mosaicstack/stack
1
0
Fork 0
Code Issues 19 Pull Requests Actions Packages Projects Releases 12 Wiki Activity

FED-M2: Step-CA + grant schema + admin CLI #461

New Issue
Open
opened 2026-04-19 22:02:00 +00:00 by jason.woltje · 0 comments
jason.woltje commented 2026-04-19 22:02:00 +00:00
Owner
Copy Link

Epic: Federation v1 — see docs/federation/PRD.md and docs/federation/MILESTONES.md.

Goal

An admin can create a federation grant and its counterparty can enroll. No runtime federation traffic yet.

Scope

  • Embed Step-CA as a Docker Compose sidecar with persistent CA volume
  • Gateway exposes short-lived enrollment endpoint (single-use token from grant)
  • DB schema: federation_grants, federation_peers, federation_audit_log
  • Sealed storage for client_key_pem using existing credential sealing key
  • Admin CLI: mosaic federation grant create|list|show, mosaic federation peer add|list
  • Step-CA signs certs with SAN OIDs for grantId + subjectUserId
  • Grant status transitions: pending → active on successful enrollment

Deliverables

  • packages/db migration: three federation tables + enum types
  • apps/gateway/src/federation/ca.service.ts (Step-CA client)
  • apps/gateway/src/federation/grants.service.ts
  • apps/gateway/src/federation/enrollment.controller.ts
  • packages/mosaic/src/commands/federation/ (grant + peer subcommands)
  • docker-compose.federated.yml adds Step-CA service
  • Scope JSON schema + validator

Acceptance Tests

  • grant create writes a pending row with scoped bundle
  • Enrollment endpoint signs CSR and returns cert with expected SAN OIDs
  • Enrollment token single-use; second attempt returns 410
  • Cert subjectUserId OID matches grant's subject_user_id
  • client_key_pem is at-rest encrypted; raw DB read shows ciphertext, not PEM
  • peer add <url> yields active peer record with valid cert+key (two-gateway E2E, no traffic)
  • Scope JSON with unknown resource type rejected at grant create
  • grant list and peer list render active/pending/revoked accurately

Dependencies

Blocked by FED-M1 (federated tier must exist).

Estimated budget

~30K tokens

Risk notes

Step-CA API is well-documented but sealing integration with existing provider-credential encryption is a cross-module concern — walk that seam deliberately.

**Epic:** Federation v1 — see `docs/federation/PRD.md` and `docs/federation/MILESTONES.md`. ## Goal An admin can create a federation grant and its counterparty can enroll. No runtime federation traffic yet. ## Scope - Embed Step-CA as a Docker Compose sidecar with persistent CA volume - Gateway exposes short-lived enrollment endpoint (single-use token from grant) - DB schema: `federation_grants`, `federation_peers`, `federation_audit_log` - Sealed storage for `client_key_pem` using existing credential sealing key - Admin CLI: `mosaic federation grant create|list|show`, `mosaic federation peer add|list` - Step-CA signs certs with SAN OIDs for `grantId` + `subjectUserId` - Grant status transitions: `pending` → `active` on successful enrollment ## Deliverables - `packages/db` migration: three federation tables + enum types - `apps/gateway/src/federation/ca.service.ts` (Step-CA client) - `apps/gateway/src/federation/grants.service.ts` - `apps/gateway/src/federation/enrollment.controller.ts` - `packages/mosaic/src/commands/federation/` (grant + peer subcommands) - `docker-compose.federated.yml` adds Step-CA service - Scope JSON schema + validator ## Acceptance Tests - [ ] `grant create` writes a `pending` row with scoped bundle - [ ] Enrollment endpoint signs CSR and returns cert with expected SAN OIDs - [ ] Enrollment token single-use; second attempt returns 410 - [ ] Cert `subjectUserId` OID matches grant's `subject_user_id` - [ ] `client_key_pem` is at-rest encrypted; raw DB read shows ciphertext, not PEM - [ ] `peer add <url>` yields `active` peer record with valid cert+key (two-gateway E2E, no traffic) - [ ] Scope JSON with unknown resource type rejected at `grant create` - [ ] `grant list` and `peer list` render active/pending/revoked accurately ## Dependencies Blocked by **FED-M1** (federated tier must exist). ## Estimated budget ~30K tokens ## Risk notes Step-CA API is well-documented but sealing integration with existing provider-credential encryption is a cross-module concern — walk that seam deliberately.
jason.woltje added this to the Federation v1 milestone 2026-04-19 22:02:00 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone Federation v1
Projects
Clear projects
No project
Assignees
Clear assignees
jason.woltje
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#461
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?