ilpanich / axiam-java-sdk / 29638217438

91%

push

github

feat(tls): add client-certificate mTLS support (CONTRACT §6.1) (#18)

Add an optional client-side X.509 identity (PEM certificate chain + PKCS#8
private key) applied to both the REST and gRPC transports:

- AxiamClient.Builder.clientCertificate(byte[] certPem, byte[] keyPem): parses
  the cert chain (X.509) and the PKCS#8 key (RSA/EC/Ed25519 auto-detected) into
  an in-memory PKCS#12 key store and passes the resulting KeyManager[] as the
  first arg to SSLContext.init(...). Both-or-neither is validated at build()
  (IllegalArgumentException); malformed PEM fails at construction (NetworkError).
  Server verification (system trust store + optional customCa) is unchanged.
- AuthClientInterceptor.channelBuilder(target, customCa, clientCert, clientKey)
  and a matching GrpcAuthzClient constructor overload feed the same identity to
  Netty via GrpcSslContexts.keyManager(...).
- The private key is secret material (§7): consumed into the key store, never
  retained on a client field, and never exposed via a getter/toString/logs.

Also fix a pre-existing latent bug surfaced by the first real HTTPS-through-SDK
test: the REST client overrode OkHttp's hostname verifier with
HttpsURLConnection.getDefaultHostnameVerifier(), an always-reject verifier that
failed verification for every host. It now uses OkHttp's built-in strict
OkHostnameVerifier (full SAN/CN matching).

Tests: real end-to-end mTLS via MockWebServer.requireClientAuth() (handshake
succeeds only when the client presents its cert; fails without it), plus
construction-validation and gRPC keyManager-path tests. All PKI is generated at
test time (keytool + in-memory KeyStore) — no key material is committed.
226 tests pass; JaCoCo line coverage floor (0.92) met; javadoc and TLS-bypass
gates pass. CONTRACT.md re-vendored; README + CHANGELOG updated.


Claude-Session: https://claude.ai/code/session_01FM1xTLBaGvfUv8X3bPw6oj

Co-authored-by: Claude <noreply@anthropic.com>

384 of 451 branches covered (85.14%)

Branch coverage included in aggregate %.

1051 of 1122 relevant lines covered (93.67%)

4.07 hits per line