boost-backend — Token exchange via RFC 8693 per-user identity delegation (issue 13 of 15)

[gabemontero]

Labels: ready-to-code
Depends on: Issue 11

Implement TokenExchangeManager for per-user Kagenti identity delegation via RFC 8693 OAuth2 Token Exchange, with graceful fallback to service-account token on all failures.

Tasks

From openspec/changes/security-safety-governance/tasks.md section 7:

• 7.1 Create TokenExchangeManager implementing RFC 8693
• 7.2 Add per-user token caching with TTL from token expiry
• 7.3 Add concurrent exchange deduplication
• 7.4 Add graceful fallback to service-account token
• 7.5 Add config schema: boost.kagenti.auth.tokenExchange.*
• 7.6 Integrate into KagentiApiClient.requestCore()
• 7.7 Extract user OIDC token from configurable request header

Specifications

• openspec/changes/security-safety-governance/specs/access-control/spec.md — Token exchange scenarios
• openspec/changes/security-safety-governance/design.md — Decision 4 (backend-only with graceful fallback)

[fullsend-ai-triage]

Triage Summary

This issue is blocked by #3307 (boost-backend-module-kagenti — Kagenti provider module).

Why it's blocked

This issue implements TokenExchangeManager for per-user identity delegation via RFC 8693, which must integrate into KagentiApiClient.requestCore() (task 7.6). The Kagenti provider module (#3307) defines the KagentiApiClient and its core request infrastructure — that module must land first before token exchange can be wired in.

When to unblock

Once #3307 is resolved, the remaining tasks (creating the TokenExchangeManager, adding per-user token caching, concurrent exchange deduplication, graceful fallback, config schema, and OIDC token extraction) can proceed.

This is issue 13 of 15 in the boost-backend series.

---

Labels: This is part of the ai-integrations workspace (boost-backend plugin for Kagenti/AI agent integration) and involves security-related token exchange.