ilpanich / axiam-go-sdk / 29638082856

95%

push

github

feat(tls): add client-certificate mTLS support (CONTRACT §6.1) (#10)

Add axiam.WithClientCertificate(certPEM, keyPEM []byte) so the SDK can
present an X.509 client identity for mutual TLS, applied to BOTH the REST
transport and any gRPC channel of the same logical client (CONTRACT.md
§6.1). An invalid cert/key pair is a construction-time error from
NewClient, matching WithCustomCA. The private key is held behind the
Sensitive type (§7): never logged/displayed and no public getter.

Server verification is never relaxed — the mTLS identity is a separate
code path from the RootCAs/verification config, the TLS-1.3 floor is
unchanged, and no TLS-bypass surface is introduced.

grpc.NewTLSCredentials now also accepts the client cert/key PEMs so the
same identity is presented over gRPC. Tests generate all PKI in-process
(no committed keys/certs) and cover a real end-to-end mTLS handshake on
both REST (httptest RequireAndVerifyClientCert) and gRPC (a real server
requiring client auth), plus construction-time parse-error cases.


Claude-Session: https://claude.ai/code/session_01FM1xTLBaGvfUv8X3bPw6oj

Co-authored-by: Claude <noreply@anthropic.com>

20 of 20 new or added lines in 2 files covered. (100.0%)

1836 of 1935 relevant lines covered (94.88%)

524.87 hits per line