Skip to content

RFC 9457 implementation at wfm server side #74

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
vireshnavalli merged 5 commits into from
Sep 17, 2026
Merged

RFC 9457 implementation at wfm server side #74

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
5fefd6d
feat(agent-vendor): added to include problem types
vireshnavalli Sep 16, 2026
17ab9c3
feat(device-agent-vendor): handler changes to return problem types error
vireshnavalli Sep 16, 2026
0238388
feat(problem-types): added extra types to missing problem for coa fra…
vireshnavalli Sep 16, 2026
0c8b604
feat(authorized): added 403 problem type for all endpoints
vireshnavalli Sep 16, 2026
c753b04
chore: adds sandbox dependency to feature/miaf branch
vireshnavalli Sep 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion api/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ require (
github.com/ghodss/yaml v1.0.0
github.com/itchyny/gojq v0.12.16
github.com/kr/pretty v0.3.1
github.com/margo/sandbox v1.0.0-rc.2.0.20260914132812-996e3c369a28
github.com/margo/sandbox v1.0.0-rc.2.0.20260917102142-7325356d9a0c
github.com/princjef/mageutil v1.0.0
go.opentelemetry.io/otel/trace v1.44.0
golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56
Expand Down
6 changes: 6 additions & 0 deletions api/go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -297,6 +297,12 @@ github.com/magefile/mage v1.15.0 h1:BvGheCMAsG3bWUDbZ8AyXXpCNwU9u5CB6sM+HNb9HYg=
github.com/magefile/mage v1.15.0/go.mod h1:z5UZb/iS3GoOSn0JgWuiw7dxlurVYTu+/jHXqQg881A=
github.com/margo/sandbox v1.0.0-rc.2.0.20260914132812-996e3c369a28 h1:gBUseGX0Ob0vtzBPEKRGzraNAnv1wiPonR5nGfA7QJ8=
github.com/margo/sandbox v1.0.0-rc.2.0.20260914132812-996e3c369a28/go.mod h1:GUXYfxV7olA9UNBHFXbcCncQphxLmbNTmncEva1XkTw=
github.com/margo/sandbox v1.0.0-rc.2.0.20260916085946-ec8c5fb42b0f h1:knEF6gDZulXTCmJYAvNAnwI31lUjSV8jd690tKL3qwA=
github.com/margo/sandbox v1.0.0-rc.2.0.20260916085946-ec8c5fb42b0f/go.mod h1:exvgewlHdcAP2CB6icHolWChDkpW0JLYBsier1AD3S8=
github.com/margo/sandbox v1.0.0-rc.2.0.20260916141039-c41545a08e1e h1:/O7eH/b+b6+Zp96YmcTbwioe3r4nHJRYtmm1mLBwQXo=
github.com/margo/sandbox v1.0.0-rc.2.0.20260916141039-c41545a08e1e/go.mod h1:exvgewlHdcAP2CB6icHolWChDkpW0JLYBsier1AD3S8=
github.com/margo/sandbox v1.0.0-rc.2.0.20260917102142-7325356d9a0c h1:dpkPwbLGS3u6M57gfs/O5OrNl09B5vMGGXdYqbM2smI=
github.com/margo/sandbox v1.0.0-rc.2.0.20260917102142-7325356d9a0c/go.mod h1:exvgewlHdcAP2CB6icHolWChDkpW0JLYBsier1AD3S8=
github.com/matryer/is v1.3.0 h1:9qiso3jaJrOe6qBRJRBt2Ldht05qDiFP9le0JOIhRSI=
github.com/matryer/is v1.3.0/go.mod h1:2fLPjFQM9rhQ15aVEtbuwhJinnOqrmgXPNdZsdwlWXA=
github.com/mattn/go-colorable v0.1.2/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
Expand Down
9 changes: 9 additions & 0 deletions api/pkg/apis/v1alpha1/managers/margo/device.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,15 @@ type DeviceManager struct {
needValidate bool
}

// IsAuthorized checks if the device SPIFFE ID is permitted by WFM local policy.
// TODO: This has been already done duing MTLs handshake to avoid attack surface, so this function is a stub for now. In the future, we may implement additional authorization checks here.
func (s *DeviceManager) IsAuthorized(ctx context.Context, spiffeId string) error {
// mTLS handshake already validates the SPIFFE ID against the Trust Bundle.
deviceLogger.DebugfCtx(ctx, "IsAuthorized: PR1 stub — allowing spiffeId: %s", spiffeId)
//return fmt.Errorf("spiffeId %s is not authorized by WFM local policy (test)", spiffeId)
return nil
}

func (s *DeviceManager) Init(pCtx *contexts.VendorContext, config managers.ManagerConfig, providers map[string]providers.IProvider) error {
err := s.Manager.Init(pCtx, config, providers)
if err != nil {
Expand Down
296 changes: 178 additions & 118 deletions api/pkg/apis/v1alpha1/vendors/margo/device-agent-vendor.go
View file
Open in desktop

Large diffs are not rendered by default.

17 changes: 17 additions & 0 deletions api/pkg/apis/v1alpha1/vendors/margo/problem_response.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
// api/pkg/apis/v1alpha1/vendors/margo/problem_response.go
package margo

import (
"github.com/eclipse-symphony/symphony/coa/pkg/apis/v1alpha2"
sbi "github.com/margo/sandbox/standard/generatedCode/wfm/sbi"
)

// problemResponse converts a *sbi.ProblemDetail into a COAResponse.
func problemResponse(pd *sbi.ProblemDetail) v1alpha2.COAResponse {
body, _ := pd.MarshalJSON()
return v1alpha2.COAResponse{
State: v1alpha2.GetHttpStatus(pd.Status),
Body: body,
ContentType: sbi.ProblemContentType,
}
}
2 changes: 1 addition & 1 deletion cli/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ require (
github.com/cenkalti/backoff/v4 v4.3.0
github.com/eclipse-symphony/symphony/api v0.0.0-00010101000000-000000000000
github.com/ghodss/yaml v1.0.0
github.com/margo/sandbox v1.0.0-rc.2.0.20260914140431-3329621a9f84
github.com/margo/sandbox v1.0.0-rc.2.0.20260917102142-7325356d9a0c
github.com/princjef/mageutil v1.0.0
)

Expand Down
6 changes: 6 additions & 0 deletions cli/go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,12 @@ github.com/lestrrat-go/sfv v1.0.0 h1:+/VOs7lhUWAwNIklow4kPYlit0fPBC6HsF+GHKXrhGM
github.com/lestrrat-go/sfv v1.0.0/go.mod h1:wawOORrbzB4Vh0QT7WtbWEbMuTbjS8OPxum1wZAYCiQ=
github.com/margo/sandbox v1.0.0-rc.2.0.20260914140431-3329621a9f84 h1:XOE/A2gF4gKPVwcb9WWcUWjFwgakcan769/CWOmsGPI=
github.com/margo/sandbox v1.0.0-rc.2.0.20260914140431-3329621a9f84/go.mod h1:GUXYfxV7olA9UNBHFXbcCncQphxLmbNTmncEva1XkTw=
github.com/margo/sandbox v1.0.0-rc.2.0.20260916085946-ec8c5fb42b0f h1:knEF6gDZulXTCmJYAvNAnwI31lUjSV8jd690tKL3qwA=
github.com/margo/sandbox v1.0.0-rc.2.0.20260916085946-ec8c5fb42b0f/go.mod h1:exvgewlHdcAP2CB6icHolWChDkpW0JLYBsier1AD3S8=
github.com/margo/sandbox v1.0.0-rc.2.0.20260916141039-c41545a08e1e h1:/O7eH/b+b6+Zp96YmcTbwioe3r4nHJRYtmm1mLBwQXo=
github.com/margo/sandbox v1.0.0-rc.2.0.20260916141039-c41545a08e1e/go.mod h1:exvgewlHdcAP2CB6icHolWChDkpW0JLYBsier1AD3S8=
github.com/margo/sandbox v1.0.0-rc.2.0.20260917102142-7325356d9a0c h1:dpkPwbLGS3u6M57gfs/O5OrNl09B5vMGGXdYqbM2smI=
github.com/margo/sandbox v1.0.0-rc.2.0.20260917102142-7325356d9a0c/go.mod h1:exvgewlHdcAP2CB6icHolWChDkpW0JLYBsier1AD3S8=
github.com/matryer/is v1.3.0 h1:9qiso3jaJrOe6qBRJRBt2Ldht05qDiFP9le0JOIhRSI=
github.com/matryer/is v1.3.0/go.mod h1:2fLPjFQM9rhQ15aVEtbuwhJinnOqrmgXPNdZsdwlWXA=
github.com/mattn/go-colorable v0.1.2/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
Expand Down
12 changes: 11 additions & 1 deletion coa/pkg/apis/v1alpha2/types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,8 +39,10 @@ const (
NotAcceptable State = 406
Conflict State = 409
StatusUnprocessableEntity State = 422
TooManyRequests State = 429
// InternalError = HTTP 500
InternalError State = 500
ServiceUnavailable State = 503
// Config errors
BadConfig State = 1000
MissingConfig State = 1001
Expand Down Expand Up @@ -172,10 +174,14 @@ func GetHttpStatus(code int) State {
return NotFound
case code == 405:
return MethodNotAllowed
case code == 409:
case code == 409:
return Conflict
case code == 422:
return StatusUnprocessableEntity
case code >= 400 && code < 500:
return BadRequest
case code == 503:
return ServiceUnavailable
case code >= 500:
return InternalError
default:
Expand Down Expand Up @@ -209,6 +215,10 @@ func (s State) String() string {
return "Conflict"
case StatusUnprocessableEntity:
return "Unprocessable Entity"
case TooManyRequests:
return "Too Many Requests"
case ServiceUnavailable:
return "Service Unavailable"
case InternalError:
return "Internal Error"
case BadConfig:
Expand Down