Harald Hoyer
26e81cef17
- Introduced CLI commands for server, login, upload, sign, verify, and more using `clap`. - Updated Dockerfile and docker-compose to default to `server` command on startup. - Enhanced `test_local.sh` for testing the server and client operations. - Added multipart support to `reqwest` and new CLI documentation in `README.md`. - Updated `Cargo.toml` with new dependencies to support CLI and multipart uploads.
131 lines
3.7 KiB
Markdown
131 lines
3.7 KiB
Markdown
# Hierarchical Document Signing with HashiCorp Vault
|
|
|
|
This project implements a hierarchical document signing system using HashiCorp Vault. It allows for secure document signing with a requirement of a specific number of signatures from different departmental groups.
|
|
|
|
## Features
|
|
|
|
- **Hierarchical Signing**: Requires 3 of 5 signatures to validate a document, with at least 1 signature from each department
|
|
- **Department Structure**: Two departments (Legal and Finance) with 5 users each
|
|
- **Document API**: Upload, sign, and verify documents through a RESTful API
|
|
- **CLI Client**: Interact with the system through command-line interface
|
|
- **Vault Integration**: Leverages HashiCorp Vault's Transit engine for cryptographic operations
|
|
|
|
## System Architecture
|
|
|
|
The system consists of:
|
|
|
|
1. **Vault Server**: Provides secure storage and cryptographic operations
|
|
2. **Rust Application**: Initializes Vault and provides a REST API for document operations
|
|
3. **User Hierarchy**: 10 users organized into 2 departments
|
|
4. **Signature Requirements**: 3 of 5 signatures needed, with at least 1 from each department
|
|
|
|
## API Endpoints
|
|
|
|
- **POST /api/login**: Authenticate with username/password and get a token
|
|
- **POST /api/documents**: Upload a new document for signing
|
|
- **GET /api/documents/:id**: Retrieve document metadata
|
|
- **POST /api/documents/:id/sign**: Sign a document with your user credentials
|
|
- **GET /api/documents/:id/verify**: Check if a document has sufficient signatures
|
|
|
|
## Getting Started
|
|
|
|
### Prerequisites
|
|
|
|
- Docker and Docker Compose
|
|
- Rust development environment (if building from source)
|
|
|
|
### Running with Docker
|
|
|
|
1. Start the Vault server and initialization program:
|
|
```
|
|
docker-compose up -d
|
|
```
|
|
|
|
2. The service will automatically:
|
|
- Initialize Vault (if needed)
|
|
- Unseal Vault
|
|
- Create 10 users in a hierarchical structure
|
|
- Start the API server on port 3000
|
|
|
|
3. User credentials:
|
|
- Legal department: legal1/legal1pass through legal5/legal5pass
|
|
- Finance department: finance1/finance1pass through finance5/finance5pass
|
|
|
|
### CLI Commands
|
|
|
|
The project includes a command-line interface to interact with the API:
|
|
|
|
1. **Start the Server**:
|
|
```bash
|
|
cargo run server [--vault-addr URL] [--api-port PORT]
|
|
```
|
|
|
|
2. **Login**:
|
|
```bash
|
|
cargo run login --username USER --password PASS [--api-url URL]
|
|
```
|
|
|
|
3. **Upload Document**:
|
|
```bash
|
|
cargo run upload --name NAME --file PATH [--api-url URL]
|
|
```
|
|
|
|
4. **Sign Document**:
|
|
```bash
|
|
cargo run sign --document-id ID --username USER --token TOKEN [--api-url URL]
|
|
```
|
|
|
|
5. **Verify Document**:
|
|
```bash
|
|
cargo run verify --document-id ID [--api-url URL]
|
|
```
|
|
|
|
6. **List Documents**:
|
|
```bash
|
|
cargo run list [--api-url URL]
|
|
```
|
|
|
|
7. **Get Document Details**:
|
|
```bash
|
|
cargo run get --document-id ID [--api-url URL]
|
|
```
|
|
|
|
### API Usage Examples (curl)
|
|
|
|
1. **Login**:
|
|
```bash
|
|
curl -X POST http://localhost:3000/api/login \
|
|
-H "Content-Type: application/json" \
|
|
-d '{"username":"legal1","password":"legal1pass"}'
|
|
```
|
|
|
|
2. **Upload Document**:
|
|
```bash
|
|
curl -X POST http://localhost:3000/api/documents \
|
|
-F "name=Contract" \
|
|
-F "file=@/path/to/document.pdf"
|
|
```
|
|
|
|
3. **Sign Document**:
|
|
```bash
|
|
curl -X POST http://localhost:3000/api/documents/DOCUMENT_ID/sign \
|
|
-H "Content-Type: application/json" \
|
|
-d '{"username":"legal1","token":"USER_TOKEN"}'
|
|
```
|
|
|
|
4. **Verify Document**:
|
|
```bash
|
|
curl -X GET http://localhost:3000/api/documents/DOCUMENT_ID/verify
|
|
```
|
|
|
|
## Security Considerations
|
|
|
|
- All cryptographic operations are performed by Vault's Transit engine
|
|
- Each user has their own signing key
|
|
- Root token should be secured in production environments
|
|
- Consider adding TLS for production deployments
|
|
|
|
## License
|
|
|
|
MIT
|