fix(dynamic-agents): verify caller context end to end

[sriaradhyula]

Description

Complete the Dynamic Agents caller-authentication rollout across the BFF, runtime, Compose, and Helm deployment paths.

• Require the BFF to forward a usable caller bearer token.
• Make independent bearer validation the Dynamic Agents default.
• Sign and verify the BFF user-context header with a shared HMAC secret.
• Fail closed when the signing configuration is unavailable.
• Add an optional standalone and enabled umbrella NetworkPolicy that limits API ingress to the UI pod and metrics ingress to the metrics pod.
• Keep an explicit bearer rollback setting while retaining signed context verification.
• Add first-install Compose defaults and Helm secret wiring.

Type of Change

• Bugfix
• New Feature
• Breaking Change
• Refactor
• Documentation
• Other (please describe)

Pre-release Helm Charts (Optional)

This PR updates the caipe-ui and dynamic-agents subcharts and adds a Dynamic Agents NetworkPolicy template. The branch uses the repository's prebuild prefix for image validation.

Checklist

• I have read the contributing guidelines
• Existing issues have been referenced (where applicable)
• I have verified this change is not present in other open pull requests

Validation

• Dynamic Agents: 25 caller-verification tests passed
• UI: 5 focused tests passed
• Helm: 15 render and contract tests passed
• RBAC living-document validation passed
• Ruff and ESLint passed
• Compose first-install configuration rendered successfully
• Dynamic Agents and UI subcharts linted and rendered successfully
• Next.js production compilation passed; the repository current route-export type errors remain in the type phase

[github-actions]

✅ No proprietary content detected. This PR is clear for review!

[github-actions]

🧪 CAIPE UI Test Results

❌ Tests failed - Please review the logs

🟡 Overall Coverage: 62%

📊 Detailed Coverage

Metric	Covered	Total	Percentage
Lines	41131	60808	67.64%
Statements	43906	67081	65.45%
Functions	7679	12634	60.78%
Branches	27985	50627	55.27%

✅ Test Suites

• ✅ auth-guard.test.tsx - Route protection & authorization
• ✅ token-expiry-guard.test.tsx - Token expiry handling
• ✅ dynamic-agent-client.test.ts - Dynamic Agents streaming client
• ✅ auth-utils.test.ts - Authentication utilities (100% coverage)
• ✅ auth-config.test.ts - OIDC configuration

📈 Coverage Thresholds

Threshold	Target	Current	Status
Minimum	40%	62%	✅ Pass
Good	60%	62%	✅ Pass
Excellent	80%	62%	⚠️ Below target

⚠️ Areas Needing Tests

High Priority:

• lib/streaming/* - Core stream event handling
• store/chat-store.ts - Chat state management
• store/agent-skills-store.ts - Agent skills
• lib/api-client.ts - API communication
• lib/storage-mode.ts - MongoDB/localStorage switching

Medium Priority:

• components/chat/ChatPanel.tsx - Main chat interface
• components/agent-builder/* - Agent builder UI
• lib/mongodb.ts - MongoDB integration

---

💡 Run locally: make caipe-ui-tests
📦 Full report: Check workflow artifacts

[github-actions]

ℹ️ Branch is behind main (advisory, non-blocking)

Commit: 6c108733

This branch does not yet contain the latest main. This does not fail the version-bump check — version files are bumped once the branch is updated, and GitHub branch protection still requires the branch to be up to date before merge. Use the Update branch button on this PR, or run:

git fetch origin main
git checkout prebuild/fix/dynamic-agents-strict-auth
git merge FETCH_HEAD
git push

This is a prebuild/* branch, so Helm prebuild publishing will still run so you can test the chart changes while the branch is being updated.

[caipe-ci-release]

Prebuild Artifacts for `ae3b20a` (archived)

Prebuild Artifacts for ae3b20a

Branch: prebuild/fix/dynamic-agents-strict-auth
Commit: ae3b20a

Docker Images

Artifact	Image	Tag	Status	CI
caipe-dynamic-agents	-	-	Failed	CI
caipe-ui	-	-	Failed	CI

These prebuild artifacts will be automatically cleaned up when the PR is closed or merged.

[caipe-ci-release]

Prebuild Artifacts for `c6a9496` (archived)

Prebuild Artifacts for c6a9496

Branch: prebuild/fix/dynamic-agents-strict-auth
Commit: c6a9496

Docker Images

Artifact	Image	Tag	Status	CI
caipe-dynamic-agents	ghcr.io/cnoe-io/prebuild/caipe-dynamic-agents	fix-dynamic-agents-strict-auth-6	Published	CI
caipe-ui	ghcr.io/cnoe-io/prebuild/caipe-ui	fix-dynamic-agents-strict-auth-6	Published	CI

Docker pull commands

docker pull ghcr.io/cnoe-io/prebuild/caipe-dynamic-agents:fix-dynamic-agents-strict-auth-6
docker pull ghcr.io/cnoe-io/prebuild/caipe-ui:fix-dynamic-agents-strict-auth-6

Helm Charts

Chart	Registry	Version	Status	CI
ai-platform-engineering	ghcr.io/cnoe-io/prebuild-helm-charts	0.5.69-dev.2-fix-dynamic-agents-strict-auth-5	Published	CI

Helm install commands

helm upgrade --install ai-platform oci://ghcr.io/cnoe-io/prebuild-helm-charts/ai-platform-engineering --version 0.5.69-dev.2-fix-dynamic-agents-strict-auth-5

These prebuild artifacts will be automatically cleaned up when the PR is closed or merged.

[subbaksh]

Code review findings

I would block merge on the following issues:

1. High: strict bearer authentication can be bypassed

In jwt_middleware.py, Authorization: Bearer enters the Bearer branch, produces an empty raw token, and then skips both token validation and the DA_REQUIRE_BEARER rejection branch.

I reproduced a protected request returning HTTP 200 with DA_REQUIRE_BEARER=true. Combined with the published Compose HMAC default, this permits a forged admin context on a default first-install configuration. Empty Bearer values should return 401 in strict mode, with a regression test covering that exact case.

2. High: signature enforcement was not applied to all Dynamic Agents callers

auth.py now rejects every unsigned X-User-Context, but only callers using buildBackendHeaders add X-User-Context-Signature.

Existing callers still construct the header manually and will receive 401 responses, including:

• /api/ai/assist
• /api/ai/review
• workflow Dynamic Agents calls
• autonomous-agents

Signing should be centralized and all manual X-User-Context construction eliminated or updated.

3. High: the NetworkPolicy blocks autonomous-agents

The new policy permits only UI and metrics pods, while autonomous-agents connects directly to Dynamic Agents. Because the umbrella values enable this policy, autonomous executions will be denied at the network layer before authentication is attempted.

The policy needs an autonomous-agents ingress rule, a configurable additional-caller list, or the caller must be routed through the BFF.

4. Medium: the required HMAC secret fails only at request time

The new HMAC secret is mandatory, but both umbrella references default to empty. Existing Helm installations can upgrade successfully and then fail at runtime with UI 500 / Dynamic Agents 503 responses. This should be caught during chart rendering or called out as an explicit upgrade requirement.

The current CI covers the individual middleware and signing helpers, but it does not exercise these cross-service call paths.

[sriaradhyula]

Addressed all four findings in ec088b9:

• Empty or whitespace-only Authorization: Bearer values now return 401 in both strict and lenient modes, with regression coverage.
• Centralized X-User-Context HMAC signing and migrated all direct UI/workflow callers plus autonomous-agents to the shared v1=<sha256> wire format. Missing secrets fail closed.
• Added configurable Dynamic Agents NetworkPolicy caller selectors and enabled autonomous-agents ingress in the umbrella chart.
• Added umbrella Helm render-time validation for the shared user-context secret, plus standalone upgrade guidance.

Validation completed locally:

• Dynamic Agents JWT middleware: 15 passed
• Autonomous Agents client: 31 passed
• Helm contracts: 18 passed
• Focused UI Jest suites: 12 passed
• Ruff, ESLint, and tsc --noEmit: passed

There are no GitHub review-thread objects on this PR to resolve; the findings were posted as a top-level PR comment. CI is now running against the updated commit.

[caipe-ci-release]

Prebuild Artifacts for `3ef260d` (archived)

Prebuild Artifacts for 3ef260d

Branch: prebuild/fix/dynamic-agents-strict-auth
Commit: 3ef260d

Docker Images

Artifact	Image	Tag	Status	CI
caipe-dynamic-agents	-	-	Failed	CI
caipe-ui	-	-	Failed	CI

These prebuild artifacts will be automatically cleaned up when the PR is closed or merged.

[caipe-ci-release]

Prebuild Artifacts for ef87509

Branch: prebuild/fix/dynamic-agents-strict-auth
Commit: ef87509

Docker Images

Artifact	Image	Tag	Status	CI
caipe-autonomous-agents	ghcr.io/cnoe-io/prebuild/caipe-autonomous-agents	fix-dynamic-agents-strict-auth-5	Published	CI
caipe-dynamic-agents	ghcr.io/cnoe-io/prebuild/caipe-dynamic-agents	fix-dynamic-agents-strict-auth-5	Published	CI
caipe-ui	ghcr.io/cnoe-io/prebuild/caipe-ui	fix-dynamic-agents-strict-auth-5	Published	CI

Docker pull commands

docker pull ghcr.io/cnoe-io/prebuild/caipe-autonomous-agents:fix-dynamic-agents-strict-auth-5
docker pull ghcr.io/cnoe-io/prebuild/caipe-dynamic-agents:fix-dynamic-agents-strict-auth-5
docker pull ghcr.io/cnoe-io/prebuild/caipe-ui:fix-dynamic-agents-strict-auth-5

Helm Charts

Chart	Registry	Version	Status	CI
ai-platform-engineering	ghcr.io/cnoe-io/prebuild-helm-charts	0.5.69-dev.4-fix-dynamic-agents-strict-auth-4	Published	CI

Helm install commands

helm upgrade --install ai-platform oci://ghcr.io/cnoe-io/prebuild-helm-charts/ai-platform-engineering --version 0.5.69-dev.4-fix-dynamic-agents-strict-auth-4

These prebuild artifacts will be automatically cleaned up when the PR is closed or merged.