feat(auth): start storing `apiSecret` in `auth` and add tenant signature middleware #3696

mkurapov · 2025-10-09T17:45:36Z

Changes proposed in this pull request

Add apiSecret to tenant table in auth
Seed apiSecret from env variable for operator
Propagate apiSecret from backend to auth when creating new tenants
On auth startup, update apiSecret if it has changed
Add middleware to Admin API to fetch correct tenant from signature
Update tableManager tests to properly handle tenant tests

Context

Fixes #3692 | RAF-1191

Checklist

Related issues linked using fixes #number
Tests added/updated
Make sure that all checks pass
Bruno collection updated (if necessary)
Documentation issue created with user-docs label (if necessary)
OpenAPI specs updated (if necessary)

netlify · 2025-10-09T17:45:42Z

✅ Deploy Preview for brilliant-pasca-3e80ec canceled.

Name	Link
🔨 Latest commit	`a15bde6`
🔍 Latest deploy log	https://app.netlify.com/projects/brilliant-pasca-3e80ec/deploys/68e9325a41fb0a00083a19fe

github-actions · 2025-10-09T17:50:21Z

🚀 Performance Test Results

Test Configuration:

VUs: 4
Duration: 1m0s

Test Metrics:

Requests/s: 43.25
Iterations/s: 14.45
Failed Requests: 0.00% (0 of 2602)

📜 Logs


> performance@1.0.0 run-tests:testenv /home/runner/work/rafiki/rafiki/test/performance
> ./scripts/run-tests.sh -e test "-k" "-q" "--vus" "4" "--duration" "1m"

Cloud Nine GraphQL API is up: http://localhost:3101/graphql
Cloud Nine Wallet Address is up: http://localhost:3100/
Happy Life Bank Address is up: http://localhost:4100/
cloud-nine-wallet-test-backend already set
cloud-nine-wallet-test-auth already set
happy-life-bank-test-backend already set
happy-life-bank-test-auth already set
     data_received..................: 939 kB 16 kB/s
     data_sent......................: 2.0 MB 33 kB/s
     http_req_blocked...............: avg=7.84µs   min=2.04µs  med=5.38µs   max=2.34ms   p(90)=6.52µs   p(95)=7.01µs  
     http_req_connecting............: avg=1.77µs   min=0s      med=0s       max=2.29ms   p(90)=0s       p(95)=0s      
     http_req_duration..............: avg=91.81ms  min=6.56ms  med=76.4ms   max=581.86ms p(90)=155.34ms p(95)=176.31ms
       { expected_response:true }...: avg=91.81ms  min=6.56ms  med=76.4ms   max=581.86ms p(90)=155.34ms p(95)=176.31ms
     http_req_failed................: 0.00%  ✓ 0         ✗ 2602
     http_req_receiving.............: avg=92.64µs  min=26.63µs med=81.46µs  max=2ms      p(90)=117.41µs p(95)=148.53µs
     http_req_sending...............: avg=38.96µs  min=10.32µs med=28.53µs  max=2.86ms   p(90)=42.05µs  p(95)=57.39µs 
     http_req_tls_handshaking.......: avg=0s       min=0s      med=0s       max=0s       p(90)=0s       p(95)=0s      
     http_req_waiting...............: avg=91.68ms  min=6.45ms  med=76.28ms  max=581.77ms p(90)=155.23ms p(95)=176.14ms
     http_reqs......................: 2602   43.253748/s
     iteration_duration.............: avg=276.57ms min=171ms   med=264.63ms max=1.08s    p(90)=329.03ms p(95)=357.98ms
     iterations.....................: 869    14.445622/s
     vus............................: 4      min=4       max=4 
     vus_max........................: 4      min=4       max=4

BlairCurrey · 2025-10-09T20:14:07Z

packages/backend/src/tenants/service.ts


    if (idpConsentUrl || idpSecret) {
      await deps.authServiceClient.tenant.update(id, {
+        apiSecret,


This is sort of tangential - dont think there is anything wrong here. But I dont think we're actually able to update tenants from the UI. Are we supposed to be able to?

As-is, it seems like the API secret is only visible to operators. For any tenant (self or non-operators). But its disabled if you're an operator (enabled if you're not, but you cant see it).

Im not really sure what the intended behavior is supposed to be but I dont see any scenario where you can update from the UI.

I noticed this too. For the information that the auth service already stores, like the idp secret or consent screen URL, any updates are handled initially by the backend service, then propagated through to the auth service. So I think the apiSecret has this same dynamic.

I think its coming back to me... just saw this when trying to update via bruno:

"Operator cannot update apiSecret over admin api"

So working as intended I think.

But this begs the question, what happens if we set the env var secret to different things? I believe they would just be different (or perhaps backed would overwrite what auth does itself if it starts up later). Obviously people should not do that but not sure if there is really a graceful way to warn.

So it looks like the only possibility of updating the apiSecret is if the tenant calls the updateTenant mutation directly via the API, and not the UI. Do you think that is OK behaviour?

If so, then we can keep this as is, and just propagate the apiSecret like the other fields. I also changed the conditional to make sure we get the change across to auth.

So it looks like the only possibility of updating the apiSecret is if the tenant calls the updateTenant mutation directly via the API, and not the UI.

I was able to update in bruno (add in ui, get id, change senderTenantId and backendApiSignatureSecret in bruno config, change id in bruno's "Rafiki Admin API" > "Update tenant" request variables).

~~After I did, I tried to use the admin ui with the new credentials. I saw the and saw some unauthorized errors. Seems like there is an issue there.~~

~~I also saw the same thing when I hastily added in an input for the secret for non-operator tenants.~~

Do you think that is OK behaviour?

I would expect that they can change it from the UI, if they are allowed to change it at all. Which I think they should.

never mind on part of that, but there is something we need to fix if we add a form input for the api secret for non operators. I added one (and the schema validator), submitted, and got unauthorized error. it did update the secret but the browser session didnt seem to udpate. worked fine when i manually cleared and re-entered. There is code that looks like it should be setting on the session but something is wrong there.

Although its interesting that we have that code to update the session... because as-is the code only shows a disabled input for the api secret if you are the operator. You cant update if you are non-operator, nor see it. So the code to update the session on api secret change would just never run? I think we intended to let the non operator update at one point at least.

I just tested as well and yes, I also need to clear the credentials and re-set them manually in Admin UI before it works.

We can put that as an enhancement but I don't see it being something of high priority to fix.

BlairCurrey

Looks good w/ the caveat in my comment:

But this begs the question, what happens if we set the env var secret to different things? I believe they would just be different (or perhaps backed would overwrite what auth does itself if it starts up later). Obviously people should not do that but not sure if there is really a graceful way to warn.

Not sure if there is much we can do about that.

njlie · 2025-10-09T20:58:56Z

packages/auth/src/tenant/routes.test.ts

    test('Gets a tenant', async (): Promise<void> => {
      const tenant = await Tenant.query().insert({
        id: v4(),
+        apiSecret: v4(),


This test is missing an assertion that this value was retrieved

Actually, do we need this get route in the first place?

Don't think so. Anything the auth service knows about the tenant is also known by the backend, which already exposes a way to get a tenant.

I will do some cleanup in another PR

packages/auth/src/tenant/routes.test.ts

njlie · 2025-10-09T21:06:43Z

packages/auth/src/signature/tenant.ts

+import * as crypto from 'crypto'
+import Koa from 'koa'
+
+function getSignatureParts(signature: string) {


Not relavant to whether or not this gets merged in but I feel as though we are reaching the point where signature verification should be a shared library between the Rafiki services

Yes, especially now with the cards & POS services

njlie · 2025-10-09T21:26:44Z

packages/auth/src/shared/utils.test.ts

-  let appContainer: TestContainer
-  let redis: Redis
-
-  describe('admin api signatures', (): void => {


Some of these tests don't appear to be replaced elsewhere

This is now encapsulated here: https://github.com/interledger/rafiki/pull/3696/files#diff-9dc226aa3bdbd465fa663bc9a108df25348ba71dc7982cd1ad178fcdf3524aadR18

Does it still test stuff like if the signature is too old to be processed or if it has already been processed?

Ah, good catch. Adding old signature tests

mkurapov · 2025-10-10T11:28:41Z

@BlairCurrey

But this begs the question, what happens if we set the env var secret to different things? I believe they would just be different (or perhaps backed would overwrite what auth does itself if it starts up later). Obviously people should not do that but not sure if there is really a graceful way to warn.

This wouldn't really be the case but you could have different API secrets in auth & backend, and as long as you use the correct API key to call each of the APIs its OK

…ated

BlairCurrey · 2025-10-10T14:08:40Z

@mkurapov

But this begs the question, what happens if we set the env var secret to different things? I believe they would just be different (or perhaps backed would overwrite what auth does itself if it starts up later). Obviously people should not do that but not sure if there is really a graceful way to warn.

This wouldn't really be the case but you could have different API secrets in auth & backend, and as long as you use the correct API key to call each of the APIs its OK

Yes I think you are right. I was conflating the operator/tenant flows in my head but they are different.

Operator cannot update apiSecret via admin api. They must use environment variables. They may be different and clients can simply use these separate secrets. Fine.

Tenants can update apiSecret via the backend mutation. This propagates to the auth client. They are always the same. Fine.

I was thinking of the scenario where they are set both from the environment variables and the admin api which propagates. But this case isn't possible since the environment variables are for the operator and the operator cannot be updated via the admin api.

mkurapov added 8 commits October 9, 2025 17:24

feat(auth): add migration to seed operators api secret

08f1ac2

feat(auth): propagate apiSecret during tenant creation

33ef3d2

test(auth): update api secret tests & tableManager

d3372d1

chore(localenv): update ADMIN_API_SECRET in docker compose files

e72808d

chore(bruno): update authApiSignatureSecret in requests

c11ccb5

feat(auth): add getTenantFromApiSignature middleware

e69b7bc

chore(auth): move tenant signature functions to separate file

6b85f54

feat(auth): update authed tenant middleware, and add tests

1228276

github-actions bot added type: tests Testing related pkg: backend Changes in the backend package. type: source Changes business logic pkg: auth Changes in the GNAP auth package. labels Oct 9, 2025

test(backend): update tenant test

6d48aaa

mkurapov force-pushed the max/raf-1191 branch from 415508b to 6d48aaa Compare October 9, 2025 17:53

chore(testenv): add ADMIN_API_SECRET to auth

f14a2d3

mkurapov marked this pull request as ready for review October 9, 2025 18:01

mkurapov requested review from BlairCurrey and njlie October 9, 2025 18:02

BlairCurrey reviewed Oct 9, 2025

View reviewed changes

BlairCurrey previously approved these changes Oct 9, 2025

View reviewed changes

njlie reviewed Oct 9, 2025

View reviewed changes

feat(backend): call the auth service client if apiSecret has been upd…

e39c343

…ated

mkurapov dismissed BlairCurrey’s stale review via e39c343 October 10, 2025 11:34

mkurapov added 2 commits October 10, 2025 13:38

test(auth): update tenant signature test name

679d0f0

feat(auth): update tenant response from auth api to include the apiSecet

4e788a0

test(auth): add additional tests for tenant signature verification

a15bde6

mkurapov requested review from BlairCurrey and njlie October 10, 2025 16:32

mkurapov mentioned this pull request Oct 10, 2025

feat(auth): add tenant boundaries to auth GraphQL resolvers #3697

Merged

6 tasks

BlairCurrey approved these changes Oct 10, 2025

View reviewed changes

njlie approved these changes Oct 10, 2025

View reviewed changes

mkurapov merged commit 0c08e41 into main Oct 10, 2025
32 of 44 checks passed

mkurapov deleted the max/raf-1191 branch October 10, 2025 18:31

feat(auth): start storing apiSecret in auth and add tenant signature middleware #3696

feat(auth): start storing apiSecret in auth and add tenant signature middleware #3696

Uh oh!

Conversation

mkurapov commented Oct 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes proposed in this pull request

Context

Checklist

Uh oh!

netlify bot commented Oct 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for brilliant-pasca-3e80ec canceled.

Uh oh!

github-actions bot commented Oct 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 Performance Test Results

Uh oh!

Choose a reason for hiding this comment

Uh oh!

njlie Oct 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

BlairCurrey Oct 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

BlairCurrey Oct 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

BlairCurrey left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mkurapov commented Oct 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

BlairCurrey commented Oct 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

feat(auth): start storing `apiSecret` in `auth` and add tenant signature middleware #3696

feat(auth): start storing `apiSecret` in `auth` and add tenant signature middleware #3696

mkurapov commented Oct 9, 2025 •

edited

Loading

netlify bot commented Oct 9, 2025 •

edited

Loading

github-actions bot commented Oct 9, 2025 •

edited

Loading

njlie Oct 9, 2025 •

edited

Loading

BlairCurrey Oct 10, 2025 •

edited

Loading

BlairCurrey Oct 10, 2025 •

edited

Loading

mkurapov commented Oct 10, 2025 •

edited

Loading

BlairCurrey commented Oct 10, 2025 •

edited

Loading