hyperledger / fabric-x-committer
90%
main: 91%

LAST BUILD BRANCH: acl/1-auth-service
DEFAULT BRANCH: main
Repo Added
Files 148
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH acl/1-auth-service
branch: SELECT
CHANGE BRANCH
x

coverage: 90.282%. First build
37207432836

Pull #848

github

dean-amar 
[auth] Add the Auth Service: nonce challenge, certificate-bound tokens, and authorization

#### Type of change

- New feature

#### Description

- New `auth` service (`committer start auth`) with three RPCs: `IssueNonce` hands out a single-use
  challenge, `Authenticate` exchanges an envelope signed over it for an opaque token bound to the
  client's TLS certificate, and `Authorize` checks a token against a resource's policy.
- Tokens (stored by hash) and nonces live in two new state-database tables, `auth_tokens` and
  `auth_nonces`, created by `init-db`, so any instance serves any request.
- Policy comes from the committed channel configuration's `ACLs` section, defaulting to
  `/Channel/Application/Readers`, and is re-read as the configuration changes.
- `statedb.ReadConfigTransaction` is the shared reader of the committed configuration (auth and query).
- Client helpers in `utils/acl`: `IssueToken`, `BuildAuthEnvelope`, `TLSCertHash`.
- Adds `grpcerror.WrapUnavailable`, `WrapUnauthenticated` and `WrapPermissionDenied`.

#### Additional details (Optional)

- Nothing enforces tokens yet; the Query Service and Sidecar are wired in #845.
- Temporarily requires the `fabric-x-common` fork in `go.mod` (envelope helper, `auth` test peer,
  `configtx.yaml` ACLs); the `replace` is removed once those changes are released upstream.

#### Related issues

- resolves #844
- related to #592

Signed-off-by: Dean Amar <Dean.Amar@ibm.com>
Pull Request #848: [ACL] Add the Auth Service: nonce challenge, certificate-bound tokens, and authorization [1/4]

338 of 441 new or added lines in 15 files covered. (76.64%)

10108 of 11196 relevant lines covered (90.28%)

40740.38 hits per line

Relevant lines Covered
11196 RELEVANT LINES 10108 COVERED LINES
40740.38 HITS PER LINE
Source Files on main

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
37207432836 acl/1-auth-service [auth] Add the Auth Service: nonce challenge, certificate-bound tokens, and authorization #### Type of change - New feature #### Description - New `auth` service (`committer start auth`) with three RPCs: `IssueNonce` hands out a single-use c... Pull #848 dean-amar github
90.28
36715313134 clone-delete [cmd, statedb] Add committer delete-clone to drop a snapshot database clone #### Type of change - New feature - Dependency update - Documentation update #### Description - Adds `committer delete-clone --config <vc-config> --tx-id <snapshot-tx-... Pull #826 cendhu github
90.66
36710735107 feat/sidecar-optional-txid-index [sidecar] Make the block store transaction ID index optional #### Type of change - New feature - Improvement (improvement to code, performance, etc) #### Description - Add `ledger.disable-tx-id-index` to the sidecar config, defaulting to false... Pull #842 liran-funaro github
90.62
36708841439 feat/sidecar-optional-txid-index [sidecar] Make the block store transaction ID index optional #### Type of change - New feature - Improvement (improvement to code, performance, etc) #### Description - Add `ledger.disable-tx-id-index` to the sidecar config, defaulting to false... Pull #842 liran-funaro github
90.69
36707195944 abort-snapshot-tx [vc, sidecar, snapshot-hasher] Abort a snapshot that will never be hashed - New feature - Accept abort snapshot transactions under SnapshotEndorsement using committerpb.SnapshotAbortKey, without a snapshot submission barrier. - Reject aborts n... Pull #831 cendhu github
90.61
36693117376 feat/grpc-flow-control-windows [grpc, utils] Size the HTTP/2 flow control windows #### Type of change - Improvement (improvement to code, performance, etc) - New feature - Test update #### Description - Adds `connection.FlowControlConfig` (`flow-control`: `initial-window-si... Pull #841 liran-funaro github
90.46
36686940428 feat/sidecar-parallel-parse [sidecar] Parse a block's transactions in parallel #### Type of change - Improvement (improvement to code, performance, etc) #### Description - Splits `mapBlock` into a parallel parse and a serial fold. `parseMessages` parses, classifies and... Pull #840 liran-funaro github
90.86
36686839933 feat/sidecar-parallel-parse [sidecar] Parse a block's transactions in parallel #### Type of change - Improvement (improvement to code, performance, etc) #### Description - Splits `mapBlock` into a parallel parse and a serial fold. `parseMessages` parses, classifies and... Pull #840 liran-funaro github
90.6
36681803112 abort-snapshot-tx [vc, sidecar, snapshot-hasher] Abort a snapshot that will never be hashed #### Type of change - New feature #### Description - Accept abort snapshot transactions under SnapshotEndorsement using committerpb.SnapshotAbortKey, without a snapsho... Pull #831 cendhu github
90.6
36674936712 clone-delete [vc, sidecar] Delete a snapshot database clone on admin request #### Type of change - New feature - Documentation update #### Description - Adds `DeleteDBCloneForSnapshot(tx_id)`, propagating sidecar → coordinator → VC. The VC drops the data... Pull #826 cendhu github
90.8
See All Builds (1192)