PAT-2167 Apps Proxy preview links (2/3): link verification and session cookie

[pepamartinec]

Release Notes

https://linear.app/keboola/issue/PAT-2167
Depends on #2662

Part 2 of 3: link verification, the session cookie and the landing page. Nothing is wired into request handling yet.

Decisions a reviewer might otherwise question:

• sub is compared byte-exact to apps-proxy's own canonical origin; the untrusted sub is never parsed. sandboxes-service emits https://<lowercase host> with no port or slash, so anything else is not a link we minted.
• The session check has no WithIssuedAt(). iat is floored to the second, so a replica whose clock is a few ms behind would reject a fresh cookie. exp and the 12 h cap stay strict.
• The cookie is re-issued once it is 5 min old, not after half the idle time. Otherwise the real idle timeout would be 2–4 h instead of 4 h.
• The redeem check uses Sec-Fetch-Site, not Origin: the landing page sends no-referrer, so Chrome posts with Origin: null.
• The landing page stays blank while it submits; text appears only without JavaScript or without a token.

• Part 3: PAT-2167 Apps Proxy preview links (3/3): routing, session gate and docs #2661

Plans for customer communication

None.

Impact analysis

No impact. The new code is not called yet.

Change type

New feature

Justification

Let agents and the kbc-ui iframe open dev-mode apps through a short-lived signed link instead of the kai-preview handshake.

Deployment

Merge & automatic deploy.

Rollback plan

Revert of this PR.

Post release support plan

None.

[linear-code]

PAT-2167

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[keboola-pr-reviewer-bot]

Verdict: needs_human (risk 3/5) · profile psgo

Needs human: security-sensitive auth code (preview-link JWT verification + session cookies) in the load-bearing apps-proxy.

Concerns:

• internal/pkg/service/appsproxy/proxy/apphandler/authproxy/preview/link.go: New signed preview-link JWT verifier for apps-proxy — auth-critical, needs security review.
• internal/pkg/service/appsproxy/proxy/apphandler/authproxy/preview/session.go: New HS256 session-cookie issue/check logic; verify sliding/hard-cap and cookie flags.
• internal/pkg/service/appsproxy/proxy/apphandler/authproxy/preview/redeem.go: CSRF defense relies solely on Sec-Fetch-Site same-origin; confirm header cannot be spoofed.

Suggested reviewers: @, this PR needs a human reviewer because it adds signed preview-link verification and session-cookie auth to apps-proxy (policy: Auth & credentials + load-bearing apps-proxy auth). Please assign an on-rotation PSGO teammate via the Reviewers panel.

[Matovidlo]

LGTM