feat(casan): establish assurance kernel and harden control plane

docker-compose.control-panel.local.yml

@@ -11,7 +11,12 @@ services:
     environment:
       CASAN_PROFILE: prod
       CASAN_CP_STRICT: "1"
-      CASAN_CP_TRUST_AUTH_PROXY: "1"
+      CASAN_CP_AUTH_MODE: jwt
+      CASAN_CP_JWT_ISSUER: http://localhost:18082
+      CASAN_CP_JWT_AUDIENCE: casan-control-panel
+      CASAN_CP_JWT_PUBLIC_KEY_FILE: /run/casan-idp/idp-public.pem
+      CASAN_CP_JWT_ROLE_CLAIM: groups
+      CASAN_CP_JWT_CLOCK_SKEW_SECONDS: "30"
       CP_BIND: 0.0.0.0
       CP_PORT: "3010"
       CASAN_APP_ROOT: /app
@@ -63,6 +68,7 @@ services:
       - ./apps/service-desk:/app/apps/service-desk
       - ./apps/projects:/app/apps/projects
       - ./packages/casan-harness/config/project-registry.json:/app/packages/casan-harness/config/project-registry.json
+      - ./tmp/control-panel-local/idp-public.pem:/run/casan-idp/idp-public.pem:ro
     expose:
       - "3010"
     networks:
@@ -111,8 +117,8 @@ services:
       - --oidc-groups-claim=groups
       - --reverse-proxy=true
       - --set-xauthrequest=true
-      - --pass-access-token=false
-      - --pass-authorization-header=false
+      - --pass-access-token=true
+      - --pass-authorization-header=true
       - --skip-provider-button=true
       - --ssl-insecure-skip-verify=true
     expose:
@@ -129,7 +135,10 @@ services:
       CASAN_IDP_SUB: oidc-ops
       CASAN_IDP_EMAIL: oidc-ops@example.com
       CASAN_IDP_GROUPS: casan-org-admin,casan-approver,casan-project:AINative_OKR_CASAN4
+      CASAN_IDP_PRIVATE_KEY_FILE: /run/casan-idp/idp-private.pem
       CASAN_APPROVAL_SIGNER_TOKEN: ${CASAN_APPROVAL_SIGNER_TOKEN:-local-approval-signer-secret}
+    volumes:
+      - ./tmp/control-panel-local/idp-private.pem:/run/casan-idp/idp-private.pem:ro
     ports:
       - "18082:8080"
     networks: