feat(cardinal): authenticate game tokens scoped to organization/project by ryanditjia · Pull Request #1004 · Argus-Labs/world-engine

ryanditjia · 2026-09-22T08:03:13Z

Cardinal authenticates commands, queries, and event streams with a game token from Argus Auth, and identifies the caller by the stable player ID in its sub claim. A guest who later saves progress to an account keeps the same ID, so game state keyed by it carries over.

Companion to monorepo #778, which issues these tokens. Design: ADR-068.

What changes

Token validation. A token must be signed by Auth's keys (EdDSA, fetched from <auth URL>/auth/jwks), be unexpired, have a non-empty sub, and have aud equal to the shard's organization/project. Tokens for another game and ordinary account tokens are rejected. The issuer is not checked: there is one issuer, and its public URL differs from the in-cluster URL Cardinal uses.
User becomes Player. PlayerFromContext replaces UserFromContext. Game systems still read the caller from cmd.Persona, which now carries the player ID; the wire field is not renamed here.
Dev mode. With CARDINAL_AUTH_MODE=DEV, the caller is taken from the X-Player-ID header (was X-Email).
CLI MCP. send_command sends X-Player-ID, from a new player_id argument that defaults to mcp-dev-player.
Docs. docs/cardinal/client-integration.mdx shows the Unity SDK 0.5 auth API.

Rollout

Deploy Auth from #778 first. A game moves to this engine release and Unity SDK 0.5 together: clients on the older SDK send tokens this version rejects.

Verification

go test ./pkg/cardinal/... ./cli/... passes after rebasing onto main.
Tests cover an untrusted signature, a non-EdDSA algorithm, a wrong or missing audience, a missing or past expiry, a missing subject, and the dev header.

Known limitation

Expiry is checked when a request or stream starts. An already-open stream is not cut off at expiry; the Unity SDK closes it client-side.

🤖 Generated with Claude Code

claude · 2026-09-22T08:03:33Z

Code Review in progress

Gather context (diff, CLAUDE.md, related files)
Review auth changes in pkg/cardinal/service.go
Review tests
Post findings

View job run · ryandi/game-player-auth

cubic-dev-ai

Review completed against the latest diff

_{Shadow auto-approve: would not auto-approve because issues were found.

Re-trigger cubic}

cubic-dev-ai

All reported issues were addressed across 3 files

_{Shadow auto-approve: would not auto-approve because issues were found.

Re-trigger cubic}

cubic-dev-ai

All reported issues were addressed across 2 files (changes from recent commits).

_{Shadow auto-approve: would not auto-approve because issues were found.

Re-trigger cubic}

cubic-dev-ai

0 issues found across 4 files (changes from recent commits).

_{Shadow auto-approve: would not auto-approve. Auto-approval skipped because cubic reviewed only this push, not the earlier force-push. Comment @cubic review to review the whole pull request.

Re-trigger cubic}

codecov · 2026-10-02T13:53:55Z

❌ 1 Tests Failed:

Tests completed	Failed	Passed	Skipped
1665	1	1664	7

View the top 1 failed test(s) by shortest run time

github.com/argus-labs/world-engine/pkg/cardinal::TestAuthenticatorArgusAcceptsGamePlayerToken

Stack Traces | 0s run time

=== RUN   TestAuthenticatorArgusAcceptsGamePlayerToken
    auth_internal_test.go:23: 
        	Error Trace:	.../pkg/cardinal/auth_internal_test.go:23
        	Error:      	Received unexpected error:
        	            	HTTP error: 404 - 404 Not Found
        	            		cardinal.TestAuthenticatorArgusAcceptsGamePlayerToken:.../pkg/cardinal/auth_internal_test.go:22
        	            		cardinal.newAuthenticatorArgus:.../pkg/cardinal/service.go:758
        	Test:       	TestAuthenticatorArgusAcceptsGamePlayerToken
--- FAIL: TestAuthenticatorArgusAcceptsGamePlayerToken (0.00s)

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}

cubic-dev-ai

All reported issues were addressed across 6 files (changes from recent commits).

_{Shadow auto-approve: would not auto-approve because issues were found.
Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic}

cubic-dev-ai

All reported issues were addressed across 2 files (changes from recent commits).

_{Shadow auto-approve: would not auto-approve because issues were found.
Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic}

cubic-dev-ai

All reported issues were addressed across 1 file (changes from recent commits).

_{Shadow auto-approve: would not auto-approve because issues were found.
Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic}

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Shards reach Auth through an internal URL that differs from the public issuer. Signature, audience, and expiry still bind the token to Auth and this project. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

…DK API Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

cubic-dev-ai

0 issues found across 2 files (changes from recent commits).

_{Shadow auto-approve: would not auto-approve. Auto-approval skipped because cubic reviewed only this push, not the earlier force-push. Comment @cubic review to review the whole pull request.

Re-trigger cubic}

… SDK 0.4" This reverts commit 1289c71. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

cubic-dev-ai

0 issues found across 2 files (changes from recent commits).

_{Shadow auto-approve: would not auto-approve. Auto-approval skipped because cubic reviewed only this push, not the earlier force-push. Comment @cubic review to review the whole pull request.

Re-trigger cubic}

…rom shard addresses Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

cubic-dev-ai

0 issues found across 1 file (changes from recent commits).

_{Shadow auto-approve: would not auto-approve. Auto-approval skipped because cubic reviewed only this push, not the earlier force-push. Comment @cubic review to review the whole pull request.

Re-trigger cubic}

…erves Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

cubic-dev-ai

0 issues found across 1 file (changes from recent commits).

_{Shadow auto-approve: would not auto-approve. Auto-approval skipped because cubic reviewed only this push, not the earlier force-push. Comment @cubic review to review the whole pull request.

Re-trigger cubic}

cubic-dev-ai Bot reviewed Sep 22, 2026

View reviewed changes

Comment thread pkg/cardinal/auth_internal_test.go

Comment thread pkg/cardinal/service.go

cubic-dev-ai Bot reviewed Sep 22, 2026

View reviewed changes

Comment thread pkg/cardinal/auth_internal_test.go

Comment thread pkg/cardinal/auth_internal_test.go

Comment thread pkg/cardinal/service.go

cubic-dev-ai Bot reviewed Sep 24, 2026

View reviewed changes

Comment thread pkg/cardinal/service.go

ryanditjia changed the title ~~feat(cardinal): authenticate stable game player identities~~ feat(cardinal): authenticate players with game-scoped access tokens Sep 24, 2026

ryanditjia force-pushed the ryandi/game-player-auth branch from eafce1b to 949b9ec Compare September 29, 2026 16:13

ryanditjia changed the title ~~feat(cardinal): authenticate players with game-scoped access tokens~~ feat(auth): add game player tokens and renewable CLI sessions Sep 29, 2026

ryanditjia changed the title ~~feat(auth): add game player tokens and renewable CLI sessions~~ feat(cardinal): authenticate game tokens scoped to organization/project Oct 1, 2026

cubic-dev-ai Bot reviewed Oct 1, 2026

View reviewed changes

ryanditjia force-pushed the ryandi/game-player-auth branch from 9ac3b9a to e2cb5e4 Compare October 1, 2026 16:52

cubic-dev-ai Bot reviewed Oct 2, 2026

View reviewed changes

Comment thread docs/cardinal/client-integration.mdx Outdated

cubic-dev-ai Bot reviewed Oct 2, 2026

View reviewed changes

Comment thread pkg/cardinal/service.go

cubic-dev-ai Bot reviewed Oct 3, 2026

View reviewed changes

Comment thread docs/cardinal/client-integration.mdx

ryanditjia and others added 11 commits October 4, 2026 19:58

feat(cardinal): authenticate game player tokens

b091f16

chore(cardinal): satisfy auth lint checks

a6898f0

feat(cardinal): scope player tokens to organization and project

54bb94d

chore(cardinal): remove stray persona comment

70f5a2f

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

fix(cardinal): stop checking the game token issuer

fea3dff

Shards reach Auth through an internal URL that differs from the public issuer. Signature, audience, and expiry still bind the token to Auth and this project. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

fix(cli): send the player ID header for MCP dev auth

9875831

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

fix(cardinal): keep trimming trailing slashes from the auth URL

f7606d1

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

refactor(cardinal): match main's JWKS URL and fix the test instead

60563f4

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs(cardinal): update Unity auth and shard examples to the current S…

f709ac4

…DK API Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

test(cardinal): use Player in the reply-waiter test added on main

d24e1f6

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docs(cardinal): show the Unity AuthResult enum and synchronous sign-out

820fd5d

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

ryanditjia force-pushed the ryandi/game-player-auth branch from 3254b70 to 820fd5d Compare October 4, 2026 13:00

rmrt1n approved these changes Oct 5, 2026

View reviewed changes

feat(cardinal): keep accepting legacy login tokens from Unity SDK 0.4

1289c71

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

cubic-dev-ai Bot reviewed Oct 5, 2026

View reviewed changes

Revert "feat(cardinal): keep accepting legacy login tokens from Unity…

4c52186

… SDK 0.4" This reverts commit 1289c71. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

cubic-dev-ai Bot reviewed Oct 5, 2026

View reviewed changes

ryanditjia mentioned this pull request Oct 5, 2026

fix(cardinal): check and update event subscriptions under one lock #1061

Open

docs(cardinal): set the game in the Unity client config and drop it f…

b177cf2

…rom shard addresses Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

cubic-dev-ai Bot reviewed Oct 5, 2026

View reviewed changes

docs(cardinal): drop Unity entity queries, which Cardinal no longer s…

c240854

…erves Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

cubic-dev-ai Bot reviewed Oct 5, 2026

View reviewed changes

Conversation

ryanditjia commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What changes

Rollout

Verification

Known limitation

Uh oh!

claude Bot commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review in progress

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

codecov Bot commented Oct 2, 2026

❌ 1 Tests Failed:

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ryanditjia commented Sep 22, 2026 •

edited

Loading

claude Bot commented Sep 22, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading