ilpanich / axiam-kotlin-sdk / 29638218400

92%

push

github

feat: greenfield AXIAM Kotlin SDK (CONTRACT.md §1–§7, §9–§11 incl. §6.1 mTLS) (#1)

Coroutine (suspend) REST client mirroring the Java SDK's patterns:

- §1 canonical camelCase API (login/verifyMfa/refresh/logout/checkAccess/
  can/batchCheck) as suspend fns, no *Async twins; tenant required at
  construction (§5), no default tenant.
- §2 sealed AxiamException taxonomy (AuthError/AuthzError/NetworkError) with
  status mapping + header redaction; §3 CSRF echo; §4 per-client cookie jar;
  §5 X-Tenant-ID; §6 strict TLS + customCa; §6.1 mTLS client certs via OkHttp
  KeyManager; §7 Sensitive<T> over tokens + private key.
- §9 single-flight refresh (kotlinx.coroutines Mutex + shared Deferred);
  EdDSA/Ed25519 JWKS verification (nimbus-jose-jwt, alg-pinned, 300s cache).
- §10/§11 Ktor plugin (AxiamAuthentication) injecting AxiamUser + require*
  helpers + framework-free annotations; Ktor optional (compileOnly). Spring
  users reuse the Java SDK interceptor.

Build: Gradle Kotlin DSL, JVM 17, Dokka javadoc jar, Kover (91.3% line),
GPG-signed Sonatype Central Portal publish. CI: build/test/koverXmlReport,
TLS-bypass grep gate, committed-private-key scan, verify-tag-on-main, Coveralls.
47 JUnit5 tests (MockWebServer; real in-memory-PKI mTLS test, no committed keys).

Deferred follow-ups: gRPC transport and §8 AMQP (contract does not require
AMQP of the Kotlin SDK).


Claude-Session: https://claude.ai/code/session_01FM1xTLBaGvfUv8X3bPw6oj

Co-authored-by: Claude <gem-equity-crowd@duck.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

197 of 306 branches covered (64.38%)

Branch coverage included in aggregate %.

509 of 559 relevant lines covered (91.06%)

6.55 hits per line