Reference for API authentication, RBAC, and step sandboxing in DuraDX.

DuraDX provides security features for production deployments:

• API Authentication — Bearer token authentication for admin API endpoints.
• Workflow RBAC — Role-based access control for workflow operations.
• Step Sandboxing — Configuration flag for restricting shell step execution.

Set the api_auth field in your Config:

use duradx::security::ApiAuth;

let mut config = Config::new("my-app", "postgres://localhost/mydb");
config.api_auth = ApiAuth::BearerToken("my-secret-token".to_string());

When ApiAuth::BearerToken is configured, every admin API request must include:

Authorization: Bearer my-secret-token

Requests without a valid token receive 401 Unauthorized.

The health check endpoint (GET /) is exempt from authentication.

The auth middleware is implemented as an Axum layer in src/security/auth.rs. It extracts the Authorization header, validates the bearer token, and passes through on match.

use duradx::security::auth::auth_middleware;
use axum::middleware;

// Applied automatically when api_auth is configured
let app = Router::new()
    .route("/workflows", post(list_workflows))
    .layer(middleware::from_fn(auth_middleware));

Role-based access control restricts who can execute, read, cancel, or administer workflows.

Permissions are stored in the workflow_permissions table:

Primary key: (workflow_name, principal, permission).

use duradx::security::rbac::{SetPermissionInput, DeletePermissionInput};

// Grant permission
ctx.system_db().set_permission(&SetPermissionInput {
    workflow_name: "process_order".to_string(),
    principal: "team-backend".to_string(),
    permission: "execute".to_string(),
}).await?;

// Check permission
let allowed = ctx.system_db().check_permission(
    "process_order",
    "team-backend",
    "execute",
).await?;

// List permissions
let perms = ctx.system_db().list_permissions("process_order").await?;

// Revoke permission
ctx.system_db().delete_permission(&DeletePermissionInput {
    workflow_name: "process_order".to_string(),
    principal: "team-backend".to_string(),
    permission: "execute".to_string(),
}).await?;

1. Always set ApiAuth::BearerToken in production. Use a strong, randomly generated token.
2. Bind admin port to localhost or internal network. Use a reverse proxy for external access.
3. Use RBAC to restrict workflow operations to authorized teams/users.
4. Rotate tokens periodically. Update the config and restart the application.
5. Use HTTPS via a reverse proxy (nginx, Caddy) — the admin API is HTTP-only.

• Admin API — HTTP endpoints protected by auth
• Configuration — api_auth config field
• Architecture — system design and admin server