test(tls): rfc 0030 green (mTLS) — RFC0030.4 require-and-verify

[jensholdgaard]

Third RFC 0030 green slice: RFC0030.4 un-ignored and passing. Six of nine §5 scenarios now green.

What

The server-side mTLS enforcement already shipped in the acceptor slice (#447): TlsSettings::load builds a WebPkiClientVerifier (⇒ RequireAndVerifyClientCert) whenever client_ca_file is set. So this slice is the acceptance test — no production code change.

Four arms over a real gRPC handshake, with client_ca_file set and a static bearer configured:

1. CA-trusted client cert + valid bearer → ingested.
2. Same trusted cert, no bearer → Unauthenticated — mTLS composes with, does not replace, bearer auth (the tenant still comes from the token).
3. No client cert → rejected before the handler.
4. Cert from an untrusted CA → rejected.

Cases 3/4 use connect-then-export because tonic defers the TLS handshake to the first RPC (a bare connect() succeeds lazily). All certs rcgen-minted at test time; the trusted client is its own CA root written to client_ca_file.

Verification

cargo fmt --check, cargo clippy --all-targets --all-features -- -D warnings exit 0, the mTLS test passes (all four arms), and the rest of the rfc0030 suite is unaffected.

Remaining

.6 (cert reload) and the .3/.8 querier + served-end-to-end arms. This slice unlocked nothing new — the tls-connect-info peer_certificates() hook was already enabled in #447 and is available when a future slice wants SAN→tenant binding (RFC §7.1, deferred).

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

@jensholdgaard, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 34 seconds

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 26bc70d7-07ee-4512-9574-69b398d45789

📥 Commits

Reviewing files that changed from the base of the PR and between ff71eb1 and 2557d88.

📒 Files selected for processing (1)

• crates/ourios-ingester/tests/it/rfc0030_tls.rs

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch rfc0030-green-mtls

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

Updates the RFC 0030 TLS/mTLS integration test suite in ourios-ingester by turning RFC0030.4 (mTLS require-and-verify) from an ignored stub into a real end-to-end gRPC handshake test, validating that mTLS enforcement composes with (and does not replace) bearer authentication.

Changes:

• Implemented RFC0030.4 as a multi-arm integration test covering: trusted client cert + bearer success, trusted cert without bearer rejection, missing client cert handshake failure, and untrusted-CA client cert handshake failure.
• Added a small helper to build a static TokenStore for bearer auth in the test.
• Updated module-level scenario status documentation to reflect RFC0030.4 now being live and only RFC0030.6 remaining ignored.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.