Sectigo Staging Service #917
Conversation
| c.Next() | ||
| } | ||
|
|
||
| // Token time constraint constants. |
There was a problem hiding this comment.
Simple JWT authentication using HS512 signed JWT tokens and a random key that is generated every time the server starts. This mimics the Sectigo API directly.
| @@ -0,0 +1,110 @@ | |||
| package server | |||
There was a problem hiding this comment.
This file contains all the "Sectigo" endpoints.
pkg/sectigo/server/config.go
Outdated
| } | ||
|
|
||
| // Generate a new self-signed certificate to issue certs | ||
| template := &x509.Certificate{ |
There was a problem hiding this comment.
If a self-signed CA cert isn't specified, one is generated.
| return nil | ||
| } | ||
|
|
||
| func (c AuthConfig) ParseSecret() []byte { |
There was a problem hiding this comment.
If a secret isn't specified, one is generated.
Codecov ReportBase: 44.38% // Head: 43.87% // Decreases project coverage by
Additional details and impacted files@@ Coverage Diff @@
## main #917 +/- ##
==========================================
- Coverage 44.38% 43.87% -0.51%
==========================================
Files 680 687 +7
Lines 24509 25449 +940
Branches 1548 1548
==========================================
+ Hits 10878 11167 +289
- Misses 12241 12847 +606
- Partials 1390 1435 +45
Flags with carried forward coverage won't be shown. Click here to find out more.
Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here. ☔ View full report at Codecov. |
| } | ||
|
|
||
| if _, err = s.tokens.Verify(string(token)); err != nil { | ||
| fmt.Println(err) |
There was a problem hiding this comment.
I assume this was left in from debugging?
There was a problem hiding this comment.
good catch; thanks!
| const ( | ||
| accessTokenDuration = 1 * time.Hour | ||
| refreshTokenDuration = 2 * time.Hour | ||
| accessRefreshOverlap = -1 * time.Hour |
There was a problem hiding this comment.
If I'm reading this correctly, the accessRefreshOverlap specifies the duration for which the access token and refresh token are both valid?
There was a problem hiding this comment.
That's correct; normally it's -15 minutes but for testing the -1 hour overlaps the access token duration completely.
Scope of changes
Adds a mock Sectigo service with a self-signed CA that we can use for integration testing to ensure that the GDS interacts with Sectigo appropriately. This will allow us to "issue" certs and download them from GDS without using our Sectigo licenses.
Fixes SC-8965
Type of change
Acceptance criteria
This is quite a big PR - so a cursory review is fine.
Author checklist
Reviewer(s) checklist