feat(gateway): broker sandbox SPIFFE provider access tokens

Signed-off-by: Drew Newberry <anewberry@nvidia.com>

Author: drew

.agents/skills/helm-dev-environment/SKILL.md

@@ -84,11 +84,11 @@ e2e:kubernetes:shared-supervisor` runs the focused e2e
 through `OPENSHELL_E2E_KUBE_EXTRA_VALUES` to cover managed namespaces.
 `mise run e2e:kubernetes:shared-supervisor-spiffe` installs pinned SPIRE charts
 (`ci/values-spire-delegation-stack.yaml`, removed again on exit) and the
-`experimental_supervisor_spiffe_delegation` overlay
+`openshell.gateway.experimental_spiffe_delegation` overlay
 (`ci/values-supervisor-spiffe.yaml`), then registers sandbox
 identities with `ClusterStaticEntry` resources. `mise run test:spire-delegation`
-covers the same authorization rules against a local SPIRE server and agent
-without a cluster.
+checks delegated issuance and identity selection against a local SPIRE server
+and agent without a cluster; the Kubernetes test covers the gateway broker.
 
 ### 2. Deploy OpenShell
 

Cargo.lock

@@ -80,6 +80,14 @@ impl TestOpenShell {
 
 #[tonic::async_trait]
 impl OpenShell for TestOpenShell {
+    async fn get_sandbox_provider_access_token(
+        &self,
+        _request: tonic::Request<openshell_core::proto::GetSandboxProviderAccessTokenRequest>,
+    ) -> Result<Response<openshell_core::proto::GetSandboxProviderAccessTokenResponse>, Status>
+    {
+        Err(Status::unimplemented("not used by this test server"))
+    }
+
     async fn peer_notify_config_update(
         &self,
         _request: tonic::Request<openshell_core::proto::PeerNotifyConfigUpdateRequest>,

crates/openshell-cli/tests/ensure_providers_integration.rs

@@ -32,6 +32,14 @@ struct TestOpenShell;
 
 #[tonic::async_trait]
 impl OpenShell for TestOpenShell {
+    async fn get_sandbox_provider_access_token(
+        &self,
+        _request: tonic::Request<openshell_core::proto::GetSandboxProviderAccessTokenRequest>,
+    ) -> Result<Response<openshell_core::proto::GetSandboxProviderAccessTokenResponse>, Status>
+    {
+        Err(Status::unimplemented("not used by this test server"))
+    }
+
     async fn peer_notify_config_update(
         &self,
         _request: tonic::Request<openshell_core::proto::PeerNotifyConfigUpdateRequest>,

crates/openshell-cli/tests/mtls_integration.rs

@@ -235,6 +235,14 @@ impl TestOpenShell {
 
 #[tonic::async_trait]
 impl OpenShell for TestOpenShell {
+    async fn get_sandbox_provider_access_token(
+        &self,
+        _request: tonic::Request<openshell_core::proto::GetSandboxProviderAccessTokenRequest>,
+    ) -> Result<Response<openshell_core::proto::GetSandboxProviderAccessTokenResponse>, Status>
+    {
+        Err(Status::unimplemented("not used by this test server"))
+    }
+
     async fn peer_notify_config_update(
         &self,
         _request: tonic::Request<openshell_core::proto::PeerNotifyConfigUpdateRequest>,

crates/openshell-cli/tests/provider_commands_integration.rs

@@ -101,6 +101,14 @@ struct TestOpenShell {
 
 #[tonic::async_trait]
 impl OpenShell for TestOpenShell {
+    async fn get_sandbox_provider_access_token(
+        &self,
+        _request: tonic::Request<openshell_core::proto::GetSandboxProviderAccessTokenRequest>,
+    ) -> Result<Response<openshell_core::proto::GetSandboxProviderAccessTokenResponse>, Status>
+    {
+        Err(Status::unimplemented("not used by this test server"))
+    }
+
     async fn peer_notify_config_update(
         &self,
         _request: tonic::Request<openshell_core::proto::PeerNotifyConfigUpdateRequest>,

crates/openshell-cli/tests/sandbox_create_lifecycle_integration.rs

@@ -163,6 +163,13 @@ macro_rules! mock_gateway {
     ) => {
         #[tonic::async_trait]
         impl OpenShell for MockGateway {
+    async fn get_sandbox_provider_access_token(
+        &self,
+        _request: Request<proto::GetSandboxProviderAccessTokenRequest>,
+    ) -> Result<Response<proto::GetSandboxProviderAccessTokenResponse>, Status> {
+        Err(Status::unimplemented("not used by this test server"))
+    }
+
             $(async fn $method(&self, _: Request<$request>) -> Result<Response<$response>, Status> {
                 Err(Status::unimplemented("unused test RPC"))
             })*

crates/openshell-cli/tests/sandbox_exec_streaming_integration.rs

@@ -47,6 +47,14 @@ struct TestOpenShell {
 
 #[tonic::async_trait]
 impl OpenShell for TestOpenShell {
+    async fn get_sandbox_provider_access_token(
+        &self,
+        _request: tonic::Request<openshell_core::proto::GetSandboxProviderAccessTokenRequest>,
+    ) -> Result<Response<openshell_core::proto::GetSandboxProviderAccessTokenResponse>, Status>
+    {
+        Err(Status::unimplemented("not used by this test server"))
+    }
+
     async fn peer_notify_config_update(
         &self,
         _request: tonic::Request<openshell_core::proto::PeerNotifyConfigUpdateRequest>,

crates/openshell-cli/tests/sandbox_name_fallback_integration.rs

@@ -205,6 +205,39 @@ pub fn normalize_compute_driver_name(value: &str) -> Result<String, String> {
     Ok(value.to_ascii_lowercase())
 }
 
+/// Experimental gateway-owned SPIRE delegation for sandbox provider grants.
+#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct ExperimentalSpiffeDelegationConfig {
+    pub admin_socket_path: String,
+    pub spiffe_id_prefix: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub admin_socket_group: Option<u32>,
+}
+
+impl ExperimentalSpiffeDelegationConfig {
+    /// Reject ambiguous host paths and identities before opening the SPIRE socket.
+    pub fn validate(&self, gateway_id: &str) -> Result<(), String> {
+        let path = std::path::Path::new(&self.admin_socket_path);
+        if !path.is_absolute()
+            || path
+                .parent()
+                .is_none_or(|parent| parent == std::path::Path::new("/"))
+            || self
+                .admin_socket_path
+                .split('/')
+                .skip(1)
+                .any(|part| part.is_empty() || part == "." || part == "..")
+            || self.admin_socket_group == Some(0)
+        {
+            return Err("experimental_spiffe_delegation requires a canonical absolute admin socket path in a dedicated directory and a non-root socket group".into());
+        }
+        crate::spiffe::SandboxSpiffeIdPrefix::parse(&self.spiffe_id_prefix)?
+            .sandbox_spiffe_id(gateway_id, "sandbox")?;
+        Ok(())
+    }
+}
+
 /// Server configuration.
 ///
 /// Built programmatically in [`crate::Config::new`] and the gateway CLI from
@@ -269,6 +302,8 @@ pub struct Config {
     /// JWTs as `Principal::Sandbox`. Required for the per-sandbox identity
     /// flow (issue #1354).
     pub gateway_jwt: Option<GatewayJwtConfig>,
+    /// Gateway-only access to SPIRE; shared supervisors receive access tokens.
+    pub experimental_spiffe_delegation: Option<ExperimentalSpiffeDelegationConfig>,
 
     /// Database URL for persistence.
     pub database_url: String,
@@ -940,6 +975,7 @@ impl Config {
             provider_profile_sources: vec![GatewayProviderProfileSourceConfig::User],
             mtls_auth: MtlsAuthConfig::default(),
             gateway_jwt: None,
+            experimental_spiffe_delegation: None,
             database_url: String::new(),
             database_max_connections: None,
             database_lock_max_connections: None,

crates/openshell-core/src/config.rs

@@ -176,22 +176,6 @@ impl GatewayCredentials {
         self.inner.sandbox_bearer.clone()
     }
 
-    /// The gateway session JWT these credentials currently present, as last
-    /// renewed, or `None` once revoked. The value is unverified; callers that
-    /// act on its claims must verify it first.
-    #[cfg(feature = "jwt")]
-    #[must_use]
-    pub fn current_gateway_token(&self) -> Option<crate::jwt::SecretJwt> {
-        let bearer = self
-            .inner
-            .bearer
-            .read()
-            .unwrap_or_else(std::sync::PoisonError::into_inner)
-            .clone()?;
-        let token = crate::auth::strip_bearer_scheme(bearer.to_str().ok()?)?;
-        crate::jwt::SecretJwt::parse(token).ok()
-    }
-
     /// Clear both credentials and stop renewal. Existing clients fail their
     /// next request locally instead of presenting a revoked identity.
     pub fn revoke(&self) {
@@ -1577,50 +1561,43 @@ pub async fn exchange_provider_subject_token(
     ))
 }
 
-/// Confirm that the gateway still accepts this session's current credentials.
-///
-/// The gateway authenticates every sandbox RPC against the persisted runtime
-/// generation, credential epoch, gateway-token lineage, and an active sandbox
-/// phase, so a successful authenticated read proves the session is current
-/// right now, not only when its JWT was signed. The response is discarded.
-#[tracing::instrument(
-    name = "supervisor.gateway.confirm_session_authorization",
-    skip_all,
-    fields(otel.kind = "client", otel.status_code = tracing::field::Empty)
-)]
-pub async fn confirm_session_authorization(
+/// Obtain only the final access token; the gateway selects and verifies the
+/// sandbox identity and resolves all grant parameters from its configuration.
+#[tracing::instrument(name = "supervisor.gateway.get_provider_access_token", skip_all)]
+pub async fn get_sandbox_provider_access_token(
     gateway: &GatewayEndpoint,
-    sandbox_name: &str,
-) -> std::result::Result<(), TokenGrantFailure> {
-    let status = ClientSpanStatus::current();
+    credential_key: &str,
+    request_id: Option<&str>,
+) -> std::result::Result<ProviderSubjectTokenExchangeResult, TokenGrantFailure> {
     let endpoint = token_grant_gateway_endpoint(gateway.url())?;
-    if sandbox_name.is_empty() {
-        return Err(gateway_grant_failure(TokenGrantFailureKind::Configuration));
-    }
     let mut client = connect(&gateway.with_url(endpoint.as_str()))
         .await
         .map_err(|_| gateway_grant_failure(TokenGrantFailureKind::Unavailable))?;
-    let result = client
-        .get_sandbox_config(GetSandboxConfigRequest {
-            workspace_scope: None,
-            name: sandbox_name.to_string(),
-        })
-        .await
-        .map(drop)
-        .map_err(|status| {
-            gateway_grant_failure(match status.code() {
-                tonic::Code::Unauthenticated
-                | tonic::Code::PermissionDenied
-                | tonic::Code::NotFound
-                | tonic::Code::FailedPrecondition => {
-                    TokenGrantFailureKind::WorkloadIdentityRejected
-                }
-                tonic::Code::DeadlineExceeded => TokenGrantFailureKind::Timeout,
-                tonic::Code::Unavailable => TokenGrantFailureKind::Unavailable,
-                _ => TokenGrantFailureKind::Unclassified,
-            })
-        });
-    status.finish(result)
+    let mut request = tonic::Request::new(crate::proto::GetSandboxProviderAccessTokenRequest {
+        credential_key: credential_key.to_string(),
+    });
+    if let Some(value) = request_id.and_then(|value| value.parse().ok()) {
+        request.metadata_mut().insert("x-request-id", value);
+    }
+    let response = tokio::time::timeout(
+        Duration::from_mins(1),
+        client.get_sandbox_provider_access_token(request),
+    )
+    .await
+    .map_err(|_| gateway_grant_failure(TokenGrantFailureKind::Timeout))?
+    .map_err(|status| provider_subject_token_exchange_status(&status, &endpoint))?
+    .into_inner();
+    // connect() and the response boundary both reject a locally revoked session.
+    if gateway.credentials().is_revoked() {
+        return Err(gateway_grant_failure(
+            TokenGrantFailureKind::WorkloadIdentityRejected,
+        ));
+    }
+    provider_subject_token_exchange_result(crate::proto::ExchangeProviderSubjectTokenResponse {
+        access_token: response.access_token,
+        expires_after: response.expires_after,
+        token_type: response.token_type,
+    })
 }
 
 /// Attach the exchange's request ID as `x-request-id` gRPC metadata.