ilpanich / axiam-rust-sdk / 29638214857

94%

Build Type

push

github

Committed by web-flow

Commit Message

feat(tls): add client-certificate mTLS support (CONTRACT §6.1) (#18)

Add opt-in mutual-TLS client-certificate authentication to both the REST
and gRPC transports, per the newly re-vendored CONTRACT.md §6.1.

- `AxiamClient::builder().with_client_cert(cert_pem, key_pem)` accepts a PEM
  cert chain + PEM private key, validated eagerly (malformed PEM -> AxiamError
  at construction). The key is retained behind `Sensitive<Vec<u8>>` and never
  exposed via getter/Debug/log.
- REST: builds a `reqwest::Identity` (cert chain + key concatenated into the
  single buffer `Identity::from_pem` expects) and applies it via
  `ClientBuilder::identity`. No new reqwest feature needed — the existing
  `rustls` feature already provides `Identity`.
- gRPC: `GrpcChannelConfig` gains `client_cert_pem` + `client_key` fields;
  `build_channel` applies `ClientTlsConfig::identity(Identity::from_pem(...))`.
  `AxiamClient::grpc_channel_config()` threads the same identity (and custom
  CA) from the REST client to the gRPC transport (§6.1 rule 4).
- Strict server verification is never weakened; the client-cert path is kept
  separate from `with_custom_ca` (§6.1 rule 2, TLS-bypass lint untouched).
- Tests generate throwaway PKI at runtime with the `rcgen` dev-dependency —
  no private key is committed. Covers accept/reject/build/grpc-identity/redaction.
- README mTLS subsection + conformance now "(including §6.1 mTLS)"; CHANGELOG
  Added entry.


Claude-Session: https://claude.ai/code/session_01FM1xTLBaGvfUv8X3bPw6oj

Co-authored-by: Claude <noreply@anthropic.com>

Coverage Stats

45 of 48 new or added lines in 2 files covered. (93.75%)

19 existing lines in 2 files now uncovered.

2694 of 2916 relevant lines covered (92.39%)

6.94 hits per line