feat(gateway): mTLS client-certificate listener (Phase 1) - #2
Open
marcorivm wants to merge 6 commits into
Open
Conversation
Reconciliation Stage A. getCurrentPlan() reports enterprise; the OSS policy validator wiring and now-empty policy-flags/policy-oss-locks modules are removed (the coherence bridge was already dropped upstream); lock affordances are edition-neutral (UnavailableBadge, informational ProAppDialog); the OneCLI Cloud promo blocks and cloud_only error string are removed. No agent-group code, no migration.
# Conflicts: # apps/web/src/lib/init/api.ts
Reconciliation Stage C. /v1/org/groups CRUD + replace-set membership (org-membership validated on the global-FK userId), /groups as a single user-groups view. Agent groups and the org-agent directory are dropped (orphaned once agent groups are gone). No orphan-neutralization pass: upstream's grants engine treats an FK-orphaned rule identity as inert, so a group delete cannot widen a rule. +59 tests, no agent-group code, no migration.
Reconciliation Stage D. /v1/projects (rename, access bindings replace-set, safe delete with pinned cascade and last-owner/stranding guards) plus /settings/project UI; /v1/org/role-mappings (CRUD, ordering, preview) with monotonic raise-only apply re-wired into the group membership writers via the applyRoleMappingsForGroup seam Stage C had stripped. Role changes audit under MEMBER, config under ROLE_MAPPING. +136 tests, no agent-group code, no migration. (Role-mappings management UI folds into Stage E.)
…44.0 Reconciliation Stage F. The OSS gateway now populates the org rule set and the user/group PrincipalSet that upstream shipped but never filled: a new loaders.rs adds the org published-rule loader and a principal CTE mirroring the API's resolvePrincipalSet (users direct and via granted groups, active members only; groups direct and inherited; fully org-fenced, agent-groups dropped). Two-level evaluation mirrors upstream's own evaluator including the hard-floor rule (a lone allow at one level cannot open the other level's default block), so an org guardrail can't be bypassed by a project allow. Fail-closed via upstream's anyhow refuse-CONNECT; our old org_degraded/Fallback/kill-switch scaffolding is deleted. Empty org fails OPEN. +21 tests, no agent-group, no signature changes to the call sites.
Add a second listener that terminates mutual TLS, requiring a client certificate signed by a dedicated client CA (distinct from the MITM CA). After the handshake the stream is handed to the existing connection handler unchanged; the peer certificate's identity (URI-SAN preferred, else CN) is extracted and threaded into ProxyContext. Phase 1 logs the identity only — no enforcement against the agent token yet. - New src/client_ca.rs: ClientIdentity, identity extraction with injection-safe sanitization, path-or-inline PEM loading, and MtlsConfig with fail-closed from_parts/from_env. - Fail-closed startup: mis-configured mTLS aborts main before DB/crypto init; never falls back to plaintext. - SECURITY: client-cert verifier uses the default deny anon policy (no allow_unauthenticated); GATEWAY_CLIENT_CA is rejected if its SPKI matches the host-resident MITM CA's public key. - GATEWAY_PLAIN_BIND fails closed on an unparseable value; accept loop retries transient errors so one listener can't cancel the other. - mTLS is off when GATEWAY_MTLS_PORT is unset (backward compatible). - 40 client_ca tests + mTLS e2e through handle_connection; OSS build, clippy --all-targets -D warnings, and fmt all clean. Claude-Session: https://claude.ai/code/session_01BgJuqEJqf7ZiUdqHWxi6bt
This was referenced Jul 30, 2026
An error occurred while trying to automatically change base from
open-edition/reconciled
to
open-edition/08-web-org-policy
August 8, 2026 19:22
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Phase 1 of remote-gateway hardening — mTLS listener
Enables hosting the gateway on a different machine than the clients (Dokploy / Railway, where Tailscale can't run). First of a stacked series; later PRs add client-cert issuance (Phase 2), an
onecli-gateway relayclient (Phase 3), nanoclaw integration (Phase 4), and cert↔token binding enforcement (Phase 5).What this PR does
ca.rs. After the handshake the stream is handed to the existing connection handler unchanged, so all CONNECT / MITM / Axum logic is reused.ProxyContext. Phase 1 logs it only — no enforcement against the agent token yet (Phase 5).GATEWAY_MTLS_PORTis unset — fully backward compatible; the plaintext listener behaves exactly as before.Security properties
mainbefore DB/crypto init — never falls back to plaintext.allow_unauthenticated); rustls validates chain + expiry during the handshake.GATEWAY_CLIENT_CAis rejected if its SPKI matches the host-resident MITM CA's public key — that key signs leaf certs on demand, so trusting it as a client anchor would let anyone mint their own client cert.GATEWAY_PLAIN_BINDfails closed on an unparseable value (no silent0.0.0.0); the accept loop retries transient errors so one listener can't cancel the other.Env contract (all off unless
GATEWAY_MTLS_PORTis set)GATEWAY_MTLS_PORT,GATEWAY_TLS_CERT,GATEWAY_TLS_KEY,GATEWAY_CLIENT_CA(each path-or-inline PEM),GATEWAY_PLAIN_BIND(default0.0.0.0).Testing
client_caunit tests + an mTLS e2e throughhandle_connection);cargo clippy --all-targets -- -D warningsandcargo fmt --checkclean./healthz200 (proves no Phase-1 enforcement); hostile CN/SAN dropped; same-public-key-different-cert client CA → rejected; allfrom_partsfail-closed cases.Notes for reviewers
cargo build --features cloudcurrently fails with 27 errors — pre-existing in theee/*.rsstubs on this branch, reproduced on the base commit; none originate in this PR's code. Validated on OSS build only.https://claude.ai/code/session_01BgJuqEJqf7ZiUdqHWxi6bt