Authorization Feature

apps/agent_gateway/app/main.py

@@ -18,6 +18,7 @@ from agent_framework.global_supervisor import (
 )
 from agent_framework.llm.providers import create_llm
 from agent_framework.observability.observer import AgentObserver
+from agent_framework.security import install_authentication
 
 from app.settings import settings
 
@@ -25,6 +26,7 @@ logging.basicConfig(level=settings.LOG_LEVEL)
 logger = logging.getLogger("agent_gateway")
 
 app = FastAPI(title="Agent Gateway - Global Supervisor")
+install_authentication(app, prefix="AGENT_GATEWAY_AUTH")
 app.add_middleware(
     CORSMiddleware,
     allow_origins=[o.strip() for o in settings.CORS_ORIGINS.split(",")],

apps/agent_gateway/config/authentication.example.yaml

@@ -0,0 +1,39 @@
+# Nunca coloque secrets diretamente neste arquivo. Use sempre *_env.
+providers:
+  public:
+    mode: none
+
+  deny:
+    mode: deny
+
+  tia_basic:
+    mode: basic
+    client_id_env: TIA_AGENT_CLIENT_ID
+    secret_hash_env: TIA_AGENT_SECRET_HASH
+    realm: agent-contas
+
+  platform_jwt:
+    mode: jwt
+    key_env: PLATFORM_JWT_PUBLIC_KEY
+    algorithms: [RS256]
+    audience: agent-platform
+    issuer: https://identity.example.com/
+
+policies:
+  - name: health-public
+    provider: public
+    paths: [/health, /ready, /live]
+
+  - name: tia-agent-api
+    provider: tia_basic
+    paths: [/gateway/message, /gateway/message/sse, /gateway/events/*]
+    methods: [GET, POST]
+
+  - name: admin-api
+    provider: platform_jwt
+    paths: [/debug/*, /admin/*]
+    required_roles: [platform-admin]
+    required_scopes: [agent.admin]
+
+# Quando nenhuma política casar, rejeita. O default omitido também é deny.
+default_provider: deny

apps/mcp_gateway/app/main.py

@@ -11,6 +11,7 @@ from typing import Any
 import httpx
 import yaml
 from fastapi import FastAPI, Header, HTTPException
+from agent_framework.security import install_authentication
 from pydantic import BaseModel, Field
 
 
@@ -64,6 +65,7 @@ discovered_tools: dict[str, dict[str, Any]] = {}
 discovery_state: dict[str, Any] = {"last_sync": None, "errors": [], "tools": []}
 cache: dict[str, tuple[float, Any]] = {}
 app = FastAPI(title="Agent Platform OCI - MCP Gateway", version="1.1.0")
+install_authentication(app, prefix="MCP_GATEWAY_AUTH")
 
 
 def audit(name: str, payload: dict[str, Any]) -> None:

apps/mcp_gateway/config/authentication.example.yaml

@@ -0,0 +1,39 @@
+# Nunca coloque secrets diretamente neste arquivo. Use sempre *_env.
+providers:
+  public:
+    mode: none
+
+  deny:
+    mode: deny
+
+  tia_basic:
+    mode: basic
+    client_id_env: TIA_AGENT_CLIENT_ID
+    secret_hash_env: TIA_AGENT_SECRET_HASH
+    realm: agent-contas
+
+  platform_jwt:
+    mode: jwt
+    key_env: PLATFORM_JWT_PUBLIC_KEY
+    algorithms: [RS256]
+    audience: agent-platform
+    issuer: https://identity.example.com/
+
+policies:
+  - name: health-public
+    provider: public
+    paths: [/health, /ready, /live]
+
+  - name: tia-agent-api
+    provider: tia_basic
+    paths: [/gateway/message, /gateway/message/sse, /gateway/events/*]
+    methods: [GET, POST]
+
+  - name: admin-api
+    provider: platform_jwt
+    paths: [/debug/*, /admin/*]
+    required_roles: [platform-admin]
+    required_scopes: [agent.admin]
+
+# Quando nenhuma política casar, rejeita. O default omitido também é deny.
+default_provider: deny