ilpanich / axiam-csharp-sdk / 29638213578

92%

Build Type

push

github

Committed by web-flow

Commit Message

feat(tls): add client-certificate mTLS support (CONTRACT §6.1) (#14)

Add optional client-certificate / mutual-TLS (mTLS) identity support to
the C# SDK, applied to BOTH the REST and gRPC transports of the same
AxiamClient (CONTRACT.md §6.1).

- AxiamClientOptions: new ClientCertificatePem / ClientKeyPem (byte[] PEM
  cert chain + PEM PKCS#8/PKCS#1 private key) init-only properties; mirror
  on Axiam.Sdk.AspNetCore.AxiamOptions, flowed through in AddAxiam.
- AxiamHttpClientFactory.CreatePrimaryHandler (HttpClientHandler path) and
  ConfigureFactoryHandler (SocketsHttpHandler path) build the identity via
  X509Certificate2.CreateFromPem and present it (ClientCertificates /
  SslOptions.ClientCertificates). Supplying exactly one of cert/key throws
  ArgumentException at construction; non-PEM input throws a clear error.
- AxiamGrpcChannel.Create threads the same identity through the shared
  handler so gRPC presents the same client certificate as REST.
- Strict server verification is unchanged: the client-cert path is separate
  from §6's server-trust callback and adds no TLS-bypass surface (grep gate
  preserved). Private key is secret material (§7), never logged/exposed.
- Tests: handler-population, cert/key-mismatch, non-PEM, gRPC channel, and
  AspNetCore options flow-through (certs generated in-test, none committed).
- Docs: README mTLS subsection + §6.1 conformance row; CHANGELOG Unreleased.
- Re-vendor CONTRACT.md (adds §6.1).


Claude-Session: https://claude.ai/code/session_01FM1xTLBaGvfUv8X3bPw6oj

Co-authored-by: Claude <noreply@anthropic.com>

Coverage Stats

431 of 496 branches covered (86.9%)

Branch coverage included in aggregate %.

37 of 0 new or added lines in 0 files covered. (NaN%)

1 existing line in 1 file now uncovered.

1031 of 1089 relevant lines covered (94.67%)

15.71 hits per line