rust/hyperswitch
1
0
Fork 0
mirror of https://github.com/juspay/hyperswitch.git synced 2025-11-02 04:04:43 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(core): Add mTLS certificates for each request (#5636)

Browse Source 
Co-authored-by: hyperswitch-bot[bot] <148525504+hyperswitch-bot[bot]@users.noreply.github.com>
This commit is contained in:
Sakil Mostak
2024-08-27 15:30:22 +05:30
committed by GitHub
parent 4585e16245
commit 716d76c53e
10 changed files with 101 additions and 89 deletions
Download Patch File Download Diff File Expand all files Collapse all files

49
crates/router/src/core/admin.rs
View File

@ -4,7 +4,6 @@ use api_models::{
admin::{self as admin_types},
enums as api_enums, routing as routing_types,
};
use base64::Engine;
use common_utils::{
date_time,
ext_traits::{AsyncExt, Encode, OptionExt, ValueExt},
@ -24,7 +23,7 @@ use uuid::Uuid;
#[cfg(any(feature = "v1", feature = "v2"))]
use crate::types::transformers::ForeignFrom;
use crate::{
consts::{self, BASE64_ENGINE},
consts,
core::{
encryption::transfer_encryption_key,
errors::{self, RouterResponse, RouterResult, StorageErrorExt},
@ -35,7 +34,11 @@ use crate::{
},
db::StorageInterface,
routes::{metrics, SessionState},
services::{self, api as service_api, authentication, pm_auth as payment_initiation_service},
services::{
self,
api::{self as service_api, client},
authentication, pm_auth as payment_initiation_service,
},
types::{
self,
api::{self, admin},
@ -198,6 +201,10 @@ pub async fn create_merchant_account(
let identifier = km_types::Identifier::Merchant(merchant_id.clone());
#[cfg(feature = "keymanager_create")]
{
use base64::Engine;
use crate::consts::BASE64_ENGINE;
keymanager::transfer_key_to_key_manager(
key_manager_state,
EncryptionTransferRequest {
@ -1604,7 +1611,7 @@ impl<'a> ConnectorAuthTypeValidation<'a> {
certificate,
private_key,
} => {
helpers::create_identity_from_certificate_and_key(
client::create_identity_from_certificate_and_key(
certificate.to_owned(),
private_key.to_owned(),
)
@ -1695,34 +1702,6 @@ impl<'a> PaymentMethodsEnabled<'a> {
}
}
struct CertificateAndCertificateKey<'a> {
certificate: &'a Secret<String>,
certificate_key: &'a Secret<String>,
}
impl<'a> CertificateAndCertificateKey<'a> {
pub fn create_identity_from_certificate_and_key(
&self,
) -> Result<reqwest::Identity, error_stack::Report<errors::ApiClientError>> {
let decoded_certificate = BASE64_ENGINE
.decode(self.certificate.clone().expose())
.change_context(errors::ApiClientError::CertificateDecodeFailed)?;
let decoded_certificate_key = BASE64_ENGINE
.decode(self.certificate_key.clone().expose())
.change_context(errors::ApiClientError::CertificateDecodeFailed)?;
let certificate = String::from_utf8(decoded_certificate)
.change_context(errors::ApiClientError::CertificateDecodeFailed)?;
let certificate_key = String::from_utf8(decoded_certificate_key)
.change_context(errors::ApiClientError::CertificateDecodeFailed)?;
reqwest::Identity::from_pkcs8_pem(certificate.as_bytes(), certificate_key.as_bytes())
.change_context(errors::ApiClientError::CertificateDecodeFailed)
}
}
struct ConnectorMetadata<'a> {
connector_metadata: &'a Option<pii::SecretSerdeValue>,
}
@ -1739,11 +1718,7 @@ impl<'a> ConnectorMetadata<'a> {
})?
.and_then(|metadata| metadata.get_apple_pay_certificates())
.map(|(certificate, certificate_key)| {
let certificate_and_certificate_key = CertificateAndCertificateKey {
certificate: &certificate,
certificate_key: &certificate_key,
};
certificate_and_certificate_key.create_identity_from_certificate_and_key()
client::create_identity_from_certificate_and_key(certificate, certificate_key)
})
.transpose()
.change_context(errors::ApiErrorResponse::InvalidDataValue {

35
crates/router/src/core/payments/helpers.rs
View File

@ -99,41 +99,6 @@ use crate::{
core::payment_methods::cards::create_encrypted_data, types::storage::CustomerUpdate::Update,
};
pub fn create_identity_from_certificate_and_key(
encoded_certificate: masking::Secret<String>,
encoded_certificate_key: masking::Secret<String>,
) -> Result<reqwest::Identity, error_stack::Report<errors::ApiClientError>> {
let decoded_certificate = BASE64_ENGINE
.decode(encoded_certificate.expose())
.change_context(errors::ApiClientError::CertificateDecodeFailed)?;
let decoded_certificate_key = BASE64_ENGINE
.decode(encoded_certificate_key.expose())
.change_context(errors::ApiClientError::CertificateDecodeFailed)?;
let certificate = String::from_utf8(decoded_certificate)
.change_context(errors::ApiClientError::CertificateDecodeFailed)?;
let certificate_key = String::from_utf8(decoded_certificate_key)
.change_context(errors::ApiClientError::CertificateDecodeFailed)?;
reqwest::Identity::from_pkcs8_pem(certificate.as_bytes(), certificate_key.as_bytes())
.change_context(errors::ApiClientError::CertificateDecodeFailed)
}
pub fn create_certificate(
encoded_certificate: masking::Secret<String>,
) -> Result<Vec<reqwest::Certificate>, error_stack::Report<errors::ApiClientError>> {
let decoded_certificate = BASE64_ENGINE
.decode(encoded_certificate.expose())
.change_context(errors::ApiClientError::CertificateDecodeFailed)?;
let certificate = String::from_utf8(decoded_certificate)
.change_context(errors::ApiClientError::CertificateDecodeFailed)?;
reqwest::Certificate::from_pem_bundle(certificate.as_bytes())
.change_context(errors::ApiClientError::CertificateDecodeFailed)
}
pub fn filter_mca_based_on_profile_and_connector_type(
merchant_connector_accounts: Vec<domain::MerchantConnectorAccount>,
profile_id: &id_type::ProfileId,