feat(server): add a session directory search issuer

charts/relayauth/templates/deployment.yaml

@@ -64,6 +64,18 @@ spec:
             - name: RELAYAUTH_ALLOW_PRIVATE_HTTP_HISTORY_ORIGIN
               value: "true"
             {{- end }}
+            {{- if (.Values.sessionDirectory).issuance }}
+            - name: RELAYAUTH_SESSION_DIRECTORY_ISSUANCE
+              value: "true"
+            {{- end }}
+            {{- with (.Values.sessionDirectory).issuer }}
+            - name: RELAYAUTH_SESSION_DIRECTORY_ISSUER
+              value: {{ . | quote }}
+            {{- end }}
+            {{- with (.Values.sessionDirectory).subjectAudiences }}
+            - name: RELAYAUTH_SESSION_DIRECTORY_SUBJECT_AUDIENCES
+              value: {{ . | quote }}
+            {{- end }}
             {{- with .Values.allowedOrigins }}
             - name: ALLOWED_ORIGINS
               value: {{ . | quote }}
@@ -84,6 +96,22 @@ spec:
             - name: RELAYAUTH_SIGNING_KEY_PEM_PREVIOUS_FILE
               value: /run/secrets/relayauth/{{ . }}
             {{- end }}
+            {{- with $keys.sessionDirectorySigningKey }}
+            - name: RELAYAUTH_SESSION_DIRECTORY_SIGNING_KEY_PEM_FILE
+              value: /run/secrets/relayauth/{{ . }}
+            {{- end }}
+            {{- with $keys.sessionDirectorySigningKeyNext }}
+            - name: RELAYAUTH_SESSION_DIRECTORY_SIGNING_KEY_PEM_NEXT_FILE
+              value: /run/secrets/relayauth/{{ . }}
+            {{- end }}
+            {{- with $keys.sessionDirectorySigningKeyPrevious }}
+            - name: RELAYAUTH_SESSION_DIRECTORY_SIGNING_KEY_PEM_PREVIOUS_FILE
+              value: /run/secrets/relayauth/{{ . }}
+            {{- end }}
+            {{- with $keys.sessionDirectoryBootstrapApiKey }}
+            - name: RELAYAUTH_SESSION_DIRECTORY_BOOTSTRAP_API_KEY_FILE
+              value: /run/secrets/relayauth/{{ . }}
+            {{- end }}
             {{- with $keys.bootstrapApiKey }}
             - name: RELAYAUTH_BOOTSTRAP_API_KEY_FILE
               value: /run/secrets/relayauth/{{ . }}

charts/relayauth/values.yaml

@@ -36,6 +36,15 @@ relayhistory:
   # https. Sets RELAYAUTH_ALLOW_PRIVATE_HTTP_HISTORY_ORIGIN=true.
   allowPrivateHttpOrigin: false
 
+# Second issuer for session directory search tokens. Off by default. Enabling it
+# needs an issuer that differs from the general one and
+# secretKeys.sessionDirectorySigningKey, or RelayAuth refuses to start.
+sessionDirectory:
+  issuance: false
+  issuer: ""
+  # Comma-separated subject token audiences. Empty means "relayhistory".
+  subjectAudiences: ""
+
 # Pre-created Secret holding keys/secrets (never rendered by this chart).
 # Each entry under secretKeys names a key inside that Secret; set an optional
 # entry to "" to leave it unconfigured. See docs/self-hosting.md.
@@ -49,6 +58,12 @@ secretKeys:
   signingKeyNext: ""
   signingKeyPrevious: ""
   bootstrapApiKey: bootstrap-api-key
+  # Session directory search issuer: a dedicated key, never a general one.
+  sessionDirectorySigningKey: ""
+  sessionDirectorySigningKeyNext: ""
+  sessionDirectorySigningKeyPrevious: ""
+  # The search minting API key, created at boot with only that scope.
+  sessionDirectoryBootstrapApiKey: ""
 
 # Extra plain environment variables, e.g. rate-limit tuning.
 extraEnv: []

docs/self-hosting.md

@@ -85,6 +85,41 @@ before it becomes the `aud`. `https` rules are unchanged. The flag widens only
 which http hosts are accepted. It does not make a public http origin acceptable,
 so turn it on only where History is reached over a trusted private network.
 
+## Session directory search issuer
+
+RelayAuth can mint 60-second tokens for one PostgREST RPC,
+`sessions.search_session_directory`, under a second issuer with its own key. The
+design is in 96BullSessions `docs/session-directory-tenant-issuer.md`. It is off
+by default.
+
+| Setting | Meaning |
+| --- | --- |
+| `RELAYAUTH_SESSION_DIRECTORY_ISSUANCE` | Exactly `true` enables minting. |
+| `RELAYAUTH_SESSION_DIRECTORY_ISSUER` | The `iss` of these tokens. Must differ from `RELAYAUTH_ISSUER`. |
+| `RELAYAUTH_SESSION_DIRECTORY_SIGNING_KEY_PEM[_FILE]` | PKCS#8 RSA key. Must not be a general signing key. |
+| `RELAYAUTH_SESSION_DIRECTORY_SIGNING_KEY_PEM_NEXT[_FILE]`, `_PREVIOUS[_FILE]` | Verify-only rotation slots, as for the general key. |
+| `RELAYAUTH_SESSION_DIRECTORY_BOOTSTRAP_API_KEY[_FILE]` | Value of the minting API key, created at boot with only the mint scope. Same rules as the bootstrap key above. |
+| `RELAYAUTH_SESSION_DIRECTORY_SUBJECT_AUDIENCES` | Accepted subject token audiences, comma-separated. Defaults to `relayhistory`. |
+
+RelayAuth refuses to start if the issuer or any key overlaps the general issuer,
+or if issuance is on without an issuer and key.
+
+`POST /v1/tokens/session-directory-search` takes `x-api-key` with a key whose
+only scope is `relayauth:assertion:create:session-directory-search`. Like every
+`relayauth:assertion:*` scope, it can only be granted by a caller holding that
+exact scope, so an org admin cannot create such a key; the first one comes from
+the bootstrap setting above. The body is
+`{ "subjectToken": "...", "workspaceId": "..." }`. The org and workspace come
+from the verified subject token, which must be an unrevoked access token with
+`rth:read`, an accepted audience and a workspace. There is no refresh token.
+
+Keys are published at `/.well-known/session-directory/jwks.json`. PostgREST reads
+its keys from `jwt-secret`, not a URL, so a rotation must update that file and
+reload PostgREST config between each step.
+
+The API key and subject token travel in the request. Do not call this endpoint
+over a plain-http in-cluster Service until RelayAuth has TLS.
+
 ## Docker
 
 Release images are published for Linux amd64 and arm64 at