hyperledger / fabric-x-committer / 37207432836

90%

main: 91%

Pull #848

github

[auth] Add the Auth Service: nonce challenge, certificate-bound tokens, and authorization

#### Type of change

- New feature

#### Description

- New `auth` service (`committer start auth`) with three RPCs: `IssueNonce` hands out a single-use
  challenge, `Authenticate` exchanges an envelope signed over it for an opaque token bound to the
  client's TLS certificate, and `Authorize` checks a token against a resource's policy.
- Tokens (stored by hash) and nonces live in two new state-database tables, `auth_tokens` and
  `auth_nonces`, created by `init-db`, so any instance serves any request.
- Policy comes from the committed channel configuration's `ACLs` section, defaulting to
  `/Channel/Application/Readers`, and is re-read as the configuration changes.
- `statedb.ReadConfigTransaction` is the shared reader of the committed configuration (auth and query).
- Client helpers in `utils/acl`: `IssueToken`, `BuildAuthEnvelope`, `TLSCertHash`.
- Adds `grpcerror.WrapUnavailable`, `WrapUnauthenticated` and `WrapPermissionDenied`.

#### Additional details (Optional)

- Nothing enforces tokens yet; the Query Service and Sidecar are wired in #845.
- Temporarily requires the `fabric-x-common` fork in `go.mod` (envelope helper, `auth` test peer,
  `configtx.yaml` ACLs); the `replace` is removed once those changes are released upstream.

#### Related issues

- resolves #844
- related to #592

Signed-off-by: Dean Amar <Dean.Amar@ibm.com>

338 of 441 new or added lines in 15 files covered. (76.64%)

10108 of 11196 relevant lines covered (90.28%)

40740.38 hits per line