feat: added x509 certificates logic with auth #346
+631
−10
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,64 @@ | ||
| import axios from 'axios' | ||
| import { Request as Req } from 'express' | ||
| import { Body, Controller, Get, Path, Post, Request, Route, Tags } from 'tsoa' | ||
| import { injectable } from 'tsyringe' | ||
|
|
||
| import { BadRequestError } from '../../errors' | ||
| import { fetchDedicatedX509Certificates, fetchSharedAgentX509Certificates } from '../../utils/helpers' | ||
| import { getTrustedCerts } from '../../utils/oid4vc-agent' | ||
|
|
||
| interface OrgTokenRequest { | ||
| clientId: string | ||
| clientSecret: string | ||
| } | ||
|
|
||
| interface OrgTokenResponse { | ||
| token: string | ||
| } | ||
|
|
||
| @Tags('Auth') | ||
| @Route('/v1/orgs') | ||
| @injectable() | ||
| export class AuthController extends Controller { | ||
| /** | ||
| * Generate an organization token by forwarding credentials to the platform | ||
| */ | ||
| // @Security('jwt', [SCOPES.UNPROTECTED]) | ||
| @Post('/{orgId}/token') | ||
| public async getOrgToken( | ||
| @Request() _request: Req, | ||
| @Path('orgId') orgId: string, | ||
| @Body() body: OrgTokenRequest, | ||
| ): Promise<OrgTokenResponse> { | ||
| const platformBaseUrl = process.env.PLATFORM_BASE_URL | ||
| if (!platformBaseUrl) { | ||
| throw new BadRequestError('PLATFORM_BASE_URL is not configured') | ||
| } | ||
|
|
||
| const response = await axios.post<OrgTokenResponse>( | ||
| `${platformBaseUrl}/v1/orgs/${orgId}/token`, | ||
| { clientId: body.clientId, clientSecret: body.clientSecret }, | ||
| { headers: { 'Content-Type': 'application/json', accept: 'application/json' } }, | ||
| ) | ||
|
|
||
| return response.data | ||
| } | ||
|
Comment on lines
+38
to
+45
There was a problem hiding this comment. Return the declared The method returns raw upstream payload, but the API contract declares 📦 Suggested patch- const response = await axios.post<OrgTokenResponse>(
+ const response = await axios.post<{ token?: string; data?: { access_token?: string } }>(
`${platformBaseUrl}/v1/orgs/${orgId}/token`,
{ clientId: body.clientId, clientSecret: body.clientSecret },
{ headers: { 'Content-Type': 'application/json', accept: 'application/json' } },
)
-
- return response.data
+ const token = response.data.token ?? response.data.data?.access_token
+ if (!token) throw new BadRequestError('Token not found in platform response')
+ return { token }🤖 Prompt for AI Agents |
||
| // TODO: Remove these test endpoints after manual testing is done | ||
| @Get('/test/dedicated-x509-certificates') | ||
| public async testFetchDedicatedX509Certificates(@Request() _request: Req): Promise<string[]> { | ||
| return fetchDedicatedX509Certificates() | ||
| } | ||
|
|
||
| @Get('/test/shared-agent-x509-certificates') | ||
| public async testFetchSharedAgentX509Certificates(@Request() _request: Req): Promise<string[]> { | ||
| return fetchSharedAgentX509Certificates() | ||
| } | ||
|
|
||
| /** | ||
| * [TEMP] Manually trigger getTrustedCerts to test agent type detection and trust list fetch | ||
| */ | ||
| @Get('/test/trusted-certs') | ||
| public async testGetTrustedCerts(@Request() _request: Req): Promise<string[]> { | ||
|
Comment on lines
+46
to
+61
Contributor
Author
There was a problem hiding this comment. We will remove this after testing on the instance |
||
| return getTrustedCerts() | ||
| } | ||
|
Comment on lines
+46
to
+63
There was a problem hiding this comment. Protect or remove test certificate endpoints before release. These endpoints are publicly reachable as declared and expose sensitive trust/certificate operations without authentication. 🛡️ Suggested patch-import { Body, Controller, Get, Path, Post, Request, Route, Tags } from 'tsoa'
+import { Body, Controller, Get, Path, Post, Request, Route, Security, Tags } from 'tsoa'
@@
`@Get`('/test/dedicated-x509-certificates')
+ `@Security`('jwt', ['tenant', 'dedicated'])
public async testFetchDedicatedX509Certificates(`@Request`() _request: Req): Promise<string[]> {
return fetchDedicatedX509Certificates()
}
`@Get`('/test/shared-agent-x509-certificates')
+ `@Security`('jwt', ['tenant', 'dedicated'])
public async testFetchSharedAgentX509Certificates(`@Request`() _request: Req): Promise<string[]> {
return fetchSharedAgentX509Certificates()
}
@@
`@Get`('/test/trusted-certs')
+ `@Security`('jwt', ['tenant', 'dedicated'])
public async testGetTrustedCerts(`@Request`() _request: Req): Promise<string[]> {
return getTrustedCerts()
}🧰 Tools🪛 ESLint[error] 46-46: Insert (prettier/prettier) 🤖 Prompt for AI Agents |
||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Fix
.envassignment syntax forPLATFORM_BASE_URL.The inline comment is currently part of the value, which can produce an invalid URL at runtime.
🧩 Suggested patch
📝 Committable suggestion
🧰 Tools
🪛 dotenv-linter (4.0.0)
[warning] 45-45: [SpaceCharacter] The line has spaces around equal sign
(SpaceCharacter)
[warning] 45-45: [ValueWithoutQuotes] This value needs to be surrounded in quotes
(ValueWithoutQuotes)
🤖 Prompt for AI Agents