ilpanich / axiam-swift-sdk / 29638221566

95%

push

github

feat: initial AXIAM Swift SDK (REST core + mTLS, CONTRACT §1–§7/§9–§11) (#1)

* feat: greenfield AXIAM Swift SDK (REST core §1–§7,§9–§11 + §6.1 mTLS)

Implements the AXIAM Swift SDK conforming to CONTRACT.md §1–§7, §9–§11
(including §6.1 mutual-TLS client certificates).

Package (SwiftPM, tools 5.9; macOS 13 / iOS 16 / Linux):
- AxiamClient actor: login/verifyMfa/refresh/logout/checkAccess/can/batchCheck
  over the /api/v1 REST surface; tokens via httpOnly cookies.
- §2 error taxonomy (AuthError/AuthzError/NetworkError) with the HTTP-status map.
- §3 CSRF capture+echo, §4 in-memory cookie jar, §5 X-Tenant-ID injection.
- §6/§6.1 TLS via AsyncHTTPClient + NIOSSL: strict verification always on,
  additive custom CA, PEM client-cert mTLS; no TLS-bypass surface.
- §7 Sensitive<T> redaction (MFA challenge token, mTLS private key).
- §9 single-flight refresh via an actor sharing one in-flight Task.
- EdDSA/Ed25519 JWKS verification with swift-crypto (300s cache, single-flight,
  alg rejected before key lookup).
- §10 framework-agnostic guard + §11 requireAuth/requireAccess/requireRole.

Chosen AsyncHTTPClient+NIOSSL over URLSession so client-cert mTLS works on Linux.

Tests (XCTest): NIO in-process HTTP server + deterministic mock transport;
covers login/mfa/refresh/logout, authz, CSRF, tenant header, cookies,
single-flight refresh (8 concurrent → 1 refresh), Sensitive, error map, config
validation, JWKS/guard. Test PKI generated at runtime (swift-crypto/openssl);
no private keys committed.

Packaging/docs/CI: podspec (1.0.0-alpha8), README (+ conformance & scope note),
CHANGELOG, DocC catalog, sdk-ci-swift.yml (build/test + TLS-bypass &
secret-scan & verify-tag-on-main gates), coverage.yml (llvm-cov → Coveralls).

Deferred follow-ups: gRPC transport, §8 AMQP HMAC (not listed for Swift),
first-party AxiamVapor product (documented Vapor wiring instead).

Vendors CONTRACT.md, openapi.json, proto/ from the platform repo.

Co-Authored-By: Claude Opus 4.8 <norep... (continued)

669 of 707 new or added lines in 11 files covered. (94.63%)

669 of 707 relevant lines covered (94.63%)

15.98 hits per line