fix: finalize basic GRCP GetCredential endpoint

components/kms/api/kms/v1/kms.proto

@@ -2,7 +2,7 @@ syntax = "proto3";
 
 package kms.v1;
 
-import "protovalidate/buf/validate/validate.proto";
+import "google/protobuf/timestamp.proto";
 
 // KMS hands out short-lived storage credentials.
 service KMS {
@@ -11,11 +11,12 @@ service KMS {
   rpc GetCredential(GetCredentialRequest) returns (GetCredentialResponse);
 }
 
-message GetCredentialRequest {
-  float latitude = 1 [
-    (buf.validate.field).float.gte = -90,
-    (buf.validate.field).float.lte = 90
-  ];
-}
+// The only input is the JWT token handled over GRPC metadata.
+message GetCredentialRequest { }
 
-message GetCredentialResponse {}
+message GetCredentialResponse {
+    string access_key_id = 1;
+    string secret_access_key = 2;
+    string session_token = 3;
+    google.protobuf.Timestamp expiration = 4;
+}

components/kms/go.mod

@@ -6,7 +6,6 @@ go 1.26.0
 // replace gitlab.com/data-custodian/custodian/components/lib-common => ../../../custodian/components/lib-common
 
 require (
-	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.12-20260825204119-511051f7f437.2
 	buf.build/go/protovalidate v1.0.0
 	github.com/alexflint/go-arg v1.5.1
 	github.com/aws/aws-sdk-go-v2 v1.47.0
@@ -28,6 +27,7 @@ require (
 )
 
 require (
+	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.12-20260825204119-511051f7f437.2 // indirect
 	cel.dev/expr v0.25.2 // indirect
 	github.com/Masterminds/semver/v3 v3.4.0 // indirect
 	github.com/alexflint/go-scalar v1.2.0 // indirect

components/kms/internal/grpc/auth.go

@@ -27,7 +27,11 @@ func AuthenticationInterceptor(
 	validator *auth.JWTVerifier,
 	oidcCfg *config.OIDC,
 ) grpc.UnaryServerInterceptor {
-	return func(ctx context.Context, req any, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler,
+	return func(
+		ctx context.Context,
+		req any,
+		info *grpc.UnaryServerInfo,
+		handler grpc.UnaryHandler,
 	) (any, error) {
 		token, err := extractToken(ctx)
 		if err != nil {

components/kms/pkg/service/grpc-get-credential.go

@@ -2,23 +2,63 @@ package service
 
 import (
 	"context"
+	"time"
 
 	"github.com/sdsc-ordes/modos-rs/components/kms/internal/grpc"
 	kms "github.com/sdsc-ordes/modos-rs/components/kms/pkg/api/kms/v1"
+	"github.com/sdsc-ordes/modos-rs/components/kms/pkg/storage/s3"
 	clog "gitlab.com/data-custodian/custodian/components/lib-common/pkg/log/context"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/timestamppb"
 )
 
 // Assert that service implements the kmsv1.Server.
 var _ kms.KMSServer = (*Service)(nil)
 
-// GetCredential implements [kms.KmsServer].
+// GetCredential implements [kms.KMSServer].
 func (s *Service) GetCredential(
 	ctx context.Context,
 	_ *kms.GetCredentialRequest,
 ) (*kms.GetCredentialResponse, error) {
 	clog.Info(ctx, "Get credential start.")
 
-	_ = grpc.Claims(ctx)
+	cl := grpc.Claims(ctx)
 
-	return &kms.GetCredentialResponse{}, nil
+	creds, err := s.Storage.NewCredentials(
+		ctx,
+		cl.BucketPermissions,
+		1*time.Hour,
+	)
+	if err != nil {
+		return nil, status.Errorf(
+			codes.Unauthenticated,
+			"retrieving credential failed")
+	}
+
+	switch creds.Type() {
+	case s3.CredentialType:
+		c, ok := creds.(*s3.S3Credentials)
+		if !ok {
+			clog.Errorf(ctx, "Could not convert to S3 credential")
+
+			return nil, status.Errorf(
+				codes.Internal,
+				"storage type '%v' not implemented",
+				creds.Type())
+		}
+
+		return &kms.GetCredentialResponse{
+			AccessKeyId:     (string)(c.AccessKeyID),
+			SecretAccessKey: (string)(c.SecretAccessKey),
+			SessionToken:    (string)(c.SessionToken),
+			Expiration:      timestamppb.New(c.Expiration),
+		}, nil
+
+	default:
+		return nil, status.Errorf(
+			codes.Internal,
+			"credential type '%v' not implemented", creds.Type(),
+		)
+	}
 }

components/kms/pkg/storage/s3/credential.go

@@ -7,6 +7,8 @@ import (
 	"gitlab.com/data-custodian/custodian/components/lib-common/pkg/secret"
 )
 
+const CredentialType = "s3"
+
 // S3Credentials represents temp. credentials from an S3.
 // It is not serializable.
 type S3Credentials struct {
@@ -35,7 +37,7 @@ type marshaller struct {
 
 // Type implements [types.Credential].
 func (c *S3Credentials) Type() string {
-	return "s3"
+	return CredentialType
 }
 
 // MarshalerJSON implements [types.Credential].

components/kms/pkg/storage/s3/storage.go

@@ -76,8 +76,8 @@ func (c *Client) NewCredentials(
 
 	return &S3Credentials{
 		AccessKeyID:     secret.RedactedString(*res.Credentials.AccessKeyId),
-		SessionToken:    secret.RedactedString(*res.Credentials.SessionToken),
 		SecretAccessKey: secret.RedactedString(*res.Credentials.SecretAccessKey),
+		SessionToken:    secret.RedactedString(*res.Credentials.SessionToken),
 		Expiration:      *res.Credentials.Expiration,
 	}, nil
 }

components/kms/pkg/storage/types/client.go

@@ -13,6 +13,7 @@ type (
 
 		// NewCredentials returns a scoped token for bucket permissions `permissions`
 		// with duration `dur`.
+		// Returns [CredentialError]s as errors.
 		NewCredentials(
 			ctx context.Context,
 			perms BucketPermissions,

components/kms/pkg/storage/types/error.go

@@ -0,0 +1,33 @@
+package types
+
+import "fmt"
+
+var _ error = (*err)(nil)
+var _ error = (*PermissionError)(nil)
+var _ error = (*DurationError)(nil)
+
+type (
+	err struct {
+		Message string
+	}
+
+	PermissionError struct {
+		err
+	}
+
+	DurationError struct {
+		err
+	}
+)
+
+func (err *err) Error() string {
+	return err.Message
+}
+
+func NewPermissionsError(msg string, args ...any) error {
+	return &PermissionError{err{Message: fmt.Sprintf(msg, args...)}}
+}
+
+func NewDurationError(msg string, args ...any) error {
+	return &DurationError{err{Message: fmt.Sprintf(msg, args...)}}
+}

components/kms/test/go.sum

@@ -275,6 +275,7 @@ gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EV
 gopkg.in/natefinch/lumberjack.v2 v2.2.1 h1:bBRl1b0OH9s/DuPhuXpNl+VtCaJXFZ5/uEFST95x9zc=
 gopkg.in/natefinch/lumberjack.v2 v2.2.1/go.mod h1:YD8tP3GAjkrDg1eZH7EGmyESg/lsYskCTPBJVb9jqSc=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

tools/nix/flake/debug.parts.nix

@@ -0,0 +1,6 @@
+{ ... }: {
+  # To enable a `debug` output on the flake outputs to
+  # inspect the whole NixOS module system.
+  #
+  debug = false;
+}

tools/nix/flake/nixpkgs.parts.nix

@@ -11,17 +11,7 @@
       ...
     }:
     let
-      p = self.lib.nixpkgs.importPkgs { inherit system; };
-
-      pkgs =
-        assert lib.assertMsg (p.multiverse.rev == inputs.nixpkgs.rev) ''
-          Input 'nixpkgs' (unstable) revision must
-          be aligned with `importPkgs`
-          '${p.multiverse.rev}'.";
-          Change it in 'flake.nix'.
-        '';
-        p;
-
+      pkgs = self.lib.nixpkgs.importPkgs { inherit system; };
       pkgsStable = self.lib.nixpkgs.importPkgsStable { inherit system; };
 
       mvs = self.lib.nixpkgs.mkMultiverse { inherit system; };

tools/nix/services/README.md

@@ -3,12 +3,12 @@
 ## Start Services
 
 ```bash
-just services-start
+just services start
 ```
 
 > [!NOTE]
 >
-> `Ctrl+D` to detach from the TUI and `just services-attach` to attach again.
+> `Ctrl+D` to detach from the TUI and `just services attach` to attach again.
 
 ## Keycloak