[CRITICAL] Implement authentication and authorization framework

[claranceliberi]

Problem Statement

The metrics agent has no authentication or authorization mechanisms, allowing any client to send metrics and access diagnostic information. This creates a significant security vulnerability where malicious actors can inject false data or extract sensitive system information.

Impact Assessment

• Severity: Critical
• Impact: Unauthorized access, data injection attacks, information disclosure
• Affected Components: All API endpoints, metric ingestion, diagnostic interfaces
• Security Risk: High - Complete bypass of access controls
• Compliance: Violates access control requirements for SOC 2, ISO 27001

Technical Details

Current State

• No authentication: All endpoints accept anonymous requests
• No authorization: No role-based access control (RBAC)
• No API keys: No mechanism to identify legitimate clients
• No audit trail: No logging of access attempts or permissions

Affected Files

• pkg/clients/tsclient/client.go - No auth headers
• pkg/clients/tsclient/writer.go - No access control
• cmd/agent/main.go - No authentication checks
• All HTTP endpoints accept unauthenticated requests

Acceptance Criteria

• Implement JWT-based authentication system
• Add API key authentication for service accounts
• Implement role-based access control (RBAC)
• Add authentication middleware for all endpoints
• Implement token refresh mechanism
• Add audit logging for all authentication events
• Support multiple authentication methods
• Add authentication configuration options

Implementation Guidelines

1. Authentication Methods:

   • JWT tokens for user authentication
   • API keys for service-to-service communication
   • Client certificates for mTLS authentication
   • Integration with external identity providers (OAuth2, SAML)

2. Authorization Framework:

type AuthConfig struct {
    Enabled        bool              `yaml:"enabled"`
    JWTSecret      string            `yaml:"jwt_secret"`
    TokenExpiry    time.Duration     `yaml:"token_expiry"`
    APIKeys        []string          `yaml:"api_keys"`
    Roles          map[string][]string `yaml:"roles"`
    RequiredScopes []string          `yaml:"required_scopes"`
}

type Permission struct {
    Resource string   `json:"resource"`
    Actions  []string `json:"actions"`
}

type Role struct {
    Name        string       `json:"name"`
    Permissions []Permission `json:"permissions"`
}

3. RBAC Implementation:
   • Roles: admin, writer, reader
   • Permissions: metrics:write, metrics:read, diagnostics:read
   • Scopes: Fine-grained access control

Security Requirements

• Token Security: Secure JWT signing and validation
• Key Management: Secure storage and rotation of secrets
• Rate Limiting: Prevent brute force attacks
• Audit Trail: Log all authentication and authorization events

Configuration Example

auth:
  enabled: true
  jwt:
    secret: "${JWT_SECRET}"
    expiry: "24h"
    refresh_enabled: true
  api_keys:
    - name: "metrics-service"
      key: "${API_KEY_METRICS}"
      roles: ["writer"]
  roles:
    admin:
      - "metrics:*"
      - "diagnostics:*"
    writer:
      - "metrics:write"
    reader:
      - "metrics:read"

Testing Requirements

• Unit tests for authentication middleware
• Integration tests with different auth methods
• Security tests for token validation
• Performance tests for auth overhead
• Penetration testing for bypass attempts

Implementation Phases

1. Phase 1: Basic JWT authentication
2. Phase 2: API key authentication
3. Phase 3: RBAC implementation
4. Phase 4: External provider integration

Related Issues

• Depends on: TLS implementation ([CRITICAL] Implement TLS/mTLS configuration for secure communications #2)
• Blocks: Audit logging implementation ([DOCUMENTATION] Comprehensive documentation and compliance framework #13)
• Related to: Configuration management
• Integrates with: Storage layer authentication ([HIGH] Implement storage persistence layer for metrics and state management #5)

Definition of Done

• JWT authentication implemented and tested
• API key authentication working
• RBAC system operational
• Authentication middleware protecting all endpoints
• Audit logging for all auth events
• Security review completed
• Performance impact < 2% overhead