mirror of
https://github.com/ModernRelay/omnigraph.git
synced 2026-06-12 01:45:14 +02:00
7a3bf5c758
Introduces an opt-in AWS Secrets Manager backend for bearer tokens,
behind the `aws` Cargo feature. Default builds (on-prem, local dev)
don't pull in the AWS SDK and don't pay its compile cost.
- New Cargo feature `aws` gates the `aws-config` + `aws-sdk-secretsmanager`
optional deps. Default features remain empty.
- New `auth::aws::SecretsManagerTokenSource` implements `TokenSource` by
fetching a JSON `{"actor_id": "token", ...}` payload from a named
Secrets Manager secret. Credentials resolve via the AWS default chain
(env, shared config, IMDSv2 instance role, ECS task role) so no
explicit plumbing is needed under an IAM role.
- New `resolve_token_source()` dispatches based on the
`OMNIGRAPH_SERVER_BEARER_TOKENS_AWS_SECRET` env var. If the var is set
but the binary was built without `--features aws`, returns a clear
rebuild instruction rather than silently falling back.
- `serve()` now uses `resolve_token_source()` and logs which source was
selected at startup.
- `parse_json_secret_payload()` is factored out as a free function so
the payload validation (trim whitespace, reject blank actor/token,
reject non-object) is unit-testable without the AWS SDK.
- New CI job `test_aws_feature` builds + tests with `--features aws`.
Not in this PR (follow-ups):
- Background refresh loop for rotation. `SecretsManagerTokenSource`
advertises `supports_refresh: true` but the AppState-level refresh
task isn't wired yet.
- Config-YAML dispatch (today the AWS source is selected via env var
only; eventually `server.bearer_tokens.source` in `omnigraph.yaml`).
Tests:
- Default-feature build: 33 lib + 41 integration + 64 openapi.
- `--features aws` build: 32 lib (one test is cfg-gated) + 41 + 64.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
47 lines
1.6 KiB
TOML
47 lines
1.6 KiB
TOML
[package]
|
|
name = "omnigraph-server"
|
|
version = "0.2.2"
|
|
edition = "2024"
|
|
description = "HTTP server for the Omnigraph graph database."
|
|
license = "MIT"
|
|
repository = "https://github.com/ModernRelay/omnigraph"
|
|
homepage = "https://github.com/ModernRelay/omnigraph"
|
|
documentation = "https://docs.rs/omnigraph-server"
|
|
|
|
[[bin]]
|
|
name = "omnigraph-server"
|
|
path = "src/main.rs"
|
|
|
|
[features]
|
|
default = []
|
|
# Enables the AWS Secrets Manager bearer-token source. Off by default — on-prem
|
|
# and local-dev builds don't pay the AWS SDK compile cost.
|
|
aws = ["dep:aws-config", "dep:aws-sdk-secretsmanager"]
|
|
|
|
[dependencies]
|
|
omnigraph = { package = "omnigraph-engine", path = "../omnigraph", version = "0.2.2" }
|
|
omnigraph-compiler = { path = "../omnigraph-compiler", version = "0.2.2" }
|
|
axum = { workspace = true }
|
|
clap = { workspace = true }
|
|
color-eyre = { workspace = true }
|
|
serde = { workspace = true }
|
|
serde_json = { workspace = true }
|
|
tokio = { workspace = true }
|
|
serde_yaml = { workspace = true }
|
|
tracing = { workspace = true }
|
|
tracing-subscriber = { workspace = true }
|
|
tower-http = { workspace = true }
|
|
utoipa = { workspace = true }
|
|
cedar-policy = { workspace = true }
|
|
futures = { workspace = true }
|
|
sha2 = { workspace = true }
|
|
subtle = { workspace = true }
|
|
async-trait = { workspace = true }
|
|
aws-config = { version = "1", optional = true, default-features = false, features = ["rustls", "rt-tokio", "credentials-process", "sso"] }
|
|
aws-sdk-secretsmanager = { version = "1", optional = true, default-features = false, features = ["rustls", "rt-tokio"] }
|
|
|
|
[dev-dependencies]
|
|
tempfile = { workspace = true }
|
|
tower = { workspace = true }
|
|
serial_test = "3"
|
|
lance-index = { workspace = true }
|