AMCERTS-155 - Add `auth` to certs by nyagamunene · Pull Request #156 · absmach/certs

nyagamunene · 2025-09-05T08:13:05Z

What type of PR is this?

What does this do?

Which issue(s) does this PR fix/relate to?

Related Issue Feature: Add auth to certs #155
Resolves Feature: Add auth to certs #155

Have you included tests for your changes?

Did you document any new/modified features?

Notes

SammyOina · 2025-09-10T07:40:04Z

 		}

-		cert, err := svc.IssueFromCSR(ctx, req.entityID, req.ttl, certs.CSR{CSR: []byte(req.CSR)})
+		session, ok := ctx.Value(api.SessionKey).(authn.Session)


let's have a new issue form csr issuefromcsrInternal and have the auth be from a token defined in env, this is to be used in agent

SammyOina · 2025-09-10T07:43:15Z

 			return fileDownloadRes{}, err
 		}
-		cert, ca, err := svc.RetrieveCert(ctx, req.token, req.id)
+


download cert was using the internly generated token from requestdownloadtoken, so this should not be the case

SammyOina · 2025-09-10T07:43:54Z

 			return nil, err
 		}

+		session, ok := ctx.Value(api.SessionKey).(authn.Session)


ocsp endpoint is supposed to be unsecured so remove auth

Same with csr endpoint @nyagamunene

csr should not require domainID in the url @nyagamunene

#156 (comment)

SammyOina · 2025-09-10T07:45:51Z

 		}

-		cert, err := svc.GetChainCA(ctx, req.token)
+		session, ok := ctx.Value(api.SessionKey).(authn.Session)


same for download ca, we generate a token in getDownloadCAToken endpoint, so this is supposed to be the only auth not mg token

SammyOina · 2025-09-16T11:47:55Z

+        location ~ ^/(pats) {
+            include snippets/proxy-headers.conf;
+            add_header Access-Control-Expose-Headers Location;
+            proxy_pass http://auth:${SMQ_AUTH_HTTP_PORT};


these are supermq files, why do we need them here?

SammyOina · 2025-09-16T11:48:53Z

+definition user {}
+
+
+definition role {


same here, we don't need to copy supermq docker. just document how it can be used with supermq, or update supermq docker to include it

We are handling auth just like we do in billing. So should we completely remove supermq and just have the env variables in certs env file. supermq-auth and certs are communicating via gRPC will it not cause issues?

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

nyagamunene force-pushed the add_auth_to_certs branch from da233fd to e98f65b Compare September 5, 2025 14:09

nyagamunene marked this pull request as ready for review September 8, 2025 17:18

SammyOina suggested changes Sep 10, 2025

View reviewed changes

nyagamunene force-pushed the add_auth_to_certs branch 2 times, most recently from c7096d7 to 80ca179 Compare September 11, 2025 15:23

SammyOina mentioned this pull request Sep 15, 2025

NOISSUE - Update cocos to match certs changes ultravioletrs/cocos#520

Merged

SammyOina suggested changes Sep 16, 2025

View reviewed changes

WashingtonKK suggested changes Sep 16, 2025

View reviewed changes

Comment thread service.go

WashingtonKK previously approved these changes Sep 16, 2025

View reviewed changes

nyagamunene dismissed WashingtonKK’s stale review via cad1686 September 17, 2025 08:57

nyagamunene added 19 commits September 17, 2025 13:41

initial implementation

7fa2c3b

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

update libraries

52606da

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

update go.mod and go.sum

1905992

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

update docker compose

78da319

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

add auth in endpoints

c79c8d6

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

remove spicedb file

0c5a8a6

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

add supermq docker

f4780d1

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

update supermq compose

9ff16f9

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

update sdk and its tests

f9b95be

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

fix failing linter

d2d5bf4

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

fix failing linter

2b8c56f

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

remove unused code

127ca13

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

fix failing linter

55308be

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

remove debug logs

b8f4855

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

update tests

07d7e65

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

update mock file

56b74b5

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

update failing linter

3c9b63c

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

fix tests

e91befd

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

remove comment

bfd8195

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

nyagamunene added 17 commits September 17, 2025 13:42

add issuerfromcsrInternal

7d5b00a

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

address comments

c26c097

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

fix failing linter

d0230ee

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

fix failing linter

dd9edec

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

remove unused code

ad3bbf5

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

fix generated files

ac6842c

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

fix tests

ea52ca6

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

fix service tests

6964a90

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

fix failing linter

fc3cfd8

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

rename files

a7f4583

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

address comments

53cca49

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

fix failing linter

e317ab9

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

fix failing linter

f0eb676

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

fix failing linter

1c74f11

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

remove supermq docker compose

206071d

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

remove unused script

8f9f903

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

add license headers

10e7570

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

nyagamunene force-pushed the add_auth_to_certs branch from cad1686 to 10e7570 Compare September 17, 2025 10:44

WashingtonKK previously approved these changes Sep 17, 2025

View reviewed changes

dborovcanin suggested changes Sep 17, 2025

View reviewed changes

Comment thread api/http/transport.go Outdated

Comment thread api/http/transport.go Outdated

Comment thread api/http/common.go

address comments

87735c8

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

nyagamunene dismissed WashingtonKK’s stale review via 87735c8 September 17, 2025 10:56

fix failing linter

ae9feec

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

dborovcanin reviewed Sep 17, 2025

View reviewed changes

Comment thread api/http/transport.go Outdated

nyagamunene added 2 commits September 17, 2025 14:16

fix mux initialization

9daf0e4

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

fix sdk tests

e96be86

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

dborovcanin approved these changes Sep 17, 2025

View reviewed changes

dborovcanin merged commit 8f5858c into absmach:main Sep 17, 2025
3 checks passed

		definition user {}


		definition role {

Uh oh!

Conversation

nyagamunene commented Sep 5, 2025

What type of PR is this?

What does this do?

Which issue(s) does this PR fix/relate to?

Have you included tests for your changes?

Did you document any new/modified features?

Notes

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants