[TaylorMutch]

Summary

Authenticate and authorize gateway-mediated application HTTP requests and WebSocket upgrades using configured gateway authentication, regardless of whether the separate app listener is enabled.

Based on main at af6604a61. Stacked on feat/4953-authoritative-app-urls/TaylorMutch.

Related Issue

Closes #4722. Part of RFC 0017.

Changes

• Resolve browser login origins through the gateway route index for both readable and hashed service hosts, preserving workspace authorization and the control-plane login boundary.
• Apply gateway identity, workspace access, and forwarding role/scope authorization before upstream connection.
• Add browser login with single-use bootstrap codes and bounded Secure/HttpOnly/SameSite=Strict host-only sessions.
• Use configured credential storage for sessions and shared revocation across gateway replicas.
• Separate gateway credentials from application bearer tokens/cookies, strip reserved credentials, and enforce origin/Fetch Metadata protections.

Release Notes

Breaking behavior: authenticated gateways require authentication for application requests with the app listener enabled or disabled. Direct app-listener authentication remains the ingress provider/application responsibility.

Testing

• Hostname integration: 111 standalone application-URL-layer tests and 120 combined-stack routing/schema regressions passed, including shared shutdown fencing and ingress URL stability. Go SDK CI, strict Clippy for affected crates, protobuf/docs/Mermaid lint, and lockfile checks passed.
• 40 focused combined-stack Rust regression tests cover listener routing, route-limit concurrency, shutdown fencing, advertisements, discovery, and proxy behavior.
• Local k3d validated the Service removal with dedicated push/poll, abrupt shared-owner takeover, HTTP/WebSockets, network-policy denial, freshness/withdrawal, outage recovery, and disabled-listener gateway access. Workload identity and memory survived owner changes.
• Real Go SDK snapshots/watches and workspace-restricted discovery credentials drove two proxy replicas; both followed Pod-IP endpoints, graceful owner handover, and route withdrawal without per-sandbox app Services.
• Helm lint/unit/parser/coherence/scaling checks, Python lint/format/type checks, and topology assertions passed.

Live Kubernetes validation preceded integration of the latest listener hardening;
focused Rust regressions validate that final integration. New-head CI is pending.

Qualification limits

Live HA validation exercised supervisor process/Pod loss on a local k3d cluster. Whole-node failure, real network partitions, metric-driven HPA, sustained production load, and published release artifacts remain unqualified. Grant-file projection contributes to revocation propagation time. Both ingress paths now share the gateway hostname format and label generator. The same installation identity and public HTTPS domain/port preserve service URLs when switching ingress. Installation-status presentation (#4670) remains separate work. Live Kubernetes runs above preceded hostname integration; the naming and shutdown-fence integration is validated by focused Rust regressions.

The example Kubernetes HTTPRoute controller is a deferred compatibility POC outside this stack.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Relevant implementation, configuration, and API documentation updated

PR dependency order: #4936 → #4940 → #4941 → #4956 → #4963 → #4964 → #4957 → #4958.

Replaces #4959, which GitHub automatically marked merged into its former SDK base when the rebased branches were published. This draft isolates the auth change against the URL layer; main was unchanged by that event.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-4963.docs.buildwithfern.com/openshell