# kong-forge-auth

Kong external Go plugin that authenticates Atlassian Forge Remote requests by
validating their Forge Invocation Token (FIT).

The plugin validates the JWT signature against Atlassian's JWKS, requires the
Forge invocation issuer, checks token time claims, and restricts requests to
configured Forge app and installation IDs. It then replaces any caller-supplied
identity headers with claims from the validated FIT.

Required Kong configuration:

```yaml
plugin: forge-auth
config:
  allowed_app_ids:
    - ari:cloud:ecosystem::app/example
  allowed_installation_ids:
    - ari:cloud:ecosystem::installation/example
  require_principal: true
```

Optional configuration:

```yaml
config:
  jwks_url: https://forge.cdn.prod.atlassian-dev.net/.well-known/jwks.json
  request_timeout_ms: 5000
```

Development or staging can temporarily bootstrap an installation before its ID
is known:

```yaml
config:
  allowed_app_ids:
    - ari:cloud:ecosystem::app/example
  allow_unregistered_installations: true
  require_principal: true
```

In bootstrap mode, every accepted installation ID is written to the Kong plugin
log. Add the discovered ID to `allowed_installation_ids` and disable bootstrap
mode immediately after the first successful invocation. Do not enable bootstrap
mode in production.

Validated identity is forwarded through these headers:

- `X-Atlassian-Account-Id`
- `X-Forge-App-Id`
- `X-Forge-Installation-Id`
- `X-Forge-Invocation-Id`

The original `Authorization`, `X-Forge-OAuth-User`, and
`X-Forge-OAuth-System` headers are removed before proxying because jsm-syncer
does not call Atlassian APIs with those tokens.

Run tests independently with:

```bash
GOWORK=off go test ./...
```