Harald Hoyer
f11b83ddf4
- Introduced a new hierarchical signing system using HashiCorp Vault. - Added Rust modules for user management, secrets setup, and document API. - Implemented API endpoints for login, document upload, signing, and verification. - Updated README with features, usage, and API examples.
91 lines
2.9 KiB
Markdown
91 lines
2.9 KiB
Markdown
# Hierarchical Document Signing with HashiCorp Vault
|
|
|
|
This project implements a hierarchical document signing system using HashiCorp Vault. It allows for secure document signing with a requirement of a specific number of signatures from different departmental groups.
|
|
|
|
## Features
|
|
|
|
- **Hierarchical Signing**: Requires 3 of 5 signatures to validate a document, with at least 1 signature from each department
|
|
- **Department Structure**: Two departments (Legal and Finance) with 5 users each
|
|
- **Document API**: Upload, sign, and verify documents through a RESTful API
|
|
- **Vault Integration**: Leverages HashiCorp Vault's Transit engine for cryptographic operations
|
|
|
|
## System Architecture
|
|
|
|
The system consists of:
|
|
|
|
1. **Vault Server**: Provides secure storage and cryptographic operations
|
|
2. **Rust Application**: Initializes Vault and provides a REST API for document operations
|
|
3. **User Hierarchy**: 10 users organized into 2 departments
|
|
4. **Signature Requirements**: 3 of 5 signatures needed, with at least 1 from each department
|
|
|
|
## API Endpoints
|
|
|
|
- **POST /api/login**: Authenticate with username/password and get a token
|
|
- **POST /api/documents**: Upload a new document for signing
|
|
- **GET /api/documents/:id**: Retrieve document metadata
|
|
- **POST /api/documents/:id/sign**: Sign a document with your user credentials
|
|
- **GET /api/documents/:id/verify**: Check if a document has sufficient signatures
|
|
|
|
## Getting Started
|
|
|
|
### Prerequisites
|
|
|
|
- Docker and Docker Compose
|
|
- Rust development environment (if building from source)
|
|
|
|
### Running with Docker
|
|
|
|
1. Start the Vault server and initialization program:
|
|
```
|
|
docker-compose up -d
|
|
```
|
|
|
|
2. The service will automatically:
|
|
- Initialize Vault (if needed)
|
|
- Unseal Vault
|
|
- Create 10 users in a hierarchical structure
|
|
- Start the API server on port 3000
|
|
|
|
3. User credentials:
|
|
- Legal department: legal1/legal1pass through legal5/legal5pass
|
|
- Finance department: finance1/finance1pass through finance5/finance5pass
|
|
|
|
### API Usage Examples
|
|
|
|
1. **Login**:
|
|
```bash
|
|
curl -X POST http://localhost:3000/api/login \
|
|
-H "Content-Type: application/json" \
|
|
-d '{"username":"legal1","password":"legal1pass"}'
|
|
```
|
|
|
|
2. **Upload Document**:
|
|
```bash
|
|
curl -X POST http://localhost:3000/api/documents \
|
|
-F "name=Contract" \
|
|
-F "file=@/path/to/document.pdf"
|
|
```
|
|
|
|
3. **Sign Document**:
|
|
```bash
|
|
curl -X POST http://localhost:3000/api/documents/DOCUMENT_ID/sign \
|
|
-H "Content-Type: application/json" \
|
|
-d '{"username":"legal1","token":"USER_TOKEN"}'
|
|
```
|
|
|
|
4. **Verify Document**:
|
|
```bash
|
|
curl -X GET http://localhost:3000/api/documents/DOCUMENT_ID/verify
|
|
```
|
|
|
|
## Security Considerations
|
|
|
|
- All cryptographic operations are performed by Vault's Transit engine
|
|
- Each user has their own signing key
|
|
- Root token should be secured in production environments
|
|
- Consider adding TLS for production deployments
|
|
|
|
## License
|
|
|
|
MIT
|