Draft: Distributed OAuth Applications across Cells

Related MRs

Repository	MR
gitlab-rails	gitlab-org/gitlab!236139 (closed)
topology-service	topology-service!518 (closed)

Summary

• Adds a dedicated oauthTokenHandler for POST /oauth/token that reads form data and routes to the correct cell by decoding the cell ID embedded in routable gloak- / gloag- / gloar- tokens
  • authorization_code grant: extracts the cell ID from the code field (expects gloag- prefix)
  • refresh_token grant: extracts the cell ID from the refresh_token field (expects gloar- prefix)
  • All other grant types (e.g. client_credentials) fall back to the JSON rule handler
  • Falls back to the JSON rule handler when no routable token is present or topology service is not configured
• Adds decodeGloakToken utility that parses the routing payload from gloak- / gloag- / gloar- prefixed tokens (base36-encoded key-value pairs)
• Adds oauth.json ruleset with two rules for header- and query-string-based classification:
  • oauth_routable_bearer_token — routes requests carrying a gloak- bearer token in the Authorization header by decoding the embedded cell ID
  • oauth_routable_auth_code — routes OAuth redirect callbacks carrying a gloag- code in the code query parameter
• Adds ClientID to the ClassifyType enum (used by related MRs)
• Removes the oauth_client_id routing rule — OAuth flows are now handled on the user's cell, not the application's cell
• Changes custom route registration from router.get to router.all so that POST /oauth/token and other non-GET custom routes are handled correctly
• Fixes Object.fromEntries(request.headers) spread in test helpers to avoid TypeScript spread-on-non-plain-object errors
• Fixes TypeScript cast for caches.default spy in test setup

Context

Part of the Distributed OAuth Applications feature. Previously the router attempted to route /oauth/authorize requests to the cell that registered the OAuth application by classifying the client_id. With the new design, OAuth applications are published globally via the Topology Service and all OAuth flows are handled on the user's own cell. Token and auth code routing by cell-embedded prefix is sufficient.

Companion changes (same branch name feat/distributed-idp-oauth):

• gitlab-rails: routable gloak- tokens, Cells::Claimable on OauthApplication, SignInWithJWKS cross-cell cookie
• topology-service: string user_data on claims, record_user_data in ClassifyResponse

Test plan

• oauthTokenHandler routes authorization_code grant with gloag- code to the correct cell
• oauthTokenHandler defaults to authorization_code when grant_type is omitted
• oauthTokenHandler routes refresh_token grant with gloar- refresh token to the correct cell
• oauthTokenHandler falls back to JSON rule handler when token is not routable
• oauthTokenHandler falls back to JSON rule handler for client_credentials grant
• oauthTokenHandler falls back to JSON rule handler when topology service is not configured
• oauth_routable_bearer_token rule matches gloak- bearer tokens in Authorization header
• oauth_routable_auth_code rule matches gloag- codes in code query parameter
• oauth_client_id rule is no longer present and no regressions in OAuth routing

🤖 Generated with GitLab Agentic Modular