Skip to content

feat: ESSR protected client APIs #351

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
iFergal wants to merge 10 commits into
base: main
Choose a base branch
from
Open

feat: ESSR protected client APIs #351

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
f7cfb9d
feat: ESSR client authentication
iFergal Jan 15, 2025
0441be2
fix: expose headers for CORS
iFergal Jan 17, 2025
3b080f8
fix: handle rep.text responses (needs tests)
iFergal Jan 23, 2025
61e11c3
refactor: remove unnecessary strip (was from debugging) [skip ci]
iFergal Jan 23, 2025
1532439
Merge remote-tracking branch 'origin/main' into feat/essrAPI
iFergal Jun 16, 2025
6edad46
feat: allow both signed headers and ESSR for authentication, signify …
iFergal Jun 18, 2025
1b457ca
test: coverage for serializeResponse
iFergal Jun 19, 2025
ec5c93a
feat: better error msgs and test coverage for signed headers
iFergal Jun 25, 2025
b3d6181
fix: unquote request path after verifying inbound ESSR
iFergal Jul 3, 2025
1d83e66
fix: calc content-length in environ by bytes not chars and test
iFergal Jul 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 11 additions & 9 deletions src/keria/app/agenting.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@
from ..peer import exchanging as keriaexchanging
from .specing import AgentSpecResource
from ..core import authing, longrunning, httping
from ..core.authing import Authenticater
from ..core.authing import SignedHeaderAuthenticator
from ..core.keeping import RemoteManager
from ..db import basing

Expand Down Expand Up @@ -152,8 +152,8 @@ def setupDoers(config: KERIAServerConfig):
"""
Sets up the HIO coroutines the KERIA agent server is composed of including three HTTP servers for a KERIA agent server:
1. Boot server for bootstrapping agents. Signify calls this with a signed inception event.
2. Admin server for administrative tasks like creating agents.
3. HTTP server for all other agent operations.
2. Admin server for any Signify client related actions after bootstrapping.
3. HTTP server for all other external agents send KERI events or messages for interactions.
"""
agency = Agency(
name=config.name,
Expand All @@ -173,7 +173,8 @@ def setupDoers(config: KERIAServerConfig):
'signature',
'signature-input',
'signify-resource',
'signify-timestamp'
'signify-timestamp',
'signify-receiver'
]
bootApp = falcon.App(middleware=falcon.CORSMiddleware(
allow_origins='*', allow_credentials='*',
Expand All @@ -188,14 +189,15 @@ def setupDoers(config: KERIAServerConfig):
bootApp.add_route("/health", HealthEnd())

# Create Authenticater for verifying signatures on all requests
authn = Authenticater(agency=agency)
authn = SignedHeaderAuthenticator(agency=agency)

app = falcon.App(middleware=falcon.CORSMiddleware(
allow_origins='*', allow_credentials='*',
expose_headers=allowed_cors_headers))
app = falcon.App(
middleware=falcon.CORSMiddleware(allow_origins='*', allow_credentials='*', expose_headers=allowed_cors_headers),
request_type=authing.ModifiableRequest
)
if config.cors:
app.add_middleware(middleware=httping.HandleCORS())
app.add_middleware(authing.SignatureValidationComponent(agency=agency, authn=authn, allowed=["/agent"]))
app.add_middleware(authing.AuthenticationMiddleware(agency=agency, authn=authn, allowed=["/agent"]))
app.req_options.media_handlers.update(media.Handlers())
app.resp_options.media_handlers.update(media.Handlers())

Expand Down
7 changes: 4 additions & 3 deletions src/keria/app/aiding.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,8 +24,8 @@


def loadEnds(app, agency, authn):
groupEnd = AgentResourceEnd(agency=agency, authn=authn)
app.add_route("/agent/{caid}", groupEnd)
agentEnd = AgentResourceEnd(agency=agency, authn=authn)
app.add_route("/agent/{caid}", agentEnd)

aidsEnd = IdentifierCollectionEnd()
app.add_route("/identifiers", aidsEnd)
Expand Down Expand Up @@ -245,7 +245,8 @@ def on_put(self, req, rep, caid):
ctrlHab = agent.hby.habByName(caid, ns="agent")
ctrlHab.rotate(serder=rot, sigers=[core.Siger(qb64=sig) for sig in sigs])

if not self.authn.verify(req):
# @TODO - foconnor: Not sure if this should be here - Signify is not signing headers for passcode rotation.
if not self.authn.inbound(req):
Copy link
Collaborator Author

@iFergal iFergal Jun 24, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@pfeairheller Passcode rotation (PUT /agent/{caid}) in Signify doesn't use signed headers (just has a signed body), like the rest of the /agent endpoints, so perhaps this shouldn't be checking for signed headers here. If not, I can update Signify to use the correct fetch, and adjust this to accept ESSR if needed.

Any idea @rodolfomiranda?

raise falcon.HTTPForbidden(description="invalid signature on request")

sxlt = body["sxlt"]
Expand Down
Loading