net: request-token auth, deferred who, and always-on endorsement - #31
Draft
samlown wants to merge 3 commits into
Draft
net: request-token auth, deferred who, and always-on endorsement#31samlown wants to merge 3 commits into
samlown wants to merge 3 commits into
Conversation
Syncs the reference server and CLI to the revised GOBL Net spec: - /who and /inbox require a bearer request token (spec §5.5), verified by a requireAuth middleware whose structured log doubles as the request audit log (token_missing / token_invalid / token_expired reasons); CORS allows the Authorization header. - The static /who response is self-signed once at startup and served with Cache-Control: private; a missing party.json makes the domain receive-only (204). The who-deferred marker answers 202 and records requests for the new `gobl net requests` / `gobl net approve` commands; approval signs the party for the requester and delivers it to their inbox, where a pending who request exempts it from endorsement. - Sender endorsement is always enforced on the inbox: senders must be endorsed by a trusted authority (lookup.gobl.org by default, --authority supplements) with a confirmed verifier; --allow-unverified relaxes only the verifier requirement for sandboxes and tests. - gobl net who/send gain --from identities to mint tokens; NetWho is rebuilt on net.Client.Who and NetSend on net.Client.Send. - Local development options removed: --insecure client flags and the manual single-identity serve mode (with its auth-disabled path). Domains come from config-dir discovery; requests are always authenticated; clients always dial https. - Keys generated at startup floor valid_from to the second so signatures made within the same second verify. Pinned to the local gobl via a replace directive until the next gobl release; drop it before merging. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Follows the gobl core change dropping the URI scheme from signed iss/aud/verifier claims: sign options and payload comparisons use Address.String(), SignOptions.Issuer/Audience are plain strings, and the inbox audience check canonicalizes both sides with net.ParseAddress, mirroring gobl's VerifyEnvelope. The gobl: scheme remains on org.Endpoint URIs and the unsigned header from/to. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Absorb gobl's review fixes: transient conditions (network failures, 429, 5xx) now surface as net.ErrUnavailable, distinct from invalid tokens and failed endorsements. - requireAuth answers 503 (reason token_unavailable) when the requester's key endpoint cannot be reached, instead of a definitive 401 clients would not retry. - handleInbox answers 503 (reason verify_unavailable) when envelope or endorsement verification hits an unreachable key/who endpoint, instead of 401/403. - WithAuthorities now replaces the client's trust list, so the server builds it as default-plus-extras to keep --authority's documented supplement semantics; covered by a test accepting an endorsement from the default authority while extras are set. - Test fetchers implement the Fetcher interface's new Post method. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Syncs the GOBL Net reference server and CLI to the revised protocol spec (invopop/gobl#909). Targets the
netbranch./whoand/inboxreject requests without a validAuthorization: Bearertoken (401); arequireAuthmiddleware verifies tokens and its structured log entries (token_missing/token_invalid/token_expired, requester address) double as the request audit log. CORS allows theAuthorizationheader; key endpoints stay open./who: static self-signed envelope served withCache-Control: private; missingparty.json→ receive-only 204; awho-deferredmarker answers 202 and records requests for the newgobl net requests/gobl net approvecommands. Approved parties are signed for the requester and delivered to their inbox, where the pending who request exempts them from endorsement.lookup.gobl.orgby default;--authoritysupplements) with a confirmed verifier.--allow-unverifiedrelaxes only the verifier requirement, for sandboxes and tests.gobl net who/sendtake--fromidentities to mint tokens;NetWho/NetSendare rebuilt onnet.Client. The--insecureflags and the manual single-identity serve mode (with its auth-disabled carve-out) are removed — domains come from config-dir discovery and requests are always authenticated.valid_fromto the second so signatures made in the same second verify.Draft because
go.modpinsreplace github.com/invopop/gobl => ../gobl; swap for the next gobl release before merging.🤖 Generated with Claude Code