mosaicstack/stack
1
0
Fork 0
Code Issues 19 Pull Requests Actions Packages Projects Releases 12 Wiki Activity

FED-M6: revocation + auto-renewal + CRL #465

New Issue
Open
opened 2026-04-19 22:02:14 +00:00 by jason.woltje · 0 comments
jason.woltje commented 2026-04-19 22:02:14 +00:00
Owner
Copy Link

Epic: Federation v1 — see docs/federation/PRD.md and docs/federation/MILESTONES.md.

Goal

Grant lifecycle works end-to-end: admin revoke, revoke-on-delete, automatic cert renewal, CRL distribution.

Scope

  • mosaic federation grant revoke <id> → status revoked, CRL updated, audit entry
  • DB hook: deleting a user cascades revoke-on-delete on all grants where that user is subject
  • Step-CA CRL endpoint exposed; serving gateway enforces CRL check on every handshake (cached CRL, 60s refresh)
  • Client-side cert renewal job: at T-7 days, submit renewal CSR; rotate cert atomically; flush cache
  • On renewal failure, peer marked degraded and admin-visible alert emitted
  • Server A detects revocation on next request (TLS handshake fails with specific error) → peer marked revoked

Deliverables

  • apps/gateway/src/federation/server/crl.service.ts + endpoint
  • apps/gateway/src/federation/server/revocation.service.ts
  • DB cascade trigger or ORM hook for user deletion → grant revocation
  • apps/gateway/src/federation/client/renewal.job.ts (scheduled)
  • packages/mosaic/src/commands/federation/grant.ts gains revoke subcommand

Acceptance Tests

  • Admin grant revoke → A's next request fails with TLS-level error
  • Deleting subject user on B auto-revokes all grants where that user was subject
  • CRL endpoint serves correct list; revoked cert present
  • Server rejects cert listed in CRL even if cert time-valid
  • Cert at T-7 days triggers renewal; new cert issued and installed without dropped requests
  • Renewal failure marks peer degraded and surfaces alert
  • A marks peer revoked after revocation-caused handshake failure, NOT on transient network errors

Dependencies

Blocked by FED-M3. Can run in parallel with FED-M5.

Estimated budget

~20K tokens

Risk notes

Atomic cert swap during renewal is the sharpest edge — any in-flight request mid-swap must either complete on old cert or retry on new, never fail mid-call.

**Epic:** Federation v1 — see `docs/federation/PRD.md` and `docs/federation/MILESTONES.md`. ## Goal Grant lifecycle works end-to-end: admin revoke, revoke-on-delete, automatic cert renewal, CRL distribution. ## Scope - `mosaic federation grant revoke <id>` → status `revoked`, CRL updated, audit entry - DB hook: deleting a user cascades `revoke-on-delete` on all grants where that user is subject - Step-CA CRL endpoint exposed; serving gateway enforces CRL check on every handshake (cached CRL, 60s refresh) - Client-side cert renewal job: at T-7 days, submit renewal CSR; rotate cert atomically; flush cache - On renewal failure, peer marked `degraded` and admin-visible alert emitted - Server A detects revocation on next request (TLS handshake fails with specific error) → peer marked `revoked` ## Deliverables - `apps/gateway/src/federation/server/crl.service.ts` + endpoint - `apps/gateway/src/federation/server/revocation.service.ts` - DB cascade trigger or ORM hook for user deletion → grant revocation - `apps/gateway/src/federation/client/renewal.job.ts` (scheduled) - `packages/mosaic/src/commands/federation/grant.ts` gains `revoke` subcommand ## Acceptance Tests - [ ] Admin `grant revoke` → A's next request fails with TLS-level error - [ ] Deleting subject user on B auto-revokes all grants where that user was subject - [ ] CRL endpoint serves correct list; revoked cert present - [ ] Server rejects cert listed in CRL even if cert time-valid - [ ] Cert at T-7 days triggers renewal; new cert issued and installed without dropped requests - [ ] Renewal failure marks peer `degraded` and surfaces alert - [ ] A marks peer `revoked` after revocation-caused handshake failure, NOT on transient network errors ## Dependencies Blocked by **FED-M3**. Can run in parallel with **FED-M5**. ## Estimated budget ~20K tokens ## Risk notes Atomic cert swap during renewal is the sharpest edge — any in-flight request mid-swap must either complete on old cert or retry on new, never fail mid-call.
jason.woltje added this to the Federation v1 milestone 2026-04-19 22:02:14 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone Federation v1
Projects
Clear projects
No project
Assignees
Clear assignees
jason.woltje
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#465
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?