## Scope On the GitLab Rails instance, issue short-lived, user-scoped JWTs signed with the instance's own Private Key that clients use against Artifact Registry. Per the [direction issue gitlab#595148](https://gitlab.com/gitlab-org/gitlab/-/work_items/595148): > Instances mint short-lived, user-scoped JWTs locally using the Private Key. AR never calls back to the GitLab instance. See also the [Token Exchange section of the AR auth interface agreement](https://handbook.gitlab.com/handbook/engineering/architecture/design-documents/artifact_registry/agreements/auth/#r1--token-exchange-service). ## Requirements - [x] GitLab Rails must expose a token exchange endpoint on the GitLab instance that accepts client credentials and returns a temporary token usable against Artifact Registry. - [x] The endpoint MUST support PATs, OAuth tokens, CI job tokens, deploy tokens, and project/group access tokens. - [x] Tokens MUST use a default duration or accept a requested duration with an upper limit. See the [client credential management work item](https://gitlab.com/gitlab-org/gitlab/-/work_items/595150). - [x] Tokens MUST be signed using a private key held by the GitLab instance. - This was decided in the code review for the original glgo-side CC v1.5 implementation and is being implemented in https://gitlab.com/gitlab-org/auth/glgo/-/merge_requests/229+ - [ ] On self-managed, CloudCreds obtained from CC v2 must be embedded in the token payload. On gitlab.com, we may decide to skip this step and accept just the token since gitlab.com is a trusted instance. - [ ] The endpoint MUST work whether Artifact Registry and Rails are co-located or remote (Self-Managed Rails → SaaS Artifact Registry). ## Dependencies - [CC v2 token exchange in glgo (R1 interim)](https://gitlab.com/gitlab-org/gitlab/-/work_items/599070) - [Sidekiq job to fetch private key and CloudCreds from CC v2 (glgo) on a schedule](https://gitlab.com/gitlab-org/gitlab/-/work_items/599085) ## References - [Direction issue gitlab#595148](https://gitlab.com/gitlab-org/gitlab/-/work_items/595148) Estimated weight: 3