feat: authenticate R2PS admin API calls with dev token - #27
Merged
Conversation
Now that go-r2ps-service requires Bearer token auth on its admin API, configure sirosid-dev to pass R2PS_ADMIN_DEV_TOKEN in all admin calls. Changes: - Makefile: add R2PS_ADMIN_DEV_TOKEN env var (default: e2e test token) - docker-compose.r2ps.yml: pass token to r2ps-server container - scripts/setup-r2ps.sh: include Authorization header in all curl calls This calls the R2PS admin API directly (port 8444) with its own dev token, eliminating the need for a proxy through go-wallet-backend.
There was a problem hiding this comment.
Pull request overview
Updates the local sirosid-dev R2PS overlay and provisioning script to work with the newly auth-protected go-r2ps-service admin API by introducing and propagating a dev Bearer token.
Changes:
- Add
R2PS_ADMIN_DEV_TOKEN(defaulted for dev/e2e) to the Makefile environment exports. - Pass
R2PS_ADMIN_DEV_TOKENinto ther2ps-servercontainer viadocker-compose.r2ps.yml. - Add
Authorization: Bearer ...to admin APIcurlcalls inscripts/setup-r2ps.sh.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| Makefile | Exports R2PS_ADMIN_DEV_TOKEN so make up R2PS=yes provides the token to compose and tooling. |
| docker-compose.r2ps.yml | Injects R2PS_ADMIN_DEV_TOKEN into the r2ps-server container environment. |
| scripts/setup-r2ps.sh | Authenticates admin API calls with Authorization: Bearer using R2PS_ADMIN_DEV_TOKEN. |
Comment on lines
+72
to
76
| status=$(curl -sf -o /dev/null -w "%{http_code}" \ | ||
| -H "Authorization: Bearer ${R2PS_ADMIN_DEV_TOKEN}" \ | ||
| "${R2PS_ADMIN_URL}/admin/store/keys" 2>&1) || true | ||
| if [[ "$status" == "200" ]]; then | ||
| ok "R2PS admin API accessible" |
| R2PS_SESSION_TTL: "5m" | ||
| # Admin API | ||
| R2PS_ADMIN_LISTEN: ":8081" | ||
| R2PS_ADMIN_DEV_TOKEN: ${R2PS_ADMIN_DEV_TOKEN:-r2ps-e2e-dev-token-for-testing-only} |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Now that
go-r2ps-servicerequires Bearer token auth on its admin API (merged in sirosfoundation/go-r2ps-service#25), this PR configures sirosid-dev to authenticate directly.Changes
R2PS_ADMIN_DEV_TOKENenv var (default:r2ps-e2e-dev-token-for-testing-only)Authorization: Bearerheader in all admin API curl callsWhy
Previously the R2PS admin API had no auth (relying on network isolation). Now it requires a Bearer token. This PR makes sirosid-dev work with the new auth-enabled R2PS by calling it directly with its own dev token — no go-wallet-backend proxy needed.
Testing
Start with
make up R2PS=yesand run./scripts/setup-r2ps.sh— all admin calls should succeed with 200.