MediaMetz/gemini-cli
1
0
Fork 0
mirror of https://github.com/google-gemini/gemini-cli.git synced 2026-03-15 16:41:11 -07:00
Code Issues Packages Projects Releases Wiki Activity

fix: delegate auth to Cloud Run IAM when K_SERVICE is set

Browse Source 
Cloud Run strips the Authorization header after using it for IAM
validation, so our JWT middleware can never see the token. When
running on Cloud Run (detected via K_SERVICE env var), skip
app-level JWT verification since Cloud Run IAM already ensures
only authorized service accounts (chat@system.gserviceaccount.com)
can reach the container.
This commit is contained in:
Adam Weidman
2026-02-12 12:19:35 -05:00
parent d1ca874dd1
commit 1c926921ed
1 changed files with 21 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
packages/a2a-server/src/chat-bridge/routes.ts
View File

@@ -21,13 +21,31 @@ const CHAT_ISSUER = 'chat@system.gserviceaccount.com';
/**
* Creates middleware that verifies Google Chat JWT tokens.
* When projectNumber is set, requests must include a valid Bearer token
* signed by Google Chat with the correct audience.
* When not set, verification is skipped (for local testing).
*
* On Cloud Run (detected via K_SERVICE env var), authentication is handled by
* Cloud Run's IAM layer — only principals with roles/run.invoker can reach the
* container. Cloud Run strips the Authorization header after validation, so our
* middleware cannot re-verify the token. We trust Cloud Run's IAM instead.
*
* When NOT on Cloud Run and projectNumber is set, requests must include a valid
* Bearer token signed by Google Chat with the correct audience.
*
* When neither condition applies, verification is skipped (local testing).
*/
function createAuthMiddleware(
projectNumber: string | undefined,
): (req: Request, res: Response, next: NextFunction) => void {
// On Cloud Run, IAM handles auth — the Authorization header is stripped
// before reaching the container, so we cannot verify it ourselves.
if (process.env['K_SERVICE']) {
logger.info(
'[ChatBridge] Running on Cloud Run — auth delegated to Cloud Run IAM.',
);
return (_req: Request, _res: Response, next: NextFunction) => {
next();
};
}
if (!projectNumber) {
logger.warn(
'[ChatBridge] CHAT_PROJECT_NUMBER not set — JWT verification disabled. ' +