ilpanich / axiam-python-sdk / 29638139048

98%

push

github

feat(tls): add client-certificate mTLS support (CONTRACT §6.1) (#11)

* feat(tls): add client-certificate mTLS support (CONTRACT §6.1)

Add optional PEM client-certificate / private-key configuration to the REST
and gRPC transports so IoT devices and service accounts can authenticate via
mutual TLS (CONTRACT.md §6.1).

- AxiamClient / AsyncAxiamClient gain additive client_cert=/client_key=
  params (PEM str or bytes), threaded into _Session.
- _Session builds a strict ssl.SSLContext (create_default_context, server
  verification unchanged) and loads the client identity via load_cert_chain
  using short-lived 0o600 temp files, unlinked once parsed into memory.
- gRPC build_channel_credentials + both authz clients accept the same
  identity, wired into grpc.ssl_channel_credentials(private_key=,
  certificate_chain=).
- Both cert and key must be supplied together (ValueError otherwise); a
  non-PEM identity is rejected at construction. Presenting a client cert never
  relaxes server verification; the private key is never logged, exposed via a
  getter, or shown in repr (§6.1 rule 3 / §7).
- Tests: end-to-end REST mTLS handshake (sync+async) against a
  CERT_REQUIRED server, str/bytes inputs, construction-error and malformed-PEM
  cases, and the gRPC credentials path. PKI generated at test time with
  cryptography (no keys/certs committed).
- Re-vendor CONTRACT.md (§6.1); README mTLS subsection + conformance note;
  CHANGELOG Unreleased entry.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FM1xTLBaGvfUv8X3bPw6oj

* test(tls): add SKI/AKI to test PKI for OpenSSL 3.x (Python 3.13) chain build

The mTLS handshake tests generate a throwaway CA + leaf certs at runtime. Under
OpenSSL 3.x (Python 3.13 CI) chain verification fails with "Missing Authority
Key Identifier" unless the CA carries a Subject Key Identifier and each leaf a
matching Authority Key Identifier. Older OpenSSL (Python 3.11) was lenient... (continued)

47 of 47 new or added lines in 4 files covered. (100.0%)

1087 of 1106 relevant lines covered (98.28%)

0.98 hits per line