tiki-archive / l0-registry Goto Github PK

The id slice is the customer-registered/specified id, which maps to a list of addresses.

Requirements:

• prove private key ownership to register and address
• append, if id exists.
• create a signing key for each id
• to get a list of addresses for an id requires key ownership proof of an address in the list
• return the sign key when getting the addresses
• nice to have: sign key auto-rotation

API:
POST /id
GET /id/{id}
DELETE /id/{id}

Security:
token: JWT from L0-auth
scope:

• registry for POST/GET
• registry:admin for DELETE

following the pattern described in l0-auth (https://github.com/tiki/l0-auth) set up:

• terraform scripts
• terraform cloud
• GitHub actions
• codeql
• pull request integration & release strategy
• prod.dockerfile

See README.md for spec.

required result: create_tables.sql

Initialize the project with the following setup:

• gitignore(s)
• docker compose
• spring-boot folder structure
• empty database

in spring boot maven project set up:

• openapi auto gen
• prod, local, and dev .properties file(s)
• health check

On each new user registered we need to report usage to Stripe for billing.

Note: This should be treated as a non-blocking event and executed in a separate thread

1. Get the total user count for the account, if > 1000 and there is no billing id cached, fetch billing id from l0-auth
2. Report both the new user registration AND the total user count to stripe.

A token with admin privilege AND a subject matching the appId should be able to delete a Id record

Add JWT security using L0-auth JWKS for all endpoints.

See https://github.com/tiki/l0-storage/blob/main/src/main/java/com/mytiki/l0_storage/security/SecurityConfig.java for an example on how to implement.

Add an optional JWKS verification endpoint for id registration.

Requirements:

• If there is a valid JWKS endpoint in the config, require it to pass on registration
• Allow optional subject claim verification
• Support RS256 (RSA) and ES256 (EC)

The config slice is the customer-specific configuration for the registry.

Options:

• A mandatory app id (from the console & embedded in JWTs as the subject)
• An optional JWKS endpoint

API:
POST /app
GET /app/{id}
DELETE /app/{id}

Security:
token: JWT from L0-auth
scope: registry:admin