correct issuer and add commands claim

api/build/id_request_token.go

@@ -5,6 +5,7 @@ package build
 import (
 	"fmt"
 	"net/http"
+	"strconv"
 	"time"
 
 	"github.com/gin-gonic/gin"
@@ -87,6 +88,7 @@ func GetIDRequestToken(c *gin.Context) {
 
 	image := c.Query("image")
 	request := c.Query("request")
+	commands, _ := strconv.ParseBool(c.Query("commands"))
 
 	// retrieve token manager from context
 	tm := c.MustGet("token-manager").(*token.Manager)
@@ -101,6 +103,7 @@ func GetIDRequestToken(c *gin.Context) {
 		TokenDuration: exp,
 		Image:         image,
 		Request:       request,
+		Commands:      commands,
 	}
 
 	// mint token

api/build/id_token.go

@@ -88,6 +88,7 @@ func GetIDToken(c *gin.Context) {
 		TokenDuration: tm.IDTokenDuration,
 		Image:         cl.Image,
 		Request:       cl.Request,
+		Commands:      cl.Commands,
 	}
 
 	// if audience is provided, include that in claims

api/oi_config.go

@@ -34,7 +34,7 @@ func GetOpenIDConfig(c *gin.Context) {
 	m := c.MustGet("metadata").(*internal.Metadata)
 
 	config := types.OpenIDConfig{
-		Issuer:      m.Vela.Address,
+		Issuer:      fmt.Sprintf("%s/_services/token", m.Vela.Address),
 		JWKSAddress: fmt.Sprintf("%s/%s", m.Vela.Address, "_services/token/.well-known/jwks"),
 		SupportedClaims: []string{
 			"sub",

cmd/vela-server/token.go

@@ -3,6 +3,8 @@
 package main
 
 import (
+	"fmt"
+
 	"github.com/sirupsen/logrus"
 	"github.com/urfave/cli/v2"
 
@@ -22,7 +24,7 @@ func setupTokenManager(c *cli.Context, db database.Interface) (*token.Manager, e
 		WorkerAuthTokenDuration:     c.Duration("worker-auth-token-duration"),
 		WorkerRegisterTokenDuration: c.Duration("worker-register-token-duration"),
 		IDTokenDuration:             c.Duration("id-token-duration"),
-		Issuer:                      c.String("server-addr"),
+		Issuer:                      fmt.Sprintf("%s/_services/token", c.String("server-addr")),
 	}
 
 	// generate a new RSA key pair

internal/token/mint.go

@@ -28,6 +28,7 @@ type Claims struct {
 	TokenType   string `json:"token_type,omitempty"`
 	Image       string `json:"image,omitempty"`
 	Request     string `json:"request,omitempty"`
+	Commands    bool   `json:"commands,omitempty"`
 	jwt.RegisteredClaims
 }
 
@@ -43,6 +44,7 @@ type MintTokenOpts struct {
 	Audience      []string
 	Image         string
 	Request       string
+	Commands      bool
 }
 
 // MintToken mints a Vela JWT Token given a set of options.
@@ -105,6 +107,7 @@ func (tm *Manager) MintToken(mto *MintTokenOpts) (string, error) {
 		claims.BuildSender = mto.Build.GetSender()
 		claims.Image = mto.Image
 		claims.Request = mto.Request
+		claims.Commands = mto.Commands
 
 	default:
 		return "", errors.New("invalid token type")
@@ -152,6 +155,7 @@ func (tm *Manager) MintIDToken(mto *MintTokenOpts, db database.Interface) (strin
 	claims.TokenType = mto.TokenType
 	claims.Image = mto.Image
 	claims.Request = mto.Request
+	claims.Commands = mto.Commands
 
 	// set standard claims
 	claims.IssuedAt = jwt.NewNumericDate(time.Now())

router/router.go

@@ -90,8 +90,8 @@ func Load(options ...gin.HandlerFunc) *gin.Engine {
 	r.POST("/webhook", webhook.PostWebhook)
 
 	// JWKS endpoints
-	r.GET("_services/token/.well-known/openid-configuration", api.GetOpenIDConfig)
-	r.GET("_services/token/.well-known/jwks", api.GetJWKS)
+	r.GET("/_services/token/.well-known/openid-configuration", api.GetOpenIDConfig)
+	r.GET("/_services/token/.well-known/jwks", api.GetJWKS)
 
 	// Authentication endpoints
 	authenticate := r.Group("/authenticate")