From f3786e9f3ff226ccfc198e9e4d5a45acffdec593 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gabriel=20N=C3=BCtzi?= Date: Tue, 13 Oct 2026 15:08:12 +0200 Subject: [PATCH 1/3] fix: test services outfactor --- tools/nix/flake/debug.parts.nix | 6 + tools/nix/flake/nixpkgs.parts.nix | 12 +- tools/nix/services/make-proc-comp-setup.nix | 190 +++++++++++++++++++ tools/nix/services/test.parts.nix | 192 ++------------------ 4 files changed, 211 insertions(+), 189 deletions(-) create mode 100644 tools/nix/flake/debug.parts.nix create mode 100644 tools/nix/services/make-proc-comp-setup.nix diff --git a/tools/nix/flake/debug.parts.nix b/tools/nix/flake/debug.parts.nix new file mode 100644 index 00000000..d280b95f --- /dev/null +++ b/tools/nix/flake/debug.parts.nix @@ -0,0 +1,6 @@ +{ ... }: { + # To enable a `debug` output on the flake outputs to + # inspect the whole NixOS module system. + # + debug = false; +} diff --git a/tools/nix/flake/nixpkgs.parts.nix b/tools/nix/flake/nixpkgs.parts.nix index 562b5f98..9679f2cf 100644 --- a/tools/nix/flake/nixpkgs.parts.nix +++ b/tools/nix/flake/nixpkgs.parts.nix @@ -11,17 +11,7 @@ ... }: let - p = self.lib.nixpkgs.importPkgs { inherit system; }; - - pkgs = - assert lib.assertMsg (p.multiverse.rev == inputs.nixpkgs.rev) '' - Input 'nixpkgs' (unstable) revision must - be aligned with `importPkgs` - '${p.multiverse.rev}'."; - Change it in 'flake.nix'. - ''; - p; - + pkgs = self.lib.nixpkgs.importPkgs { inherit system; }; pkgsStable = self.lib.nixpkgs.importPkgsStable { inherit system; }; mvs = self.lib.nixpkgs.mkMultiverse { inherit system; }; diff --git a/tools/nix/services/make-proc-comp-setup.nix b/tools/nix/services/make-proc-comp-setup.nix new file mode 100644 index 00000000..26664116 --- /dev/null +++ b/tools/nix/services/make-proc-comp-setup.nix @@ -0,0 +1,190 @@ +{ + inputs, + inputs', + self, + self', + modos', + useNix ? true, + ... +}: + +# This is a process-compose-flake NixOS module to configure a full process-compose setup with +# all services. +{ + lib, + config, + pkgs, + ... +}: +let + servicesCfg = config; + ak = servicesCfg.services.authentik; + + setDataDir = + procs: + lib.mapAttrs ( + k: v: + v + // { + dataDir = ".output/run/process-compose/data/${k}"; + } + ) procs; +in +{ + imports = [ + inputs.services-flake.processComposeModules.default + self.processComposeModules.keycloak + self.processComposeModules.authentik + self.processComposeModules.rustfs + + self.processComposeModules.kms + ]; + + # Use a pinned version for process-compose. + package = modos'.packages.pinned.process-compose; + + cli.options = { + unix-socket = "./.output/run/process-compose/pc-test-services.sock"; + log-file = ".output/run/process-compose/log.txt"; + no-server = false; + }; + + settings = { + log_level = "debug"; + ordered_shutdown = true; + log_configuration = { + disable_json = true; + no_color = true; + no_metadata = true; + }; + }; + + defaults.processSettings = + { name, ... }: + { + availability.restart = lib.mkDefault "no"; + availability.max_restarts = lib.mkDefault 0; + log_location = ".output/run/process-compose/log/${name}.log"; + log_configuration = { + disable_json = true; + no_color = true; + }; + }; + + services.postgres = setDataDir ak.services.postgres; + + services.authentik = { + enable = true; + dataDir = ".output/run/process-compose/data"; + + components = inputs'.authentik-nix.legacyPackages.authentikComponents; + secretKey = "test"; + + initialAdminEmail = "admin@example.com"; + initialAdminPassword = "admin"; + + server.http.port = 9001; + worker.http.port = 9002; + + blueprints = { + export = { + enable = true; + path = "tools/configs/authentik/export.yaml"; + }; + + imports = [ + ../../configs/authentik/modos-brand-blueprint.yaml + ../../configs/authentik/modos-groups-users-blueprint.yaml + ../../configs/authentik/modos-enrollment-blueprint.yaml + ../../configs/authentik/modos-oauth-blueprint.yaml + ]; + }; + }; + + services.keycloak = { + enable = true; + dataDir = ".output/run/process-compose/data"; + + settings.http-port = 8081; + + # User is `admin`. + initialAdminPassword = "admin"; + + plugins = [ + modos'.packages.component.keycloak-mapper.plugin + ]; + + realms = { + modos = { + path = "./tools/configs/keycloak/modos-realm.json"; + import = true; + export = true; + }; + }; + }; + + services.mailhog."mailhog" = { + smtp.port = 1026; + enable = true; + }; + + services.rustfs = { + enable = true; + dataDir = ".output/run/process-compose/data"; + + package = inputs'.rustfs-flake.packages.default; + server.port = 9010; + + # Web Interface + console = { + enable = true; + port = 9011; + }; + + accessKey = "rustfsadmin"; + secretKey = "rustfsadmin"; + + logLevel = "debug"; + + buckets = [ + "bucket-a" + "bucket-b" + ]; + + iam.import.path = "tools/configs/rustfs/iam-export"; + iam.export = { + enable = true; + path = "tools/configs/rustfs/iam-export"; + }; + }; + + services.kms = { + enable = true; + package = + if useNix then + self'.packages.kms-service + else + (pkgs.writeShellScriptBin "kms-service" '' + just nix::develop "default-nogh" just run + ''); + }; + + settings.processes.kms = { + working_dir = "./components/kms"; + # In ProcessCompose-Flake 1.122 its possible to do + # See: https://github.com/Platonic-Systems/process-compose-flake/pull/115 + # watch = lib.optionalAttrs !nix { + # debounce = "300ms"; + # paths = [ + # { + # path = "./components/kms"; + # } + # ]; + # }; + depends_on = { + keycloak.condition = "process_healthy"; + authentik.condition = "process_healthy"; + rustfs.condition = "process_healthy"; + }; + }; +} diff --git a/tools/nix/services/test.parts.nix b/tools/nix/services/test.parts.nix index fe6a3f0c..bfd9dbe9 100644 --- a/tools/nix/services/test.parts.nix +++ b/tools/nix/services/test.parts.nix @@ -2,6 +2,7 @@ self, lib, inputs, + options, ... }: { @@ -18,185 +19,19 @@ ... }: let - setDataDir = - procs: - lib.mapAttrs ( - k: v: - v - // { - dataDir = ".output/run/process-compose/data/${k}"; - } - ) procs; - makeServices = { - nix ? false, - }: - # Process-compose NixOS module. - { - config, - pkgs, - pkgsStable, - ... + useNix ? false, }: - let - servicesCfg = config; - ak = servicesCfg.services.authentik; - in - { - imports = [ - inputs.services-flake.processComposeModules.default - self.processComposeModules.keycloak - self.processComposeModules.authentik - self.processComposeModules.rustfs - - self.processComposeModules.kms - ]; - - cli.options = { - unix-socket = "./.output/run/process-compose/pc-test-services.sock"; - log-file = ".output/run/process-compose/log.txt"; - no-server = false; - }; - - settings = { - log_level = "debug"; - ordered_shutdown = true; - log_configuration = { - disable_json = true; - no_color = true; - no_metadata = true; - }; - }; - - defaults.processSettings = - { name, ... }: - { - availability.restart = lib.mkDefault "no"; - availability.max_restarts = lib.mkDefault 0; - log_location = ".output/run/process-compose/log/${name}.log"; - log_configuration = { - disable_json = true; - no_color = true; - }; - }; - - services.postgres = setDataDir ak.services.postgres; - - services.authentik = { - enable = true; - dataDir = ".output/run/process-compose/data"; - - components = inputs'.authentik-nix.legacyPackages.authentikComponents; - secretKey = "test"; - - initialAdminEmail = "admin@example.com"; - initialAdminPassword = "admin"; - - server.http.port = 9001; - worker.http.port = 9002; - - blueprints = { - export = { - enable = true; - path = "tools/configs/authentik/export.yaml"; - }; - - imports = [ - ../../configs/authentik/modos-brand-blueprint.yaml - ../../configs/authentik/modos-groups-users-blueprint.yaml - ../../configs/authentik/modos-enrollment-blueprint.yaml - ../../configs/authentik/modos-oauth-blueprint.yaml - ]; - }; - }; - - services.keycloak = { - enable = true; - dataDir = ".output/run/process-compose/data"; - - settings.http-port = 8081; - - # User is `admin`. - initialAdminPassword = "admin"; - - plugins = [ - modos'.packages.component.keycloak-mapper.plugin - ]; - - realms = { - modos = { - path = "./tools/configs/keycloak/modos-realm.json"; - import = true; - export = true; - }; - }; - }; - - services.mailhog."mailhog" = { - smtp.port = 1026; - enable = true; - }; - - services.rustfs = { - enable = true; - dataDir = ".output/run/process-compose/data"; - - package = inputs'.rustfs-flake.packages.default; - server.port = 9010; - - # Web Interface - console = { - enable = true; - port = 9011; - }; - - accessKey = "rustfsadmin"; - secretKey = "rustfsadmin"; - - logLevel = "debug"; - - buckets = [ - "bucket-a" - "bucket-b" - ]; - - iam.import.path = "tools/configs/rustfs/iam-export"; - iam.export = { - enable = true; - path = "tools/configs/rustfs/iam-export"; - }; - }; - - services.kms = { - enable = true; - package = - if nix then - self'.packages.kms-service - else - (pkgs.writeShellScriptBin "kms-service" '' - just nix::develop "default-nogh" just run - ''); - }; - - settings.processes.kms = { - working_dir = "./components/kms"; - # In ProcessCompose-Flake 1.122 its possible to do - # See: https://github.com/Platonic-Systems/process-compose-flake/pull/115 - # watch = lib.optionalAttrs !nix { - # debounce = "300ms"; - # paths = [ - # { - # path = "./components/kms"; - # } - # ]; - # }; - depends_on = { - keycloak.condition = "process_healthy"; - authentik.condition = "process_healthy"; - rustfs.condition = "process_healthy"; - }; - }; + import ./make-proc-comp-setup.nix { + inherit + inputs + inputs' + self + self' + modos' + useNix + ; }; in { @@ -204,13 +39,14 @@ # This test-services are with modos components running from `just run` # instead of a Nix derivation. # Note: This `test-services-*` package is exposed on `packages` outputs in the flake. - process-compose."test-services" = makeServices { nix = false; }; + process-compose."test-services" = makeServices { useNix = false; }; # This test-services are with all Nix derivations. - process-compose."test-services-nix" = makeServices { nix = true; }; + process-compose."test-services-nix" = makeServices { useNix = true; }; modos.services.config = { # Expose to further inspect. test-services = config.process-compose.test-services; + test-services-opts = options; }; }; } From 75716e11ee51653a6757e5c02f5015ebfef718a5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gabriel=20N=C3=BCtzi?= Date: Tue, 13 Oct 2026 17:04:11 +0200 Subject: [PATCH 2/3] fix: add grps basic endpoints --- components/kms/api/kms/v1/kms.proto | 17 ++-- components/kms/internal/grpc/auth.go | 6 +- components/kms/pkg/api/kms/v1/kms.pb.go | 78 +++++++++++++------ .../kms/pkg/service/grpc-get-credential.go | 43 +++++++++- components/kms/pkg/storage/s3/credential.go | 4 +- components/kms/pkg/storage/s3/storage.go | 2 +- components/kms/pkg/storage/types/client.go | 1 + components/kms/pkg/storage/types/error.go | 33 ++++++++ tools/nix/services/README.md | 4 +- 9 files changed, 149 insertions(+), 39 deletions(-) create mode 100644 components/kms/pkg/storage/types/error.go diff --git a/components/kms/api/kms/v1/kms.proto b/components/kms/api/kms/v1/kms.proto index c6a43298..1945bde3 100644 --- a/components/kms/api/kms/v1/kms.proto +++ b/components/kms/api/kms/v1/kms.proto @@ -2,7 +2,7 @@ syntax = "proto3"; package kms.v1; -import "protovalidate/buf/validate/validate.proto"; +import "google/protobuf/timestamp.proto"; // KMS hands out short-lived storage credentials. service KMS { @@ -11,11 +11,12 @@ service KMS { rpc GetCredential(GetCredentialRequest) returns (GetCredentialResponse); } -message GetCredentialRequest { - float latitude = 1 [ - (buf.validate.field).float.gte = -90, - (buf.validate.field).float.lte = 90 - ]; -} +// The only input is the JWT token handled over GRPC metadata. +message GetCredentialRequest { } -message GetCredentialResponse {} +message GetCredentialResponse { + string access_key_id = 1; + string secret_access_key = 2; + string session_token = 3; + google.protobuf.Timestamp expiration = 4; +} diff --git a/components/kms/internal/grpc/auth.go b/components/kms/internal/grpc/auth.go index 57253544..a32be026 100644 --- a/components/kms/internal/grpc/auth.go +++ b/components/kms/internal/grpc/auth.go @@ -27,7 +27,11 @@ func AuthenticationInterceptor( validator *auth.JWTVerifier, oidcCfg *config.OIDC, ) grpc.UnaryServerInterceptor { - return func(ctx context.Context, req any, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler, + return func( + ctx context.Context, + req any, + info *grpc.UnaryServerInfo, + handler grpc.UnaryHandler, ) (any, error) { token, err := extractToken(ctx) if err != nil { diff --git a/components/kms/pkg/api/kms/v1/kms.pb.go b/components/kms/pkg/api/kms/v1/kms.pb.go index 5aaf21ee..00289efd 100644 --- a/components/kms/pkg/api/kms/v1/kms.pb.go +++ b/components/kms/pkg/api/kms/v1/kms.pb.go @@ -7,9 +7,9 @@ package kmsv1 import ( - _ "buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go/buf/validate" protoreflect "google.golang.org/protobuf/reflect/protoreflect" protoimpl "google.golang.org/protobuf/runtime/protoimpl" + timestamppb "google.golang.org/protobuf/types/known/timestamppb" reflect "reflect" sync "sync" unsafe "unsafe" @@ -22,9 +22,9 @@ const ( _ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20) ) +// The only input is the JWT token handled over GRPC metadata. type GetCredentialRequest struct { state protoimpl.MessageState `protogen:"open.v1"` - Latitude float32 `protobuf:"fixed32,1,opt,name=latitude,proto3" json:"latitude,omitempty"` unknownFields protoimpl.UnknownFields sizeCache protoimpl.SizeCache } @@ -59,17 +59,14 @@ func (*GetCredentialRequest) Descriptor() ([]byte, []int) { return file_kms_v1_kms_proto_rawDescGZIP(), []int{0} } -func (x *GetCredentialRequest) GetLatitude() float32 { - if x != nil { - return x.Latitude - } - return 0 -} - type GetCredentialResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache + state protoimpl.MessageState `protogen:"open.v1"` + AccessKeyId string `protobuf:"bytes,1,opt,name=access_key_id,json=accessKeyId,proto3" json:"access_key_id,omitempty"` + SecretAccessKey string `protobuf:"bytes,2,opt,name=secret_access_key,json=secretAccessKey,proto3" json:"secret_access_key,omitempty"` + SessionToken string `protobuf:"bytes,3,opt,name=session_token,json=sessionToken,proto3" json:"session_token,omitempty"` + Expiration *timestamppb.Timestamp `protobuf:"bytes,4,opt,name=expiration,proto3" json:"expiration,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache } func (x *GetCredentialResponse) Reset() { @@ -102,16 +99,47 @@ func (*GetCredentialResponse) Descriptor() ([]byte, []int) { return file_kms_v1_kms_proto_rawDescGZIP(), []int{1} } +func (x *GetCredentialResponse) GetAccessKeyId() string { + if x != nil { + return x.AccessKeyId + } + return "" +} + +func (x *GetCredentialResponse) GetSecretAccessKey() string { + if x != nil { + return x.SecretAccessKey + } + return "" +} + +func (x *GetCredentialResponse) GetSessionToken() string { + if x != nil { + return x.SessionToken + } + return "" +} + +func (x *GetCredentialResponse) GetExpiration() *timestamppb.Timestamp { + if x != nil { + return x.Expiration + } + return nil +} + var File_kms_v1_kms_proto protoreflect.FileDescriptor const file_kms_v1_kms_proto_rawDesc = "" + "\n" + - "\x10kms/v1/kms.proto\x12\x06kms.v1\x1a)protovalidate/buf/validate/validate.proto\"C\n" + - "\x14GetCredentialRequest\x12+\n" + - "\blatitude\x18\x01 \x01(\x02B\x0f\xbaH\f\n" + + "\x10kms/v1/kms.proto\x12\x06kms.v1\x1a\x1fgoogle/protobuf/timestamp.proto\"\x16\n" + + "\x14GetCredentialRequest\"\xc8\x01\n" + + "\x15GetCredentialResponse\x12\"\n" + + "\raccess_key_id\x18\x01 \x01(\tR\vaccessKeyId\x12*\n" + + "\x11secret_access_key\x18\x02 \x01(\tR\x0fsecretAccessKey\x12#\n" + + "\rsession_token\x18\x03 \x01(\tR\fsessionToken\x12:\n" + "\n" + - "\x1d\x00\x00\xb4B-\x00\x00\xb4\xc2R\blatitude\"\x17\n" + - "\x15GetCredentialResponse2S\n" + + "expiration\x18\x04 \x01(\v2\x1a.google.protobuf.TimestampR\n" + + "expiration2S\n" + "\x03KMS\x12L\n" + "\rGetCredential\x12\x1c.kms.v1.GetCredentialRequest\x1a\x1d.kms.v1.GetCredentialResponseB\x93\x01\n" + "\n" + @@ -133,15 +161,17 @@ var file_kms_v1_kms_proto_msgTypes = make([]protoimpl.MessageInfo, 2) var file_kms_v1_kms_proto_goTypes = []any{ (*GetCredentialRequest)(nil), // 0: kms.v1.GetCredentialRequest (*GetCredentialResponse)(nil), // 1: kms.v1.GetCredentialResponse + (*timestamppb.Timestamp)(nil), // 2: google.protobuf.Timestamp } var file_kms_v1_kms_proto_depIdxs = []int32{ - 0, // 0: kms.v1.KMS.GetCredential:input_type -> kms.v1.GetCredentialRequest - 1, // 1: kms.v1.KMS.GetCredential:output_type -> kms.v1.GetCredentialResponse - 1, // [1:2] is the sub-list for method output_type - 0, // [0:1] is the sub-list for method input_type - 0, // [0:0] is the sub-list for extension type_name - 0, // [0:0] is the sub-list for extension extendee - 0, // [0:0] is the sub-list for field type_name + 2, // 0: kms.v1.GetCredentialResponse.expiration:type_name -> google.protobuf.Timestamp + 0, // 1: kms.v1.KMS.GetCredential:input_type -> kms.v1.GetCredentialRequest + 1, // 2: kms.v1.KMS.GetCredential:output_type -> kms.v1.GetCredentialResponse + 2, // [2:3] is the sub-list for method output_type + 1, // [1:2] is the sub-list for method input_type + 1, // [1:1] is the sub-list for extension type_name + 1, // [1:1] is the sub-list for extension extendee + 0, // [0:1] is the sub-list for field type_name } func init() { file_kms_v1_kms_proto_init() } diff --git a/components/kms/pkg/service/grpc-get-credential.go b/components/kms/pkg/service/grpc-get-credential.go index 009d7221..7f3729b7 100644 --- a/components/kms/pkg/service/grpc-get-credential.go +++ b/components/kms/pkg/service/grpc-get-credential.go @@ -2,10 +2,15 @@ package service import ( "context" + "time" "github.com/sdsc-ordes/modos-rs/components/kms/internal/grpc" kms "github.com/sdsc-ordes/modos-rs/components/kms/pkg/api/kms/v1" + "github.com/sdsc-ordes/modos-rs/components/kms/pkg/storage/s3" clog "gitlab.com/data-custodian/custodian/components/lib-common/pkg/log/context" + "google.golang.org/grpc/codes" + "google.golang.org/grpc/status" + "google.golang.org/protobuf/types/known/timestamppb" ) // Assert that service implements the kmsv1.Server. @@ -18,7 +23,41 @@ func (s *Service) GetCredential( ) (*kms.GetCredentialResponse, error) { clog.Info(ctx, "Get credential start.") - _ = grpc.Claims(ctx) + cl := grpc.Claims(ctx) - return &kms.GetCredentialResponse{}, nil + creds, err := s.Storage.NewCredentials( + ctx, + cl.BucketPermissions, + 1*time.Hour, + ) + if err != nil { + return nil, status.Errorf( + codes.Unauthenticated, + "retrieving credential failed") + } + + switch creds.Type() { + case s3.CredentialType: + c, ok := creds.(*s3.S3Credentials) + if !ok { + clog.Errorf(ctx, "Could not convert to S3 credential") + + return nil, status.Errorf( + codes.Internal, + "storage type '%v' not implemented", + creds.Type()) + } + + return &kms.GetCredentialResponse{ + AccessKeyId: (string)(c.AccessKeyID), + SecretAccessKey: (string)(c.SecretAccessKey), + SessionToken: (string)(c.SessionToken), + Expiration: timestamppb.New(c.Expiration), + }, nil + } + + return nil, status.Errorf( + codes.Internal, + "storage type '%v' not implemented", + creds.Type()) } diff --git a/components/kms/pkg/storage/s3/credential.go b/components/kms/pkg/storage/s3/credential.go index 6e4bc696..4386e6ca 100644 --- a/components/kms/pkg/storage/s3/credential.go +++ b/components/kms/pkg/storage/s3/credential.go @@ -7,6 +7,8 @@ import ( "gitlab.com/data-custodian/custodian/components/lib-common/pkg/secret" ) +const CredentialType = "s3" + // S3Credentials represents temp. credentials from an S3. // It is not serializable. type S3Credentials struct { @@ -35,7 +37,7 @@ type marshaller struct { // Type implements [types.Credential]. func (c *S3Credentials) Type() string { - return "s3" + return CredentialType } // MarshalerJSON implements [types.Credential]. diff --git a/components/kms/pkg/storage/s3/storage.go b/components/kms/pkg/storage/s3/storage.go index b75db506..9be4837b 100644 --- a/components/kms/pkg/storage/s3/storage.go +++ b/components/kms/pkg/storage/s3/storage.go @@ -76,8 +76,8 @@ func (c *Client) NewCredentials( return &S3Credentials{ AccessKeyID: secret.RedactedString(*res.Credentials.AccessKeyId), - SessionToken: secret.RedactedString(*res.Credentials.SessionToken), SecretAccessKey: secret.RedactedString(*res.Credentials.SecretAccessKey), + SessionToken: secret.RedactedString(*res.Credentials.SessionToken), Expiration: *res.Credentials.Expiration, }, nil } diff --git a/components/kms/pkg/storage/types/client.go b/components/kms/pkg/storage/types/client.go index 06982df9..15393d0c 100644 --- a/components/kms/pkg/storage/types/client.go +++ b/components/kms/pkg/storage/types/client.go @@ -13,6 +13,7 @@ type ( // NewCredentials returns a scoped token for bucket permissions `permissions` // with duration `dur`. + // Returns [CredentialError]s as errors. NewCredentials( ctx context.Context, perms BucketPermissions, diff --git a/components/kms/pkg/storage/types/error.go b/components/kms/pkg/storage/types/error.go new file mode 100644 index 00000000..948b8210 --- /dev/null +++ b/components/kms/pkg/storage/types/error.go @@ -0,0 +1,33 @@ +package types + +import "fmt" + +var _ error = (*err)(nil) +var _ error = (*PermissionError)(nil) +var _ error = (*DurationError)(nil) + +type ( + err struct { + Message string + } + + PermissionError struct { + err + } + + DurationError struct { + err + } +) + +func (err *err) Error() string { + return err.Message +} + +func NewPermissionsError(msg string, args ...any) error { + return &PermissionError{err{Message: fmt.Sprintf(msg, args...)}} +} + +func NewDurationError(msg string, args ...any) error { + return &DurationError{err{Message: fmt.Sprintf(msg, args...)}} +} diff --git a/tools/nix/services/README.md b/tools/nix/services/README.md index 33ea78eb..e6748e0e 100644 --- a/tools/nix/services/README.md +++ b/tools/nix/services/README.md @@ -3,12 +3,12 @@ ## Start Services ```bash -just services-start +just services start ``` > [!NOTE] > -> `Ctrl+D` to detach from the TUI and `just services-attach` to attach again. +> `Ctrl+D` to detach from the TUI and `just services attach` to attach again. ## Keycloak From b462fefd0cd147d8898003a4a5bedf28795b300d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gabriel=20N=C3=BCtzi?= Date: Wed, 14 Oct 2026 10:33:50 +0200 Subject: [PATCH 3/3] fix: linting --- components/kms/go.mod | 2 +- components/kms/pkg/service/grpc-get-credential.go | 13 +++++++------ components/kms/test/go.sum | 1 + 3 files changed, 9 insertions(+), 7 deletions(-) diff --git a/components/kms/go.mod b/components/kms/go.mod index dba7b6d2..92f0eed4 100644 --- a/components/kms/go.mod +++ b/components/kms/go.mod @@ -6,7 +6,6 @@ go 1.26.0 // replace gitlab.com/data-custodian/custodian/components/lib-common => ../../../custodian/components/lib-common require ( - buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.12-20260825204119-511051f7f437.2 buf.build/go/protovalidate v1.0.0 github.com/alexflint/go-arg v1.5.1 github.com/aws/aws-sdk-go-v2 v1.47.0 @@ -28,6 +27,7 @@ require ( ) require ( + buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.12-20260825204119-511051f7f437.2 // indirect cel.dev/expr v0.25.2 // indirect github.com/Masterminds/semver/v3 v3.4.0 // indirect github.com/alexflint/go-scalar v1.2.0 // indirect diff --git a/components/kms/pkg/service/grpc-get-credential.go b/components/kms/pkg/service/grpc-get-credential.go index 7f3729b7..64a1827c 100644 --- a/components/kms/pkg/service/grpc-get-credential.go +++ b/components/kms/pkg/service/grpc-get-credential.go @@ -16,7 +16,7 @@ import ( // Assert that service implements the kmsv1.Server. var _ kms.KMSServer = (*Service)(nil) -// GetCredential implements [kms.KmsServer]. +// GetCredential implements [kms.KMSServer]. func (s *Service) GetCredential( ctx context.Context, _ *kms.GetCredentialRequest, @@ -54,10 +54,11 @@ func (s *Service) GetCredential( SessionToken: (string)(c.SessionToken), Expiration: timestamppb.New(c.Expiration), }, nil - } - return nil, status.Errorf( - codes.Internal, - "storage type '%v' not implemented", - creds.Type()) + default: + return nil, status.Errorf( + codes.Internal, + "credential type '%v' not implemented", creds.Type(), + ) + } } diff --git a/components/kms/test/go.sum b/components/kms/test/go.sum index c515b88f..e8ddbd18 100644 --- a/components/kms/test/go.sum +++ b/components/kms/test/go.sum @@ -275,6 +275,7 @@ gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EV gopkg.in/natefinch/lumberjack.v2 v2.2.1 h1:bBRl1b0OH9s/DuPhuXpNl+VtCaJXFZ5/uEFST95x9zc= gopkg.in/natefinch/lumberjack.v2 v2.2.1/go.mod h1:YD8tP3GAjkrDg1eZH7EGmyESg/lsYskCTPBJVb9jqSc= gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY= +gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ= gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=