ilpanich / axiam-cplusplus-sdk / 34778560658

95%

push

github

feat(pki,webauthn): sign-CSR certificates and passkey first-login setup (F-1) (#61)

Re-syncs this SDK against contract 1.45 and implements the two surfaces
it adds.

certificates().sign_csr() (§27) is generated from the re-vendored
registry like every other management operation: 159 -> 160 operations
across the same 24 namespaces. Its response is the existing Certificate
model, deliberately not GeneratedCertificate, whose private_key_pem is
mandatory and would always be absent here — the key stays with whoever
built the CSR and AXIAM never sees it.

webauthn_setup_register_start/finish (§24.1, §25.2 rule 2) are the
WebAuthn twin of mfa_setup_enroll/mfa_setup_confirm: same setup token as
their only credential, reached from the same LoginResult field, and
finish adopting a session exactly as mfa_setup_confirm does — decision
memo included, because it IS the completion of the login the tenant's
MFA policy interrupted.

§24.1's "no session credential on these two" is not free on a cookie-jar
transport. CurlTransport::perform_isolated() routes both calls onto a
fresh, unshared handle with no cookie engine, so a session cookie
already in the jar is never replayed; and because finish must still
ADOPT the session its own response sets, the Set-Cookie it receives is
merged back into the shared jar explicitly rather than relying on an
engine deliberately not there for the outgoing half. Both halves are
asserted against the real libcurl transport over a loopback socket, not
only against the in-memory fake — the fake has no jar to leak a session
out of in the first place.

Verified: ASan+UBSan and valgrind (--error-exitcode=9 --leak-check=full)
both clean over 1191 test cases / 3750 checks; plain Debug build green;
§27 drift-check, TLS-bypass gate and secret-scan gate all pass.


Claude-Session: https://claude.ai/code/session_01Kz53zeXGGKAjSNH81BZvX7

Co-authored-by: Claude <noreply@anthropic.com>

4944 of 5620 branches covered (87.97%)

Branch coverage included in aggregate %.

173 of 188 new or added lines in 4 files covered. (92.02%)

10328 of 10457 relevant lines covered (98.77%)

204.36 hits per line