Fixed the postman collection and app config - #2338
Merged
Merged
Conversation
Signed-off-by: anushasunkada <anushasunkada@gmail.com>
WalkthroughThe PR updates local eSignet endpoints to port 8080, renames the cache type environment variable, refreshes Postman client encryption setup, and adds optional HSM client installation with PKCS#11 proxy configuration. ChangeseSignet runtime and client setup
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant DockerImage
participant Entrypoint
participant HSMArchive
participant HSMInstaller
DockerImage->>Entrypoint: Start container with HSM settings
Entrypoint->>HSMArchive: Download archive when URL is configured
Entrypoint->>HSMInstaller: Extract archive and run install.sh as root
HSMInstaller-->>Entrypoint: Complete HSM client installation
Entrypoint->>Entrypoint: Execute container command
Possibly related PRs
Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## develop-go #2338 +/- ##
=============================================
Coverage ? 66.36%
=============================================
Files ? 123
Lines ? 7988
Branches ? 110
=============================================
Hits ? 5301
Misses ? 2272
Partials ? 415
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@esignet-service/data/deployment.yaml`:
- Around line 2-16: Align deployment.yaml’s top-level port and server.port with
the 8088 default used by app.go’s defaultPort and cfg.Server.Port flow,
preserving consistent token-binding hostport validation. Replace every
${VAR:-fallback} expression with Go-compatible environment expansion and rely on
the Go configuration defaults for unset variables, including issuer, data_dir,
provider, flow/theme/layout IDs, runtime_db_type, and public_url.
In `@postman-collection/Go-eSignet` (local).postman_environment.json:
- Line 14: Update the endpoint environment values used as DPoP htu inputs for
token, PAR, and UserInfo requests to contain each request’s full endpoint URL,
including its path, rather than only the service origin. Apply the same
correction to all three referenced environment entries and preserve the existing
host and port.
In `@postman-collection/Go-eSignet.postman_collection.json`:
- Line 267: Add a UserInfo response script for the request using the
`client_enc_private_key` variable: import the stored RSA-OAEP private JWK,
decrypt the `jwt_encrypted` compact JWE response, and validate the resulting
plaintext before treating the request as successful. Replace raw JWE logging
with decryption/validation handling while preserving the existing UserInfo
status check.
- Around line 206-208: Update the crypto availability guard in the pre-request
script to safely detect an absent Postman crypto global before accessing its
properties, while preserving the existing manual-key setup error for unavailable
key generation.
- Around line 229-230: Add client_enc_public_key and client_enc_private_key
variable declarations to every exported Postman environment, matching the names
used by the collection scripts; set the client_enc_private_key variable type to
secret while keeping the public key appropriately non-secret.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: d0744b56-6753-48c8-a556-3dc04567041e
📒 Files selected for processing (5)
esignet-service/.env.exampleesignet-service/data/deployment.yamlesignet-service/internal/config/app.gopostman-collection/Go-eSignet (local).postman_environment.jsonpostman-collection/Go-eSignet.postman_collection.json
Signed-off-by: anushasunkada <anushasunkada@gmail.com>
Signed-off-by: anushasunkada <anushasunkada@gmail.com>
Signed-off-by: anushasunkada <anushasunkada@gmail.com>
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@esignet-service/docker-entrypoint.sh`:
- Around line 7-10: Update the HSM client download flow around
hsm_client_zip_url_env to require an HTTPS URL and validate client.zip against a
trusted, independently configured pinned signature or checksum before any
extraction or installer execution. Abort immediately on URL or verification
failure, and keep the verification material separate from the mutable download
URL.
- Line 24: Update the mv command in the archive extraction flow to protect the
archive-derived dirname value: quote the source and destination arguments and
include -- before them to prevent word splitting, pathname expansion, or option
parsing.
In `@esignet-service/Dockerfile`:
- Around line 61-63: Remove the sudoers rule and user-writable privileged
installer access from esignet-service/Dockerfile lines 61-63; ensure the HSM
installation is performed only by a trusted root-only init container or
image-build stage, with the installed library directory root-owned and
read-only. Update esignet-service/docker-entrypoint.sh line 34 to stop running
the installer at application startup and instead consume the preinstalled client
mounted read-only.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: ac9e619c-92bd-477c-82ba-84dee9b2555d
📒 Files selected for processing (3)
esignet-service/Dockerfileesignet-service/docker-entrypoint.shhelm/esignet/values.yaml
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
Configuration
localhost:8080.Testing Tools