Repository navigation
Sign in to a gateway's console with Meridian Cloud - #52
Merged
Merged
Conversation
Poisson arrivals of short chats, long generations and long prompts, streamed and not, sticky sessions, rotated API keys and a few deliberately bad requests. Standard library only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0177yERMgobFkKXuZUcZmpwZ
Not wanted in the repository. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0177yERMgobFkKXuZUcZmpwZ
Gateways connected to a workspace offer "Sign in with Meridian Cloud" on their console. Meridian Cloud is the identity provider (authorization code + PKCE); the gateway is a confidential client that redeems codes with its workspace token. The person's workspace role sets their rights on the gateway: viewer reads, operator also reloads, admin/owner also manage keys. Cloud: - /oauth/gateway/authorize: session + membership check; redirects only to the console_url the gateway reported over its authenticated channel - /api/gateway/v1/auth/token: one-time 60 s signed codes, bound to the workspace, gateway, redirect URI and PKCE challenge; audit gateway_sign_in - /api/gateway/v1/auth/role: role re-check; console_url sanitised in reports - sign-in page honours ?next= and explains the gateway context; gateway page links to the gateway console Gateway: - /auth/cloud/start|callback|logout, /meridian/console/sign-in-options - in-memory hashed sessions (12 h), CSRF header for cookie writes, role re-check every 5 min; operator endpoints require sign-in while connected - config: control_plane.console_sso, console_url, console_key_sign_in - console: cloud sign-in page with API keys as break-glass, account menu (name, workspace, role, Open Meridian Cloud, sign out), fleet links open Meridian Cloud Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0177yERMgobFkKXuZUcZmpwZ
Contributor
There was a problem hiding this comment.
Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.
An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Gateways connected to a Meridian Cloud workspace now offer Sign in with Meridian Cloud on their own console. Workspace members sign in with their cloud account; their workspace role sets their rights on the gateway. Previously the gateway console only accepted pasted API keys and its fleet pages couldn't reach a cloud-mode control plane.
How it works
Authorization-code flow with PKCE; Meridian Cloud is the identity provider, the gateway a confidential client.
/oauth/gateway/authorize: requires a cloud session (signed-out people sign in and return via?next=), checks membership, redirects only to theconsole_urlthe gateway reported over its token-authenticated channel (sanitised on ingest)./api/gateway/v1/auth/token: one-time, 60 s signed codes bound to workspace, gateway, redirect URI and PKCE challenge; redeemable only with that workspace's gateway token. Audit eventgateway_sign_in./api/gateway/v1/auth/role: the gateway re-checks each session's role every 5 min; removed members are signed out, role changes apply./auth/cloud/start|callback|logout,/meridian/console/sign-in-options: hashed in-memory sessions (12 h, HttpOnly, SameSite=Lax),X-Meridian-CSRFrequired for cookie-authenticated writes. Operator endpoints require sign-in while connected.control_plane.console_sso,console_url(defaulthttp://localhost:<port>),console_key_sign_in(API keys as break-glass, default on).UI
GPU nodes keep no UI of their own by design (no inbound port besides the engine); they're managed in Meridian Cloud.
Checklist
tests/control/test_gateway_sso.py(9): member sign-in + rights, non-member, redirect binding, unsafe console URLs, code binding/replay/verifier/other workspace, demotion/removal, sign-out + API-key fallback, not-yet-connectedscripts/console_demo.py --cloud: gateway → cloud sign-in → back as admin → sign outnpm run audit:ui: gateway 54 page views and cloud gateway pages clean; new sign-in screens axe-clean in light, dark, mobiledocs/CLOUD.md(Gateway console sign-in),docs/CONSOLE.md,CHANGELOG.mdGenerated by Claude Code