a04e2e3f544ad49934919e2fdae968ee3e9 Mon Sep 17 00:00:00 2001 From: akshayakumar-t Date: Sat, 1 Aug 2026 09:32:28 +0530 Subject: [PATCH 02/10] test[OBE-11604] - Bump private submodule for refresh + data E2E tests Co-Authored-By: Akshaya's Agent --- lib/observo/private | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/observo/private b/lib/observo/private index 60dad1f8f..aa309430c 160000 --- a/lib/observo/private +++ b/lib/observo/private @@ -1 +1 @@ -Subproject commit 60dad1f8f4fcc86200000d9d736183656c4124c5 +Subproject commit aa309430cdb521c533a5e59fde9211975e05f0d7 From 4e42cc1cbb1f8bea98c4b5ee348e1533eacbd56e Mon Sep 17 00:00:00 2001 From: akshayakumar-t Date: Sat, 1 Aug 2026 09:44:08 +0530 Subject: [PATCH 03/10] fix[OBE-11604] - Bump private submodule for security fixes Co-Authored-By: Akshaya's Agent --- lib/observo/private | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/observo/private b/lib/observo/private index aa309430c..db8598573 160000 --- a/lib/observo/private +++ b/lib/observo/private @@ -1 +1 @@ -Subproject commit aa309430cdb521c533a5e59fde9211975e05f0d7 +Subproject commit db8598573ab4d50dfbe2c02c56c8370d9b4e2735 From 4d3534c3fb4949cf77d7a2d427f8dc561d34574a Mon Sep 17 00:00:00 2001 From: akshayakumar-t Date: Sat, 1 Aug 2026 09:55:26 +0530 Subject: [PATCH 04/10] fix[OBE-11604] - Bump private submodule for Fable review fixes Co-Authored-By: Akshaya's Agent --- lib/observo/private | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/observo/private b/lib/observo/private index db8598573..768a95413 160000 --- a/lib/observo/private +++ b/lib/observo/private @@ -1 +1 @@ -Subproject commit db8598573ab4d50dfbe2c02c56c8370d9b4e2735 +Subproject commit 768a9541343b9361a5b5eb6386fe7fc105dc1731 From 815845a743302f35356e2170909f96b7ae7f4149 Mon Sep 17 00:00:00 2001 From: akshayakumar-t Date: Sat, 1 Aug 2026 12:36:41 +0530 Subject: [PATCH 05/10] feat(sauth): replace smpl_jwt with jsonwebtoken for JWT-bearer auth Swap smpl_jwt (OpenSSL, padded base64url) for jsonwebtoken (ring, RFC 7515 compliant) in the jwt-bearer feature. Remove base64 dev-only dep that was only needed by the now-deleted decode_jwt_iss helper. Co-Authored-By: Akshaya's Agent --- Cargo.lock | 3 +-- lib/observo/private | 2 +- lib/observo/sauth/Cargo.toml | 7 +++---- 3 files changed, 5 insertions(+), 7 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 00a2619c8..27b573f0a 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -9953,13 +9953,13 @@ dependencies = [ name = "sauth" version = "0.1.0" dependencies = [ - "base64 0.22.1", "headers 0.3.9", "http 0.2.9", "http 1.1.0", "hyper 0.14.28", "hyper-util", "itertools 0.14.0", + "jsonwebtoken", "oauth2 5.0.0", "oxide-auth", "oxide-auth-poem", @@ -9975,7 +9975,6 @@ dependencies = [ "serde_json", "serde_urlencoded", "serde_with", - "smpl_jwt", "tempfile", "thiserror 2.0.17", "tokio", diff --git a/lib/observo/private b/lib/observo/private index 768a95413..11990de24 160000 --- a/lib/observo/private +++ b/lib/observo/private @@ -1 +1 @@ -Subproject commit 768a9541343b9361a5b5eb6386fe7fc105dc1731 +Subproject commit 11990de2439d565f7e1df44f9bafcb8713745380 diff --git a/lib/observo/sauth/Cargo.toml b/lib/observo/sauth/Cargo.toml index 43fd2c3c9..5301c0c2f 100644 --- a/lib/observo/sauth/Cargo.toml +++ b/lib/observo/sauth/Cargo.toml @@ -38,16 +38,15 @@ rand.workspace = true url = { workspace = true, optional = true } # this is a hack to enable tracing in hyper-util (debugging can be difficult without this) hyper-util = { version = "0.1.10", optional = true, features = ["full"] } -smpl_jwt = { version = "0.8.0", default-features = false, optional = true } +jsonwebtoken = { workspace = true, optional = true } reqwest = { version = "0.11", optional = true, default-features = false, features = ["json", "rustls-tls"] } -base64 = { version = "0.22", optional = true } [features] default = [] -jwt-bearer = ["dep:smpl_jwt", "dep:reqwest"] +jwt-bearer = ["dep:jsonwebtoken", "dep:reqwest"] test-support = ["dep:thiserror", "dep:poem", "dep:poem-derive", "dep:oxide-auth", "dep:oxide-auth-poem", "dep:tempfile", "dep:rcgen", "dep:serde_urlencoded", "dep:url", - "dep:hyper-util", "dep:base64"] + "dep:hyper-util", "dep:jsonwebtoken"] [dev-dependencies] sauth = {features = ["test-support"], path = "."} From 115dee4520ad2b1e9706267e5d030dc9814e3007 Mon Sep 17 00:00:00 2001 From: akshayakumar-t Date: Sat, 1 Aug 2026 12:48:14 +0530 Subject: [PATCH 06/10] fix(sauth): enforce HTTPS for jwt_bearer token_url Co-Authored-By: Akshaya's Agent --- lib/observo/private | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/observo/private b/lib/observo/private index 11990de24..59a23cb9f 160000 --- a/lib/observo/private +++ b/lib/observo/private @@ -1 +1 @@ -Subproject commit 11990de2439d565f7e1df44f9bafcb8713745380 +Subproject commit 59a23cb9f184f447b034694b858566e54a9ba7ac From 494c0513752eb2bced1f1c87c92f98664559bf90 Mon Sep 17 00:00:00 2001 From: akshayakumar-t Date: Sat, 1 Aug 2026 12:52:08 +0530 Subject: [PATCH 07/10] chore(sauth): remove jwt-bearer feature flag Make jsonwebtoken and reqwest unconditional dependencies in sauth. Remove the jwt-bearer feature from sauth/Cargo.toml and drop the features = ["jwt-bearer"] reference from scol's dependency. Co-Authored-By: Akshaya's Agent --- lib/observo/private | 2 +- lib/observo/sauth/Cargo.toml | 7 +++---- lib/observo/scol/Cargo.toml | 2 +- 3 files changed, 5 insertions(+), 6 deletions(-) diff --git a/lib/observo/private b/lib/observo/private index 59a23cb9f..ec729fad7 160000 --- a/lib/observo/private +++ b/lib/observo/private @@ -1 +1 @@ -Subproject commit 59a23cb9f184f447b034694b858566e54a9ba7ac +Subproject commit ec729fad7a48be21f4f8bdd59807034d7e96db9e diff --git a/lib/observo/sauth/Cargo.toml b/lib/observo/sauth/Cargo.toml index 5301c0c2f..1f37eb49d 100644 --- a/lib/observo/sauth/Cargo.toml +++ b/lib/observo/sauth/Cargo.toml @@ -38,15 +38,14 @@ rand.workspace = true url = { workspace = true, optional = true } # this is a hack to enable tracing in hyper-util (debugging can be difficult without this) hyper-util = { version = "0.1.10", optional = true, features = ["full"] } -jsonwebtoken = { workspace = true, optional = true } -reqwest = { version = "0.11", optional = true, default-features = false, features = ["json", "rustls-tls"] } +jsonwebtoken.workspace = true +reqwest = { version = "0.11", default-features = false, features = ["json", "rustls-tls"] } [features] default = [] -jwt-bearer = ["dep:jsonwebtoken", "dep:reqwest"] test-support = ["dep:thiserror", "dep:poem", "dep:poem-derive", "dep:oxide-auth", "dep:oxide-auth-poem", "dep:tempfile", "dep:rcgen", "dep:serde_urlencoded", "dep:url", - "dep:hyper-util", "dep:jsonwebtoken"] + "dep:hyper-util"] [dev-dependencies] sauth = {features = ["test-support"], path = "."} diff --git a/lib/observo/scol/Cargo.toml b/lib/observo/scol/Cargo.toml index 31e300b5d..87da6586a 100644 --- a/lib/observo/scol/Cargo.toml +++ b/lib/observo/scol/Cargo.toml @@ -27,7 +27,7 @@ vector-config = { path = "../../vector-config", default-features = false } vector-config-macros = { path = "../../vector-config-macros", default-features = false } vector-core = { path = "../../vector-core", default-features = false } vector-lib = { path = "../../vector-lib", default-features = false, features = ["lua", "observo"] } -sauth = { path = "../sauth", features = ["jwt-bearer"] } +sauth = { path = "../sauth" } base64 = "0.13.1" async-channel = { version = "2.3.1" } serde_with.workspace = true From c8f984163369a22ee3537dafe449e6fc87014789 Mon Sep 17 00:00:00 2001 From: akshayakumar-t Date: Sat, 1 Aug 2026 12:57:18 +0530 Subject: [PATCH 08/10] fix(sauth): eliminate private_interfaces warning for JwtCredentials Co-Authored-By: Akshaya's Agent --- lib/observo/private | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/observo/private b/lib/observo/private index ec729fad7..8c7f3ccbc 160000 --- a/lib/observo/private +++ b/lib/observo/private @@ -1 +1 @@ -Subproject commit ec729fad7a48be21f4f8bdd59807034d7e96db9e +Subproject commit 8c7f3ccbccfec943e0bc09ce7df4404667a2c813 From ecead0cecbe9d641f147dc0a4177d85136a2ad46 Mon Sep 17 00:00:00 2001 From: akshayakumar-t Date: Sat, 1 Aug 2026 13:07:09 +0530 Subject: [PATCH 09/10] fix(sauth): use URL parsing to prevent loopback-host bypass; add jwt_bearer docs Promote url crate from optional to unconditional dep in sauth so build() can parse token_url and compare Host enum variants exactly. Co-Authored-By: Akshaya's Agent --- lib/observo/private | 2 +- lib/observo/sauth/Cargo.toml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/lib/observo/private b/lib/observo/private index 8c7f3ccbc..cdfb7ee29 160000 --- a/lib/observo/private +++ b/lib/observo/private @@ -1 +1 @@ -Subproject commit 8c7f3ccbccfec943e0bc09ce7df4404667a2c813 +Subproject commit cdfb7ee298bbdf6f6d08c7a7f5ba248a26041b2a diff --git a/lib/observo/sauth/Cargo.toml b/lib/observo/sauth/Cargo.toml index 1f37eb49d..6f3be9f8d 100644 --- a/lib/observo/sauth/Cargo.toml +++ b/lib/observo/sauth/Cargo.toml @@ -35,7 +35,7 @@ serde_json.workspace = true toml.workspace = true hyper.workspace = true rand.workspace = true -url = { workspace = true, optional = true } +url.workspace = true # this is a hack to enable tracing in hyper-util (debugging can be difficult without this) hyper-util = { version = "0.1.10", optional = true, features = ["full"] } jsonwebtoken.workspace = true @@ -44,7 +44,7 @@ reqwest = { version = "0.11", default-features = false, features = ["json", "rus [features] default = [] test-support = ["dep:thiserror", "dep:poem", "dep:poem-derive", "dep:oxide-auth", - "dep:oxide-auth-poem", "dep:tempfile", "dep:rcgen", "dep:serde_urlencoded", "dep:url", + "dep:oxide-auth-poem", "dep:tempfile", "dep:rcgen", "dep:serde_urlencoded", "dep:hyper-util"] [dev-dependencies] From 520a816b707c596d5619ed99d3acdb253038cf0f Mon Sep 17 00:00:00 2001 From: akshayakumar-t Date: Sat, 1 Aug 2026 13:16:20 +0530 Subject: [PATCH 10/10] fix(sauth): tighten loopback comment and tests to match actual behavior Co-Authored-By: Akshaya's Agent --- lib/observo/private | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/observo/private b/lib/observo/private index cdfb7ee29..8ad51beab 160000 --- a/lib/observo/private +++ b/lib/observo/private @@ -1 +1 @@ -Subproject commit cdfb7ee298bbdf6f6d08c7a7f5ba248a26041b2a +Subproject commit 8ad51beaba38f07d3c20000bba6d6bf8fe304eb1