chris/OSVauco
1
0
Fork 0
Code Issues 1 Pull Requests Actions 2 Packages Projects Releases Wiki Activity

docs: fix AUTH-LØSNING section — correct Cloud Run URL and token method

Browse Source
This commit is contained in:
chrischristiansen-glitch 2026-06-10 19:52:31 +02:00
parent 7b857059b3
commit d34ab15f92
1 changed files with 40 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

46
docs/ROADMAP.md
View File

@ -100,27 +100,61 @@
- [x] **Emma Vauger** — Registrert som agent `emma.vauger@vauco.no` · 2026-06-10 - [x] **Emma Vauger** — Registrert som agent `emma.vauger@vauco.no` · 2026-06-10
- [x] **CI5** — OPAX-MCP build + deploy SUCCESS · 2026-06-10 ✅ - [x] **CI5** — OPAX-MCP build + deploy SUCCESS · 2026-06-10 ✅
- [x] **CI6** — Jason kaller OPAX-MCP live, returnerer faktisk build-ID · 2026-06-10 ✅ - [x] **CI6** — Jason kaller OPAX-MCP live, returnerer faktisk build-ID · 2026-06-10 ✅
- [x] **CI/CD smoke-test pipeline** — BASE_URL hardkodet, IAM run.invoker fikset, --audiences bug løst · 2026-06-10 ✅
--- ---
## AUTH-LØSNING (autoritativ) — Cloud Run / IAP fra VM ## AUTH-LØSNING (autoritativ) — Cloud Run / IAP
> Bruk alltid denne metoden for curl-kall mot `osvauco-agent` fra dev-VM: > Oppdatert 2026-06-10 etter smoke-test debugging. Tidligere versjon var feil.
### Kanoniske URL-er
```
Kanonisk URL: https://osvauco-agent-357036551735.us-central1.run.app ← bruk ALLTID denne
IAP/public URL: https://opax.vauco.no
Cloud Build SA: 357036551735@cloudbuild.gserviceaccount.com
```
> ⚠️ `zjbqp3prqq`-URL er den interne Cloud Run URL — den fungerer IKKE som `--audiences` target for identity tokens. Bruk alltid `357036551735`-URL (kanonisk) eller `opax.vauco.no` (public).
### Fra dev-VM (metadata token)
```bash ```bash
# Hent token via GCE metadata (riktig audience = kanonisk URL):
TOKEN=$(curl -s -H "Metadata-Flavor: Google" \ TOKEN=$(curl -s -H "Metadata-Flavor: Google" \
"http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?audience=https://osvauco-agent-zjbqp3prqq-uc.a.run.app&format=full") "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?audience=https://osvauco-agent-357036551735.us-central1.run.app&format=full")
curl -s \ curl -s \
-H "Authorization: Bearer $TOKEN" \ -H "Authorization: Bearer $TOKEN" \
-H "x-goog-authenticated-user-email: accounts.google.com:chris.christiansen@vauco.no" \ -H "x-goog-authenticated-user-email: accounts.google.com:chris.christiansen@vauco.no" \
-H "Content-Type: application/json" \ -H "Content-Type: application/json" \
-d '{"user_id": "chris", "session_id": "<session-id>", "message": "<melding>"}' \ -d '{"user_id": "chris", "session_id": "<session-id>", "message": "<melding>"}' \
https://osvauco-agent-zjbqp3prqq-uc.a.run.app/run https://osvauco-agent-357036551735.us-central1.run.app/run
``` ```
**Viktig:** Bruk `zjbqp3prqq`-URL (ikke `357036551735`-URL) som audience og endepunkt. ### Fra Cloud Build smoke-test
**Aldri** bruk `gcloud auth print-identity-token` uten `--audiences` — gir feil audience.
```bash
# ALDRI --audiences flagg — returnerer tomt token:
# TOKEN=$(gcloud auth print-identity-token --audiences="$URL") ← FEIL
# RIKTIG:
BASE_URL="https://osvauco-agent-357036551735.us-central1.run.app"
TOKEN=$(gcloud auth print-identity-token)
curl -s -o /dev/null -w "%{http_code}" \
-H "Authorization: Bearer $TOKEN" \
"$BASE_URL/health"
```
### Fra gcloud CLI (lokal maskin)
```bash
TOKEN=$(gcloud auth print-identity-token)
curl -H "Authorization: Bearer $TOKEN" \
https://osvauco-agent-357036551735.us-central1.run.app/health
```
--- ---