chore: rebase

Author: Manuthor

crate/clients/ckms/src/tests/security/privilege_bypass.rs

@@ -1,7 +1,6 @@
 //! Privileged-user bypass tests (CLI-level).
 //!
 //! Verifies that the `crypto_officer_users` server configuration correctly scopes
-//! Verifies that the `crypto_officer_users` server configuration correctly scopes
 //! privileges: only listed users can create keys; the privilege does NOT bleed
 //! into read or access-management operations on keys owned by other users.
 //!
@@ -47,7 +46,6 @@ async fn pb01_privileged_user_can_create_key() -> CosmianResult<()> {
 
 // ---------------------------------------------------------------------------
 // PB2: Non-privileged user cannot create a key when crypto_officer_users is set.
-// PB2: Non-privileged user cannot create a key when crypto_officer_users is set.
 // ---------------------------------------------------------------------------
 #[tokio::test]
 async fn pb02_non_privileged_user_cannot_create() -> CosmianResult<()> {

crate/server/src/config/command_line/clap_config.rs

@@ -215,13 +215,6 @@ pub struct ClapConfig {
     #[clap(long, hide = true)]
     pub non_revocable_key_id: Option<Vec<String>>,
 
-    /// **Deprecated** — use `--crypto-officer-users` (under `[roles]`) instead.
-    ///
-    /// List of users who have the right to create and import objects and grant
-    /// the `Create` access right to other users. Kept for backward compatibility;
-    /// if set and `[roles] crypto_officer_users` is not configured, these users
-    /// are promoted to the `CryptoOfficer` role automatically on startup.
-    #[clap(long, hide = true, verbatim_doc_comment)]
     /// **Deprecated** — use `--crypto-officer-users` (under `[roles]`) instead.
     ///
     /// List of users who have the right to create and import objects and grant
@@ -231,10 +224,10 @@ pub struct ClapConfig {
     #[clap(long, hide = true, verbatim_doc_comment)]
     pub privileged_users: Option<Vec<String>>,
 
-    #[clap(flatten)]
     /// RBAC role assignments (`CryptoOfficer`).
     /// Users not listed in any role default to `Operator` (minimum privilege).
     /// In TOML these fields live under the `[roles]` section.
+    #[clap(flatten)]
     #[serde(default, rename = "roles")]
     pub roles: RolesConfig,
 
@@ -505,7 +498,6 @@ impl ClapConfig {
         //  4. Deserialize into `ClapConfig`, collecting any unknown fields as errors.
         //     `serde_ignored` wraps the deserializer and calls the callback for every
         //     field the target type does not recognize — including fields that bubble up
-        //     field the target type does not recognize — including fields that bubble up
         //     via `#[serde(flatten)]` (e.g. `HsmConfig`), where `deny_unknown_fields`
         //     would conflict with the flatten and cannot be used directly.
         let load_file = |p: &PathBuf| -> KResult<Self> {
@@ -750,8 +742,6 @@ impl fmt::Debug for ClapConfig {
         let x = x.field("non_revocable_key_id", &self.non_revocable_key_id);
         let x = x.field("privileged_users (deprecated)", &self.privileged_users);
         let x = x.field("roles", &self.roles);
-        let x = x.field("privileged_users (deprecated)", &self.privileged_users);
-        let x = x.field("roles", &self.roles);
 
         let x = x.field("aws_xks_config", &self.aws_xks_config);
         let x = if self.aws_xks_config.aws_xks_enable {

crate/server/src/core/operations/dispatch.rs

@@ -234,9 +234,6 @@ async fn dispatch_inner(
     // Enforce role-based access control before any other check.
     check_role_permission(kms, user, operation_tag, &kms.params.crypto_officer).await?;
 
-    // Enforce role-based access control before any other check.
-    check_role_permission(kms, user, operation_tag, &kms.params.crypto_officer).await?;
-
     // For operations where the request carries algorithm choices, validate them
     // before executing any cryptographic action.  Skip entirely when no policy
     // is configured — avoids a function call + match on every dispatch.

crate/server/src/core/operations/generate_crl.rs

@@ -40,8 +40,6 @@ use crate::{
 /// In-memory cache of the most recently generated CRL per issuer.
 ///
 /// The public CRL endpoint (`GET /public/certificates/{id}/crl`) reads from
-///
-/// The public CRL endpoint (`GET /public/certificates/{id}/crl`) reads from
 /// this cache so it can serve pre-signed bytes without requiring any
 /// authentication or access to key material.
 ///

crate/server/src/middlewares/auth_verifier/token.rs

@@ -48,18 +48,12 @@ const ALLOWED_ALGORITHMS: &[Algorithm] = &[
     Algorithm::PS512,
 ];
 
-/// Claims extracted from a Cosmian Auth Verifier JWT.
-///
-/// The auth server includes the RBAC `roles` (RFC 9068 private claim) and
-/// the realm identifier in `as_rid` so that OPA can enforce domain-scoped
-/// policies without an additional lookup.
 /// Claims extracted from a Cosmian Auth Verifier JWT.
 ///
 /// The auth server includes the RBAC `roles` (RFC 9068 private claim) and
 /// the realm identifier in `as_rid` so that OPA can enforce domain-scoped
 /// policies without an additional lookup.
 #[derive(Debug, Deserialize)]
-/// Subject — used as the KMS user identity (username / email).
 pub(crate) struct AuthVerifierClaims {
     /// Subject — used as the KMS user identity (username / email).
     pub sub: String,
@@ -82,10 +76,6 @@ pub(crate) struct AuthVerifierClaims {
 /// against every key in the JWKS (Cosmian tokens carry no `kid`), and
 /// populates [`AuthenticatedUser`] with the full claims — including `roles`
 /// and `domain` — so OPA can evaluate role-based and domain-scoped policies.
-/// Extracts the bearer token from the `Authorization` header, validates it
-/// against every key in the JWKS (Cosmian tokens carry no `kid`), and
-/// populates [`AuthenticatedUser`] with the full claims — including `roles`
-/// and `domain` — so OPA can evaluate role-based and domain-scoped policies.
 pub(super) async fn handle_auth_verifier(
     jwks_manager: &Arc<JwksManager>,
     req: &ServiceRequest,
@@ -102,22 +92,15 @@ pub(super) async fn handle_auth_verifier(
     })
 }
 
-/// Validate a Cosmian Auth Verifier JWT and return its full claims.
 /// Validate a Cosmian Auth Verifier JWT and return its full claims.
 ///
 /// Validates the signature against every public key in the JWKS (Cosmian
 /// tokens carry no `kid`). Returns all claims — `sub`, `roles`, and
 /// `domain` (`as_rid` / `as_domain`) — so callers can populate
 /// [`AuthenticatedUser`] or store them in a session without re-parsing.
-/// Validates the signature against every public key in the JWKS (Cosmian
-/// tokens carry no `kid`). Returns all claims — `sub`, `roles`, and
-/// `domain` (`as_rid` / `as_domain`) — so callers can populate
-/// [`AuthenticatedUser`] or store them in a session without re-parsing.
 ///
 /// In test / insecure builds the signature check is skipped; only the
 /// claim structure is decoded (same behaviour as [`JwtAuth`]).
-/// In test / insecure builds the signature check is skipped; only the
-/// claim structure is decoded (same behaviour as [`JwtAuth`]).
 #[cfg_attr(any(test, feature = "insecure"), allow(unused_variables))]
 #[cfg_attr(any(test, feature = "insecure"), allow(clippy::unused_async))]
 pub(crate) async fn verify_auth_verifier_jwt(

crate/test_kms_server/README.md

@@ -355,9 +355,6 @@ replays the steps sequentially.
 | OPA | `opa/mode_enforcing_native_co_cert_allowed` | OPA enforcing mode. A client authenticated via mTLS (cert CN = <owner.client@acme.com>) | 2 |
 | OPA | `opa/mode_enforcing_unknown_role_denied` | OPA enforcing mode. A bearer token carrying an unrecognised role `Hacker` | 1 |
 | OPA | `opa/mode_enforcing_wrong_domain` | OPA enforcing (dual-gate) mode — multi-tenant isolation. | 3 |
-| OPA | `opa/mode_enforcing_empty_roles_denied` | OPA enforcing mode. A bearer token with an empty `roles` claim (and no domain) | 1 |
-| OPA | `opa/mode_enforcing_native_co_cert_allowed` | OPA enforcing mode. A client authenticated via mTLS (cert CN = <owner.client@acme.com>) | 2 |
-| OPA | `opa/mode_enforcing_unknown_role_denied` | OPA enforcing mode. A bearer token carrying an unrecognised role `Hacker` | 1 |
 | OPA | `opa/mode_exclusive_allowed` | OPA exclusive mode; JWT with CryptoOfficer role from auth server; Create then Get allowed by is_owner=true. | 3 |
 | OPA | `opa/mode_exclusive_auditor_destroy_denied` | OPA exclusive mode. The CryptoOfficer (default JWT client, owner) creates an AES key. | 3 |
 | OPA | `opa/mode_exclusive_auditor_get_attributes_allowed` | OPA exclusive mode. The CryptoOfficer (default JWT client, owner) creates an AES key. | 3 |