b45ad34169
All checks were successful
validate / JSON Schema (ajv) (push) Successful in 19s
build-images / signing-service image (push) Successful in 22s
validate / Rego (opa fmt + opa test) (push) Successful in 13s
validate / DB (migrate up/down dry-run) (push) Successful in 26s
validate / Go (vet + test) (push) Successful in 1m13s
Trivial Senken-Adapter per §7 of architecture V1.1. Accepts
{decision_id, payload_hash, payload, approval_ref, transform_ref}
on POST /api/v1/sink/dummy/deliver; calls verification-service's
/api/v1/verify/chain and branches:
- valid=true → atomic .tmp+rename write of payload to
/data/dummy-sink/<decision_id>.json, builds a
basicstack.de/attestations/handover/v1 statement, signs via
signing-service with the double identity flow (Pocket-ID bearer
+ projected SA token), submits DSSE envelope to the TLog and
returns 201 {handover_ref, log_index}.
- valid=false & replay=true → 409.
- valid=false → 403 {reasons:[…]}.
Replay protection lives in verification-service per the parent plan;
dummy-sink keeps no local replay store. The payload_hash field is
verified against both the raw and canonical form so a verifier can
reproduce either hash.
Tests use httptest-backed fakes for verify / sign / tlog and cover
the DEV-611 acceptance criteria plus the bad-request shapes:
- happy path writes the file, calls signer with the handover
statement, submits the envelope to the TLog
- 403 keeps the disk and never calls signer/tlog
- replay returns 409 without re-signing
- payload_hash mismatch rejects before verify
- malformed bodies return 400
- verify unavailable → 502, signing denied → 403
Co-Authored-By: Paperclip <noreply@paperclip.ing>
33 lines
1.3 KiB
Go
33 lines
1.3 KiB
Go
// Package auth exposes the two identity sources dummy-sink uses to call
|
|
// the signing-service:
|
|
//
|
|
// 1. Pocket-ID client_credentials access token (Authorization: Bearer …)
|
|
// 2. Projected ServiceAccount token (X-Workload-Token …) read from a
|
|
// kubelet-managed Volume (`projected: { serviceAccountToken: … }`).
|
|
//
|
|
// Both are modelled behind the same TokenSource interface so the
|
|
// orchestration code never cares about the identity's origin. The split
|
|
// mirrors services/testagent-transform/internal/auth and services/
|
|
// approval-service/internal/signer; both of those services already use
|
|
// the double-identity flow against signing-service.
|
|
package auth
|
|
|
|
import "context"
|
|
|
|
// TokenSource returns a bearer-style token. Implementations may cache
|
|
// internally; the caller is expected to retry on error.
|
|
type TokenSource interface {
|
|
Token(ctx context.Context) (string, error)
|
|
}
|
|
|
|
// StaticToken is a constant TokenSource. Primarily used in tests.
|
|
type StaticToken string
|
|
|
|
// Token returns s.
|
|
func (s StaticToken) Token(_ context.Context) (string, error) { return string(s), nil }
|
|
|
|
// TokenFunc adapts a plain function to TokenSource.
|
|
type TokenFunc func(ctx context.Context) (string, error)
|
|
|
|
// Token calls f.
|
|
func (f TokenFunc) Token(ctx context.Context) (string, error) { return f(ctx) }
|