Feature/radius auth and refactor - #1
Merged
Merged
Conversation
- Add RADIUS (udp/radsec) auth backend via pyrad2 with bcrypt-hashed local fallback and legacy sha512 rehashing (est_handler, secureserver) - Add Database user CRUD (insert/update user, password update) and db_update tool - Strengthen CSR identity binding (CN/DNS/IP set-equality, SAN type checks) - Expand test suite (esthandler, helper, database, csr_fixtures) - Remove bundled CA handlers (certifier/openssl/xca/mscertsrv) and stale CI workflows / wf_data fixtures; refresh docs and Docker example Assisted by LLM
Runs the unittest suite on push to main and all PRs (ubuntu-latest, Python 3.12). A separate non-blocking pylint job reports the score without gating CI; PYTHONPATH=. resolves est_proxy imports (no setup.py). Assisted by LLM
- helper.py: move ALLOWED_SUBJECT_OIDS and CSR_EXTENSION_NAMES to module top, near imports - helper.py/est_handler.py: condense verbose comment blocks to terse one/two-liners, match house style - est_handler.py: replace "Fallback will be dropped" dev note with a concrete explanation - pytest.yml: remove the non-blocking pylint job, leaving only pytest Assisted by LLM.
- est_handler.py: drop misleading "to bcrypt" from deprecated-hash rehash warning - test_esthandler.py: add _udp_client / _radius_send tests (udp + radsec coroutine paths) - test_esthandler.py: add _check_csr_data cases (no CN, multi-value IP/DNS SAN match, reenroll DNS mismatch) - test_esthandler.py: rewrite test_068 __init__ default-cfg_file case; fix path/type in test_029; correct many stale docstrings - test_helper.py: cover equal_content_list (equal/differ) and get_cn_and_san with no CN - csr_fixtures.py: clarify build_csr_bad_signature docstring to match actual byte-flip behavior Assisted by LLM
iQSol
force-pushed
the
feature/radius-auth-and-refactor
branch
from
July 8, 2026 11:33
fa6141f to
c4c3870
Compare
- CHANGES.md: changelog for 0.1.0 (initial RFC 7030 EST proxy, CA handlers, Docker) and 0.2.0 (RADIUS auth backend, DB user management, CSR hardening) - release.yml: tag-triggered pipeline building the Docker image and publishing a GitHub Release with the compressed image tarball Assisted by LLM
- database.py: log an info line inside each migration guard (auth_backend column add, certificates FK rebuild) so messages appear only on real change - database.py: drop the redundant unconditional "dbversion set to N" log - db_update.py: report "dbversion updated X -> Y" or "already up to date" instead of unconditional before/after version lines - test_database.py: assert per-migration logs fire on migration and are absent on a no-op run - test_db_update_tool.py: new tests covering both wrapper branches Assisted by LLM
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.