Authentication Methods
| Method | Applies To | Validator |
|---|
| JWT Bearer Token | /v1/* (canonical APIs) | JWTValidator |
| API Tokens | /v1/* (external integrations) | APITokenValidator |
| Application Tokens | /v1/* (scoped app access) | ApplicationTokenValidator |
| Session Auth | Website/admin routes | SessionValidator |
| OAuth2/OIDC | Login flow | OAuth2Backend |
| LDAP | Enterprise directory login | LDAPBackend |
| Azure AD | Microsoft identity login | AzureADBackend |
| MFA | Enhanced security | MFAService |
Token Validation Chain
Request → TokenExtractor (Authorization/x-api-key header)
→ JWTValidator (check signature + revocation list)
→ APITokenValidator (lookup model + check expiry)
→ ApplicationTokenValidator (scoped validation)
→ ExemptionRules (public prefix check)
→ Route Handler
Role-Based Access Control
| Role | Typical Permissions |
|---|
| Admin | Full system access, user/role management, configuration |
| Power User | Advanced AI operations, RAG management, workflow creation |
| User | Standard AI operations, personal workflows |
| Guest | Read-only access to public endpoints |
Permission Scopes (80+ defined)
| Domain | Example Permissions |
|---|
llm | llm:view, llm:load, llm:delete, llm:manage_env, llm:generate, llm:chat |
rag | rag:read, rag:write, rag:admin, rag:query, rag:manage_collections |
rag_cluster | rag_cluster:view, rag_cluster:manage, rag_cluster:failover, rag_cluster:conflict |
agent | agent:read, agent:execute, agent:approve, agent:admin |
system | system:admin, server:*, runtime:*, env:*, task:*, job:* |
user | user:manage, role:manage, group:manage, policy:manage |
studio | studio:view, studio:write, studio:manage |
workflow | workflow:read, workflow:write, workflow:execute |
scheduler | scheduler:read, scheduler:write, scheduler:execute, scheduler:admin |
Auth Services (app/services/auth/ — 11 modules)
| Service | Responsibility |
|---|
auth_service.py | RBAC permission management (80+ permission constants) |
jwt_service.py | JWT token generation, validation, refresh, revocation |
api_token_manager.py | API token lifecycle (create, validate, revoke) |
auth_types.py | Typed DTOs (AuthCredentials, AuthResult, TokenInfo, TokenResponse) |
auth_registry.py | Backend registration for pluggable auth |
ldap_backend.py | LDAP/Active Directory integration |
oauth2_backend.py | OAuth2 (Google, GitHub, Microsoft) |
azure_ad_backend.py | Azure AD / Entra ID integration |
mfa_service.py | Multi-factor authentication |
application_token_validation_service.py | Application-scoped token validation |