feat(examples): wire offered/accepted COSE algorithm config through adapters + demos#79
Merged
Merged
Conversation
…dapters + demos Plumb the crypto-agility algorithm lists (ADR 0019) through all three adapter config surfaces and set them explicitly in each example app, completing the ADR's "wire through external host config" follow-up. - Spring: pkauth.ceremony.offered-algorithms / accepted-algorithms bound on PkAuthProperties.Ceremony and forwarded via the 7-arg CeremonyConfig.from. - Micronaut: same keys on PkAuthConfiguration.Ceremony (getter/setter pairs), forwarded in PkAuthFactory. - Dropwizard: offeredAlgorithms / acceptedAlgorithms record components on PkAuthConfig.Ceremony (TTL-only and no-arg constructors kept for back-compat), forwarded in PkAuthModule. - Demos: spring + micronaut application.yml set both lists; the Java-configured dropwizard DemoConfiguration sets them on PkAuthConfig.Ceremony. All set to the core defaults as living documentation; nulls still fall back to those defaults. - Docs: operator-guide section on the two knobs; ADR 0019 follow-up marked done. Verified: ./gradlew check passes, and all three demos boot with the new config and pass their Playwright e2e suites (the enum-list binding is exercised by a real registration ceremony in each). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What & why
Follow-up to #78 (crypto-agility / post-quantum readiness, ADR 0019). #78 added the
CoseAlgorithmenum and theofferedAlgorithms/acceptedAlgorithmslists onCeremonyConfig, but left "wire them through each adapter's external host config" as an open follow-up. This PR completes that and surfaces the knobs in all three example apps.No behavior change: every adapter null-coalesces to the core defaults, and the demos set the lists to exactly those defaults (as living documentation).
Changes
Adapter config plumbing →
CeremonyConfig.from(...)(7-arg)pkauth.ceremony.offered-algorithms/accepted-algorithmsbound onPkAuthProperties.Ceremony, forwarded inPkAuthAutoConfiguration.PkAuthConfiguration.Ceremony(getter/setter pairs), forwarded inPkAuthFactory.offeredAlgorithms/acceptedAlgorithmsrecord components onPkAuthConfig.Ceremony(the no-arg and TTL-only constructors are kept for back-compat), forwarded inPkAuthModule.Demos
spring-boot-demo/micronaut-demoapplication.yml: set both lists underpkauth.ceremony.dropwizard-demoDemoConfiguration.java(Java-configured): set them onPkAuthConfig.Ceremony.offered = [ES256, EdDSA, RS256],accepted = [ES256, EdDSA, RS256, ES384, RS384]) with comments explaining an operator can narrow either.Docs
docs/operator-guide.md: new subsection documenting the two knobs and the re-enrollment caveat when narrowingaccepted.Verification
./gradlew checkpasses (Spotless + tests + JaCoCo gates).🤖 Generated with Claude Code