[SalimKayal]

Summary

The internal proxy endpoint POST /internal/sessions/{session_id}/authorize now requires a Keycloak service-account token carrying the ssh-proxy realm role; it was unauthenticated (POC). Plan 3 of service-account-plan.md.

Motivation and context

The proxy is the internet-facing first hop. #1446 left the endpoint public so the flow could be exercised; this puts authentication back using a realm role created Keycloak.

Behavior

• No/invalid token → 401; valid user token without the role → 403; ssh-proxy role → existing 204/404 logic.
• renku-admin (is_admin) bypasses the role check.
• Internal/session HS512 tokens are rejected (fail Keycloak JWKS).

Changes

• ssh_proxy/blueprints.py, data_api/app.py: add authenticator + ssh_proxy_role="ssh-proxy" to SSHProxyBP, gate the handler with @authenticate + @require_role, wire dm.authenticator.
• ssh_proxy/api.spec.yaml: add 401/403 responses.
• test/.../test_ssh_proxy.py: auth-matrix tests (no token / user / wrong role / admin bypass / service account).
• users/core.py: docstring now says "authorize endpoint" (incidental, unrelated).

Notes

• Deploy precondition: must issue the ssh-proxy client a token with realm_access.roles: ["ssh-proxy"] and an aud in ["renku","renku-ui","renku-cli","swagger"]; a missing audience fails closed to 401.
• This PR requires feat: fetch token from keycloak service account for ssh proxy renku#4620

---

PR Stack

• feat: add support for ssh pubkeys storing / validating / retrieving  #1441
  • feat(users): store ssh keys #1442
    • feat(users): add /user/ssh_keys CRUD API #1444
      • feat: proxy api for ssh keys #1446
        • feat: ssh proxy service account authn #1448 ◀️ this PR
          • feat(notebooks): configure proxy-to-session key secret names #1452
            • Add frontend variant as session label #1455
              • feat(notebooks): mount proxy-to-session keys only for ssh frontends #1458

[coveralls]

Coverage Report for CI Build 35978868057

Warning

No base build found for commit 3fe4321 on salimkayal/feat/ssh-keys_proxy-api.
Coverage changes can't be calculated without a base build.
If a base build is processing, this comment will update automatically when it completes.

Coverage: 85.455%

Details

• Patch coverage: 7 of 7 lines across 1 file are fully covered (100%).

Uncovered Changes

No uncovered changes found.

Coverage Regressions

Requires a base build to compare against. How to fix this →

---

Coverage Stats

Relevant Lines:	34602
Covered Lines:	29569
Line Coverage:	85.45%
Coverage Strength:	1.48 hits per line

---

💛 - Coveralls

The merge-base changed after approval.