ilpanich / axiam-rust-sdk / 34778564413

94%

push

github

feat(pki,webauthn): certificates.sign_csr and the passkey setup pair (contract 1.45) (#105)

* feat: certificates.sign_csr and the webauthn setup pair (contract 1.45)

Re-vendors CONTRACT.md, openapi.json, management-registry.json and proto/
from axiam at 3d5b279 (contract 1.45) and implements this SDK's share of
the two additive operations it introduces.

C-1, the mechanical half: `certificates.sign_csr` — a certificate for a
key AXIAM never sees. `tools/gen_management.py` regenerates the §27
surface from the re-vendored registry; the management surface moves
159 -> 160 operations across the same 24 namespaces. The generator
already emits `SignCertificateCsrRequest`, so nothing needed
hand-writing, and it wired the operation's response to the existing
`Certificate` — never `GeneratedCertificate`, whose `private_key_pem`
field is mandatory and would always be absent here (§27.5). Two tests
in `management_semantics_test.rs` pin that: one constructs every field
of `Certificate` and asserts the serialized form carries nothing that
reads as a private key, the other round-trips `sign_csr` against a
fixture that sends a `private_key_pem` anyway and confirms it cannot
resurface on the decoded value.

M-3, the mirror: `webauthn_setup_register_start` /
`webauthn_setup_register_finish` in `src/rest/webauthn.rs`, beside the
six existing operations. The WebAuthn twin of `mfa_setup_enroll` /
`mfa_setup_confirm` — a user of a tenant that requires MFA is no longer
limited to TOTP for the first factor a forced login enrolment demands.

Both take no session at all, and neither attaches this client's own
session credential even when one is configured (§24.1): a dedicated
`webauthn_post_no_session` helper skips the `X-CSRF-Token` forwarding
every other call in this module does, and pre-empts `reqwest`'s cookie
jar with an explicit empty `Cookie` header — the jar only auto-populates
one when the outgoing request does not already carry one, so this is
enough to keep a con... (continued)

71 of 88 new or added lines in 2 files covered. (80.68%)

12570 of 13506 relevant lines covered (93.07%)

27.6 hits per line