prisma-risk / tsoracle / 26428206571

95%

Build Type

push

github

Committed by web-flow

Commit Message

fix(standalone): require mTLS for non-loopback admin gRPC bind (#462)

The membership-admin gRPC surface introduced in #453 was unauthenticated:
any client reaching --admin-listen could AddLearner / Promote / RemoveNode
and take over openraft membership. This change:

- adds --admin-tls-{cert,key,ca} to `serve openraft` for the server side
  (eager-validated AdminTlsMaterial mirrors peer_tls.rs)
- adds --client-tls-{cert,key,ca} to `tsoracle admin` for operator dial,
  plus a scheme-preserving leader-hint redirect (was hard-coded http://)
- refuses to bind a non-loopback --admin-listen without admin TLS
  (loopback plaintext is still allowed for local dev), with the guard
  hoisted to the top of build_openraft so a misconfigured deployment
  fails fast — before opening RocksDB, constructing Raft, binding the
  peer port, or running initialize()
- rejects pointing --peer-tls-ca and --admin-tls-ca at the same CA file
  (canonicalized path AND byte-content compare); operator remains
  responsible for issuing the two CAs from independent chains, which
  is documented on AdminTlsConfig
- exposes Standalone::admin_listen_addr() so the OS-picked port from
  bind(":0") is observable to callers/tests

Coverage Stats

112 of 122 new or added lines in 6 files covered. (91.8%)

14 existing lines in 1 file now uncovered.

12289 of 12889 relevant lines covered (95.34%)

461366.65 hits per line