From f41ce0a3fbc7690cc873e8585a01afa8df5b8692 Mon Sep 17 00:00:00 2001 From: asmo Date: Wed, 24 Sep 2025 15:56:51 +0200 Subject: [PATCH] optional client identity in grpc payment processor (#1084) * fix: update TLS configuration to handle missing client certificates gracefully --- .../cdk-payment-processor/src/proto/client.rs | 33 +++++++------------ 1 file changed, 12 insertions(+), 21 deletions(-) diff --git a/crates/cdk-payment-processor/src/proto/client.rs b/crates/cdk-payment-processor/src/proto/client.rs index d88876af..bd6482c3 100644 --- a/crates/cdk-payment-processor/src/proto/client.rs +++ b/crates/cdk-payment-processor/src/proto/client.rs @@ -47,32 +47,23 @@ impl PaymentProcessorClient { // Check for client.pem let client_pem_path = tls_dir.join("client.pem"); - if !client_pem_path.exists() { - let err_msg = format!( - "Client certificate file not found: {}", - client_pem_path.display() - ); - tracing::error!("{}", err_msg); - return Err(anyhow!(err_msg)); - } // Check for client.key let client_key_path = tls_dir.join("client.key"); - if !client_key_path.exists() { - let err_msg = format!("Client key file not found: {}", client_key_path.display()); - tracing::error!("{}", err_msg); - return Err(anyhow!(err_msg)); - } - + // check for ca cert let server_root_ca_cert = std::fs::read_to_string(&ca_pem_path)?; let server_root_ca_cert = Certificate::from_pem(server_root_ca_cert); - let client_cert = std::fs::read_to_string(&client_pem_path)?; - let client_key = std::fs::read_to_string(&client_key_path)?; - let client_identity = Identity::from_pem(client_cert, client_key); - let tls = ClientTlsConfig::new() - .ca_certificate(server_root_ca_cert) - .identity(client_identity); - + let tls: ClientTlsConfig = match client_pem_path.exists() && client_key_path.exists() { + true => { + let client_cert = std::fs::read_to_string(&client_pem_path)?; + let client_key = std::fs::read_to_string(&client_key_path)?; + let client_identity = Identity::from_pem(client_cert, client_key); + ClientTlsConfig::new() + .ca_certificate(server_root_ca_cert) + .identity(client_identity) + } + false => ClientTlsConfig::new().ca_certificate(server_root_ca_cert), + }; Channel::from_shared(addr)? .tls_config(tls)? .connect()