Add Delegated User Access and Private Connectivity

This course is built around the public Zheta Kubernetes Lab monorepo. The excerpt below is runnable source, not pseudocode.

Source: services/shared/auth.py

if claims.get("iss") != issuer or claims.get("aud") != audience or int(claims.get("exp", 0)) <= int(time.time()):
        raise PermissionError("expired or wrong-scope bearer token")
    if not claims.get("sub") or not claims.get("org"):
        raise PermissionError("bearer token lacks tenant identity")
    return Identity(str(claims["sub"]), str(claims["org"]))

Code to reality

Declared intent

Derive actor and tenant authority only from a signed, scoped, unexpired identity token.

Interpreter

The shared authentication adapter verifies cryptographic and semantic claims before MVC dispatch.

Software effect

Accepted requests carry an immutable actor and organization identity; invalid requests stop at the boundary.

Hardware effect

Signature verification consumes service CPU but denied calls allocate no downstream runtime or data resources.

Observable evidence

Positive tenant access and wrong-signature, wrong-audience, and cross-tenant denials identify the boundary.

The source tables below remain the detailed contract. Begin with these customer paths:

• D09-UC-01
  • Person: Enterprise end user
  • Job: Ask an app to read one source item on the user's behalf
  • Observable result: Broker uses workload identity plus user delegation and source allows their intersected scope
• D09-UC-02
  • Person: Network administrator
  • Job: Expose a source privately without making it public
  • Observable result: Broker resolves private DNS and connects over the approved private route

Now turn each customer job into a story with a result that an engineer can check:

• D09-US-01
  • Story: As an enterprise end user, I want explicit delegated consent, so that the app cannot reuse my authority after revocation
  • Observable acceptance: Consent, subject, scopes, expiry, revocation, and source decision are recorded without storing a reusable token in app data
• D09-US-02
  • Story: As a network administrator, I want source traffic constrained to a private path, so that public reachability is unnecessary
  • Observable acceptance: Private DNS/route succeeds; public probe fails; wrong-scope private request still receives authorization denial

Finally trace each story through the system that owns its state and the evidence that proves the outcome:

• D09-FLOW-01
  • Trigger: User approves delegated read of one source collection
  • Responsible systems: Enterprise identity provider, Connector Broker, source authorization
  • Authoritative state: Delegated Grant store plus source authorization records
  • Owned record: DelegatedConnectorGrant
  • Observable evidence: Actor, subject, workload, both grant IDs, effective scope, private endpoint, source request, environment, timestamp, trace ID
  • Failure signal: Invalid consent, revoked token, empty scope intersection, or source denial
• D09-FLOW-02
  • Trigger: Revoked user asks for a workload-allowed resource
  • Responsible systems: Private DNS, routing/firewall, Connector Broker, source endpoint
  • Authoritative state: Network configuration and flow evidence
  • Owned record: PrivateConnectionEvidence
  • Observable evidence: Revocation, denial rule, zero delegated source call, private-path proof, allowed machine control, immutable evidence ID
  • Failure signal: Public resolution, route/firewall failure, unexpected public flow, or authorization bypass

Enterprise problem: A private connection is often treated as authorization, while delegated tokens are treated as replacements for workload grants, allowing reachable workloads to exceed either machine or human scope.

Whole-course context: Provider state can record an intended machine connector name but no broker enforces source authority yet; today designs the separate delegated grant and private route without pretending either exists.

Today’s slice: Design the required intersection of workload and delegated-user scopes, then inspect the authenticated provider identity seam that exists today; delegated grants and private source connectivity are not implemented in the monorepo.

End-of-day evidence: Provider-token success plus missing, tampered, expired, and wrong-audience denials are reproducible; delegated consent, scope intersection, private DNS/route, and source decision remain named acceptance evidence for later implementation.

Still unsolved: Generated-app human identity, collaboration roles, publication, and AWS account implementation remain deferred.

Some source actions need a named human while scheduled refreshes need machine authority. These use cases keep both grants independent and make the private path observable.

Reachability and authority answer different questions. These stories require separate network and policy evidence.

The user chooses Connect as me for one source operation. Connector Broker computes the intersection of the machine and human grants before it uses the private route.

A private endpoint controls the network path but cannot decide whether a user may read a record. Connector Broker combines plane-local grants; the source system remains the final authority.

Delegated credentials in app tables would survive user revocation and cross a plane boundary. Connector Broker owns encrypted grant material and exposes only opaque status to the app.

Generated-application database: Not created in this runnable slice — no delegated credential or connection status is persisted; both the generated-app store and connector grant store remain explicit production work.

Testing only an authorized request cannot expose accidental union of scopes. The current monorepo verifies a provider bearer token's signature, issuer, audience, expiry, actor, and organization; it has no delegated grant, OAuth exchange, private DNS, firewall, or enterprise source adapter. Read the exact boundary in services/shared/auth.py.

if claims.get("iss") != issuer or claims.get("aud") != audience or int(claims.get("exp", 0)) <= int(time.time()):
    raise PermissionError("expired or wrong-scope bearer token")
if not claims.get("sub") or not claims.get("org"):
    raise PermissionError("bearer token lacks tenant identity")
return Identity(str(claims["sub"]), str(claims["org"]))

Use workload authority for unattended app operations and delegated authority only when the source action must carry a human subject. Private connectivity reduces exposure; it never expands permission, and revoking either grant must independently stop the combined path.