T

Stéphane Tailland dcc93f0f68 refactor: rename the token-exchange broker to drop the middleware's name

Every agent has to name this client in the audience scopes it requests, so the
one thing an agent cannot avoid naming was the very thing it should know
nothing about. The gateway is replaceable; the contract should not say
otherwise.

token-exchange-broker, same credential, same behaviour. The old client stays in
the realm until every consumer has moved.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-08-29 07:40:03 +02:00

dev

refactor: rename the token-exchange broker to drop the middleware's name

2026-08-29 07:40:03 +02:00

kong

fix(catalog-mcp): create-product could never succeed

2026-08-28 17:34:06 +02:00

.gitignore

First commit

2026-08-20 13:24:10 +02:00

openapi.yaml

Regenerate the spec against the gateway, not the backend

2026-08-27 06:42:02 +02:00

README.md

MCP server

2026-08-20 17:27:09 +02:00

README.md

catalog-api

Kong routing/policy layer for the catalog slice of classic-models-api (see /Users/stephanetailland/git/classic-models-api), split out per the DDD decomposition in ../kong-konnect-deployment-strategy.md. The backend itself stays a single monolith — only Kong does the domain split.

Two exposure surfaces of the same API, both proxying to the real classic-models-api backend:

REST (kong/rest/) — 14 routes covering products/productlines.
MCP (kong/mcp/) — the same catalog exposed as MCP tools (list-products, get-product, create-product so far; extending to the rest is mechanical), via ai-mcp-proxy.

Auth

openid-connect on both surfaces, with a distinct audience each (catalog-api for REST, mcp-catalog for MCP) and a real RFC 8693 token exchange chain: MCP → catalog-api → classic-models-api (REST's own exchange target), narrowing the token before it ever reaches the backend — the backend never sees a token minted for a different audience. consumer_claims/consumer_by map the JWT sub to a Kong Consumer for per-consumer rate limiting; consumer_groups_claim maps realm roles to Kong Consumer Groups for MCP's per-tool ACLs.

Other policies

Per-consumer + API-level rate limiting, response caching (GET/HEAD), audit log (http-log, endpoint still a placeholder — no real log collector in this lab).

Structure

dev/gitrepository.yaml + dev/flux-kustomization.yaml — this repo, self-referential; deploys ./kong into the catalog domain's dev environment (dependsOn the domain's Gateway infra in dataplane-catalog).
dev/externalsecret.yaml — git deploy key (ESO/Vault).
dev/token-exchange-broker-externalsecret.yaml — the shared client secret Kong uses to authenticate its own token-exchange calls to Keycloak.
kong/rest/, kong/mcp/ — see above.
openapi.yaml — extracted from the live backend, filtered to this domain's paths/schemas.