CTO
|
69b3f3012f
|
services: add transparency-log Go service (ADR-0005 POST /api/v1/log/entries)
validate / Rego (opa fmt + opa test) (push) Successful in 14s
validate / JSON Schema (ajv) (push) Successful in 20s
validate / Go (vet + test) (push) Successful in 20s
- services/transparency-log/pkg/backend: Backend interface with in-memory
append-log (RFC 6962 Merkle tree) + Trillian wrapper (prod stub).
- Idempotenz-Pflicht: Wiederaufruf mit identischem content_hash liefert
200 + gleichen log_index + aktuellen inclusion_proof.
- content_hash-Verifikation serverseitig; Mismatch → 409.
- pkg/httpapi: ADR-0005-konformer Handler (201/200/400/404/409/503).
- cmd/transparency-log: minimaler HTTP-Server, memory default,
--backend trillian als Stub (503).
- Interop-Test in services/admin-api/internal/tlog/interop_test.go
fährt die echte transparency-log pkg gegen die admin-api
HTTPSubmitter — Happy-Path, Idempotenz und content_hash-Mismatch
abgedeckt.
- go test: 10 Tests transparency-log + 2 Interop-Tests admin-api, go
vet clean in beiden Modulen.
Folge-Subtask: Trillian-Deployment + Keys (siehe ADR-0005 Open Points).
Co-Authored-By: Paperclip <noreply@paperclip.ing>
|
2026-10-25 18:08:53 +00:00 |
|
CTO (Paperclip)
|
be3ac9cdb8
|
admin-api: Pocket-ID client_credentials TokenSource with OIDC discovery + cache (replaces StaticToken in prod)
validate / JSON Schema (ajv) (push) Successful in 20s
validate / Go (vet + test) (push) Successful in 19s
validate / Rego (opa fmt + opa test) (push) Successful in 13s
* services/admin-api/internal/attest/pocket_id_token_source.go — attest.TokenSource impl: OIDC discovery via /.well-known/openid-configuration, HTTP Basic client_credentials grant, mutex-guarded in-memory token cache with configurable RefreshLeeway (default 30s = "verwirft bei exp-30s" from DEV-602).
* services/admin-api/internal/attest/pocket_id_token_source_test.go — 10 subtests against an httptest OIDC mock: happy path, cache hold, exp-30s refresh boundary, optional scope/audience, bad creds (401), missing config, discovery failures, non-positive expires_in, type-conformance.
* services/admin-api/cmd/admin-api/main.go — buildTokenSource(): -bearer flag wins (dev), else -oidc-issuer + POCKET_ID_CLIENT_ID + POCKET_ID_CLIENT_SECRET env → PocketIDTokenSource (prod); hard-fail at startup if issuer is set but credentials are missing. New flags -pocket-id-scope / -pocket-id-audience for the client_credentials request.
* services/admin-api/README.md — split inbound/outbound Pocket-ID auth, document the admin-api OIDC client registration (UI + API), new flags, env vars, prod bootstrap example.
36/36 go tests pass, go vet clean.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
|
2026-10-25 18:04:00 +00:00 |
|