Fix/platform federation http

.bumpversion.toml

@@ -1,5 +1,5 @@
 [tool.bumpversion]
-current_version = "1.20.0+261027"
+current_version = "1.20.1+261112"
 parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<patch>\\d+)\\+(?P<build>\\d+)"
 serialize = ["{major}.{minor}.{patch}+{build}"]
 search = "{current_version}"

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "rasenmaeher_api"
-version = "1.20.0+261027"
+version = "1.20.1+261112"
 description = "python-rasenmaeher-api"
 authors = [
     { name = "Aciid", email = "703382+Aciid@users.noreply.github.com" },

src/rasenmaeher_api/__init__.py

@@ -1,3 +1,3 @@
 """python-rasenmaeher-api"""
 
-__version__ = "1.20.0+261027"  # NOTE Use `bump-my-version` to bump versions correctly
+__version__ = "1.20.1+261112"  # NOTE Use `bump-my-version` to bump versions correctly

src/rasenmaeher_api/web/api/federation/views.py

@@ -9,6 +9,7 @@
 from fastapi import APIRouter, Depends, HTTPException, Request
 from fastapi.exceptions import RequestValidationError
 from fastapi.routing import APIRoute
+from libpvarki.middleware.mtlsheader import CONFIG
 from starlette.responses import Response
 
 from rasenmaeher_api.mtlsinit import get_session_winit
@@ -53,8 +54,10 @@ async def dispatch[Response: (FederationTrustResponse, FederationOutgoingRespons
         if not isinstance(base, str):
             raise TypeError("Invalid product API")
         parsed = urlsplit(base)
+        # Meshed (Linkerd) product APIs are internal http, authenticated by l5d identity.
+        schemes = ("https", "http") if CONFIG("MTLS_TRUST_L5D", cast=bool, default=False) else ("https",)
         if (
-            parsed.scheme != "https"
+            parsed.scheme not in schemes
             or not parsed.hostname
             or parsed.username
             or parsed.password

tests/federation/test_dispatch.py

@@ -183,7 +183,38 @@ def test_missing_product(public: TestClient, product: MagicMock, issuer_cl: Issu
         123,
     ],
 )
-def test_bad_product_config(public: TestClient, product: MagicMock, issuer_cl: Issuer, api: Any) -> None:
+def test_bad_product_config(
+    public: TestClient, product: MagicMock, issuer_cl: Issuer, monkeypatch: pytest.MonkeyPatch, api: Any
+) -> None:
+    monkeypatch.delenv("MTLS_TRUST_L5D", raising=False)
+    RMSettings.singleton().kraftwerk_manifest_dict["products"]["tak"]["api"] = api
+    assert post(public, issuer_cl).status_code == 503
+    product.post.assert_not_called()
+
+
+def test_meshed_http_dispatch(
+    public: TestClient, product: MagicMock, issuer_cl: Issuer, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    monkeypatch.setenv("MTLS_TRUST_L5D", "true")
+    RMSettings.singleton().kraftwerk_manifest_dict["products"]["tak"]["api"] = (
+        "http://tak-server.app-tak.svc.cluster.local:8003/"
+    )
+    assert post(public, issuer_cl).status_code == 200
+    assert product.post.call_args.args == ("http://tak-server.app-tak.svc.cluster.local:8003/api/v1/federation/trust",)
+    product.post.assert_called_once()
+
+
+@pytest.mark.parametrize(
+    "api",
+    [
+        "https://user:pass@tak.local.example/",  # pragma: allowlist secret
+        123,
+    ],
+)
+def test_meshed_bad_product_config(
+    public: TestClient, product: MagicMock, issuer_cl: Issuer, monkeypatch: pytest.MonkeyPatch, api: Any
+) -> None:
+    monkeypatch.setenv("MTLS_TRUST_L5D", "true")
     RMSettings.singleton().kraftwerk_manifest_dict["products"]["tak"]["api"] = api
     assert post(public, issuer_cl).status_code == 503
     product.post.assert_not_called()

tests/test_rasenmaeher_api.py

@@ -15,7 +15,7 @@
 
 def test_version() -> None:
     """Make sure version matches expected"""
-    assert __version__ == "1.20.0+261027"
+    assert __version__ == "1.20.1+261112"
 
 
 @pytest.mark.asyncio(loop_scope="session")