ilpanich / axiam-go-sdk / 34778552691

95%

push

github

Contract 1.45: setup-token passkey enrolment and CSR-signed certificates (#78)

* feat(auth,certificates): sign-CSR certificates and passkey first-factor setup (F-1)

Fan-out of AXIAM's mfa-first-login-and-csr-issuance-plan.md items C-1 and
M-3, re-vendoring contract 1.45 from ilpanich/axiam@3d5b279.

C-1 — certificates.sign_csr (mechanical). Ran
internal/cmd/genmanagement against the re-vendored management-registry.json
and openapi.json: it emitted Certificates().SignCSR, the
SignCertificateCSRRequest model, and updated the generated surface test's
operation count (159 -> 160) on its own — nothing here was hand-written.
Its response type is the plain Certificate, not GeneratedCertificate,
because AXIAM never sees the caller's key; a new hand-written test
(TestManagement_SignCSRReturnsNoPrivateKeyField) pins that structurally,
by reflecting over Certificate's fields, rather than by checking an empty
string a server could still satisfy.

M-3 — WebauthnSetupRegisterStart / WebauthnSetupRegisterFinish (mirror,
with one real design problem). These are the setup-token twins of
WebauthnRegisterStart/Finish, reached exactly like MfaSetupEnroll /
MfaSetupConfirm when Login answers MFASetupRequired. CONTRACT.md §24.1 is
explicit that the pair takes no session and that an SDK "MUST NOT attach
its session credential" to either call, however the client is otherwise
configured.

That turned out not to be free in this SDK: net/http.Client attaches
every cookie-jar cookie matching the request URL unconditionally whenever
a Jar is set, with no per-request opt-out and no way to suppress it by
setting a Cookie header manually (the jar's cookies are appended on top,
not skipped). Reaching the requirement needed a real mechanism, not just
skipping a helper call:

  - sessionlessWebauthnPost bypasses doRequest/decorateRequest (the choke
    point that echoes a captured CSRF token and attaches an adopted
    LoginClientCredentials bearer token) and sends through a throwawa... (continued)

93 of 101 new or added lines in 2 files covered. (92.08%)

8334 of 8824 relevant lines covered (94.45%)

267.41 hits per line