Skip to content

CRITICAL: Implement Token Minting for local-dev-user Service Account #322

Description

@bobbravo2

Overview

Priority: 🔴 CRITICAL
Effort: 2-3 hours
Related PR: #246
Mentioned in: All 6 automated code reviews

Implement proper token minting for local-dev-user service account in local development mode.


Problem

Current implementation uses backend SA (cluster-admin) instead of minting scoped token.

Security Impact:

  • Cannot test RBAC locally
  • Dev mode uses unrestricted permissions
  • Violates CLAUDE.md standards

Solution

Implement TokenRequest API to mint tokens for local-dev-user with namespace-scoped permissions.

Location: components/backend/handlers/middleware.go:340-345


Acceptance Criteria

  • Token minting using TokenRequest API
  • Error handling for missing SA
  • Tests 26, 28, 21.1, 21.2 pass
  • Local dev workflow functions correctly
  • RBAC boundaries testable

References


Timeline: Complete within 1 week of PR #246 merge

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions