feat: local auth disabled mode and dev images

.gitguardian.yaml

@@ -3,3 +3,4 @@ version: 2
 secret:
   ignored_paths:
     - 'frontend/app/cypress/e2e/**'
+    - 'pkg/authmode/keyset/**'

.github/workflows/build.yml

@@ -68,6 +68,33 @@ jobs:
       - name: Build servers
         run: docker build -f ./build/package/servers.dockerfile . --build-arg SERVER_TARGET=engine
 
+  authdisabled:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Clone repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Build api (authdisabled)
+        run: docker build -f ./build/package/servers.dockerfile . --build-arg SERVER_TARGET=api --build-arg GO_BUILD_TAGS=authdisabled
+      - name: Build engine (authdisabled)
+        run: docker build -f ./build/package/servers.dockerfile . --build-arg SERVER_TARGET=engine --build-arg GO_BUILD_TAGS=authdisabled
+      - name: Build admin (authdisabled)
+        run: docker build -f ./build/package/servers.dockerfile . --build-arg SERVER_TARGET=admin --build-arg GO_BUILD_TAGS=authdisabled
+      - name: Build lite (authdisabled)
+        run: docker build -f ./build/package/servers.dockerfile . --build-arg SERVER_TARGET=lite --build-arg GO_BUILD_TAGS=authdisabled
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: '3.14'
+      - name: Generate docs snippets and examples
+        working-directory: frontend/snippets
+        run: python3 generate.py
+      - name: Build dashboard (authdisabled)
+        run: |
+          DOCKER_BUILDKIT=1 docker build -f ./build/package/servers.dockerfile \
+            --build-arg SERVER_TARGET=api --build-arg GO_BUILD_TAGS=authdisabled \
+            -t hatchet-api-dev-tmp .
+          DOCKER_BUILDKIT=1 docker build -f ./build/package/dashboard.dockerfile \
+            --build-arg HATCHET_API_IMAGE=hatchet-api-dev-tmp .
+
   admin:
     runs-on: ubuntu-latest
     steps:

.github/workflows/release.yaml

@@ -150,6 +150,18 @@ jobs:
             ghcr.io/hatchet-dev/hatchet/hatchet-lite:${{steps.tag_name.outputs.tag}}-arm64
 
           docker manifest push ghcr.io/hatchet-dev/hatchet/hatchet-lite:latest
+      - name: Pull and push dev images
+        run: |
+          for img in hatchet-api hatchet-engine hatchet-admin hatchet-lite hatchet-dashboard; do
+            docker pull ghcr.io/hatchet-dev/hatchet/$img-dev:${{steps.tag_name.outputs.tag}}-arm64
+            docker pull ghcr.io/hatchet-dev/hatchet/$img-dev:${{steps.tag_name.outputs.tag}}-amd64
+
+            docker manifest create ghcr.io/hatchet-dev/hatchet/$img-dev:latest \
+              ghcr.io/hatchet-dev/hatchet/$img-dev:${{steps.tag_name.outputs.tag}}-amd64 \
+              ghcr.io/hatchet-dev/hatchet/$img-dev:${{steps.tag_name.outputs.tag}}-arm64
+
+            docker manifest push ghcr.io/hatchet-dev/hatchet/$img-dev:latest
+          done
       - name: Pull and push hatchet-dashboard
         run: |
           docker pull ghcr.io/hatchet-dev/hatchet/hatchet-dashboard:${{steps.tag_name.outputs.tag}}-arm64

.pre-commit-config.yaml

@@ -26,11 +26,11 @@ repos:
         exclude: ^examples/
       - id: mixed-line-ending
         args: ["--fix=lf"]
-        exclude: ^examples/
+        exclude: (^examples/|^pkg/authmode/keyset/)
       - id: end-of-file-fixer
-        exclude: ^examples/
+        exclude: (^examples/|^pkg/authmode/keyset/)
       - id: trailing-whitespace
-        exclude: ^examples/
+        exclude: (^examples/|^pkg/authmode/keyset/)
       - id: check-yaml
         exclude: (^examples/|^cmd/hatchet-cli/cli/templates/)
   - repo: https://github.com/golangci/golangci-lint

api-contracts/openapi/components/schemas/metadata.yaml

@@ -33,6 +33,14 @@ APIMeta:
       type: boolean
       description: whether or not a Prometheus federation server is configured (SERVER_PROMETHEUS_SERVER_URL) on this instance
       example: false
+    authDisabled:
+      type: boolean
+      description: whether or not authentication is disabled (authdisabled build) on this instance
+      example: false
+    authDisabledToken:
+      type: string
+      description: the embedded worker API token, only set on authdisabled builds
+      example: eyJhbGciOiJFUzI1NiIs...
 
 APIMetaAuth:
   type: object

api/v1/server/authn/authdisabled.go

@@ -0,0 +1,26 @@
+//go:build authdisabled
+
+package authn
+
+import (
+	"net/http"
+
+	"github.com/labstack/echo/v4"
+)
+
+func (a *AuthN) authPreflight(c echo.Context) (handled bool, err error) {
+	ctx := c.Request().Context()
+
+	user, err := a.config.V1.User().GetUserByEmail(ctx, a.config.Seed.AdminEmail)
+
+	if err != nil {
+		a.l.Error().Ctx(ctx).Err(err).Msg("authdisabled: could not resolve the seeded admin user")
+
+		return true, echo.NewHTTPError(http.StatusInternalServerError, "authdisabled: could not resolve the seeded admin user; ensure the database was seeded (ADMIN_EMAIL/ADMIN_PASSWORD)")
+	}
+
+	c.Set("user", user)
+	c.Set("auth_strategy", "authdisabled")
+
+	return true, nil
+}

api/v1/server/authn/default.go

@@ -0,0 +1,9 @@
+//go:build !authdisabled
+
+package authn
+
+import "github.com/labstack/echo/v4"
+
+func (a *AuthN) authPreflight(c echo.Context) (handled bool, err error) {
+	return false, nil
+}

api/v1/server/authn/middleware.go

@@ -60,6 +60,13 @@ func (a *AuthN) authenticate(c echo.Context, r *middleware.RouteInfo) error {
 		return a.handleNoAuth(c)
 	}
 
+	// authPreflight only returns handled=true in authdisabled builds, where it resolves the
+	// request as the seeded admin and short-circuits the strategies below. In normal builds it
+	// is a no-op (returns false), so authentication always proceeds. Do not invert this check.
+	if handled, err := a.authPreflight(c); handled {
+		return err
+	}
+
 	var bearerErr error
 
 	if r.Security.BearerAuth() {

api/v1/server/authz/authdisabled.go

@@ -0,0 +1,17 @@
+//go:build authdisabled
+
+package authz
+
+import (
+	"github.com/labstack/echo/v4"
+
+	"github.com/hatchet-dev/hatchet/api/v1/server/middleware"
+)
+
+func (a *AuthZ) authPreflight(c echo.Context, r *middleware.RouteInfo) (handled bool, err error) {
+	if err := a.authorizeTenantOperations("NOAUTH", r); err != nil {
+		return true, err
+	}
+
+	return true, a.validateUserTenantPermissions(c, r)
+}

api/v1/server/authz/default.go

@@ -0,0 +1,13 @@
+//go:build !authdisabled
+
+package authz
+
+import (
+	"github.com/labstack/echo/v4"
+
+	"github.com/hatchet-dev/hatchet/api/v1/server/middleware"
+)
+
+func (a *AuthZ) authPreflight(c echo.Context, r *middleware.RouteInfo) (handled bool, err error) {
+	return false, nil
+}

api/v1/server/authz/middleware.go

@@ -48,6 +48,13 @@ func (a *AuthZ) authorize(c echo.Context, r *middleware.RouteInfo) error {
 		return nil
 	}
 
+	// authPreflight only returns handled=true in authdisabled builds, where it authorizes the
+	// request against the NOAUTH role and short-circuits the strategy switch below. In normal
+	// builds it is a no-op (returns false), so authorization always proceeds. Do not invert this.
+	if handled, err := a.authPreflight(c, r); handled {
+		return err
+	}
+
 	var err error
 
 	switch c.Get("auth_strategy").(string) {
@@ -182,7 +189,7 @@ func (a *AuthZ) validateUserTenantPermissions(c echo.Context, r *middleware.Rout
 		c.Set("tenant-member", tenantMember)
 
 		// authorize tenant operations
-		if err := a.authorizeTenantOperations(tenantMember.Role, r); err != nil {
+		if err := a.authorizeTenantOperations(string(tenantMember.Role), r); err != nil {
 			a.l.Debug().Ctx(ctx).Err(err).Msgf("error authorizing tenant operations")
 
 			return unauthorized
@@ -192,14 +199,14 @@ func (a *AuthZ) validateUserTenantPermissions(c echo.Context, r *middleware.Rout
 	return nil
 }
 
-func (a *AuthZ) authorizeTenantOperations(tenantMemberRole sqlcv1.TenantMemberRole, r *middleware.RouteInfo) error {
+func (a *AuthZ) authorizeTenantOperations(roleName string, r *middleware.RouteInfo) error {
 	// if the operation is in the allowed operations, skip the RBAC check this is needed for extensions
 	if rbac.OperationIn(r.OperationID, a.config.Auth.AllowedOperations) {
 		return nil
 	}
 
 	// at the moment, tenant members are only restricted from creating other tenant users.
-	if !a.rbac.IsAuthorized(string(tenantMemberRole), r.OperationID) {
+	if !a.rbac.IsAuthorized(roleName, r.OperationID) {
 		return echo.NewHTTPError(http.StatusUnauthorized, "Not authorized to perform this operation")
 	}
 

api/v1/server/authz/rbac.yaml

@@ -1,6 +1,8 @@
 roles:
   OWNER:
     inherits: [ADMIN]
+  NOAUTH:
+    inherits: [MEMBER]
   ADMIN:
     inherits: [MEMBER]
     permissions:

api/v1/server/handlers/metadata/get.go

@@ -4,6 +4,7 @@ import (
 	"github.com/labstack/echo/v4"
 
 	"github.com/hatchet-dev/hatchet/api/v1/server/oas/gen"
+	"github.com/hatchet-dev/hatchet/pkg/authmode"
 )
 
 func (u *MetadataService) MetadataGet(ctx echo.Context, request gen.MetadataGetRequestObject) (gen.MetadataGetResponseObject, error) {
@@ -36,6 +37,8 @@ func (u *MetadataService) MetadataGet(ctx echo.Context, request gen.MetadataGetR
 
 	prometheusServerEnabled := u.config.Prometheus.PrometheusServerURL != ""
 
+	authDisabled := authmode.IsDisabled
+
 	meta := gen.APIMeta{
 		Auth: &gen.APIMetaAuth{
 			Schemes: &authTypes,
@@ -48,6 +51,13 @@ func (u *MetadataService) MetadataGet(ctx echo.Context, request gen.MetadataGetR
 		AllowChangePassword:     &u.config.Runtime.AllowChangePassword,
 		ObservabilityEnabled:    &observabilityEnabled,
 		PrometheusServerEnabled: &prometheusServerEnabled,
+		AuthDisabled:            &authDisabled,
+	}
+
+	if authDisabled {
+		if embeddedToken := authmode.EmbeddedToken(); embeddedToken != "" {
+			meta.AuthDisabledToken = &embeddedToken
+		}
 	}
 
 	return gen.MetadataGet200JSONResponse(meta), nil