feat: add TLS configuration support to FFI engine

Add TlsConfig struct with support for custom CA certificates,
insecure skip verify, and client certificates for mutual TLS.

Fixes #1132

Author: markphelps

flipt-engine-ffi/src/http.rs

@@ -16,6 +16,10 @@ use tokio_util::io::StreamReader;
 use fliptevaluation::error::Error;
 use fliptevaluation::models::source;
 
+use crate::TlsConfig;
+use base64::prelude::BASE64_STANDARD;
+use base64::Engine as Base64Engine;
+
 #[derive(Debug, Clone, Default, Deserialize)]
 #[cfg_attr(test, derive(PartialEq))]
 #[serde(rename_all = "snake_case")]
@@ -111,6 +115,7 @@ pub struct HTTPFetcherBuilder {
     request_timeout: Option<Duration>,
     update_interval: Duration,
     mode: FetchMode,
+    tls_config: Option<TlsConfig>,
 }
 
 #[derive(Deserialize)]
@@ -136,6 +141,7 @@ impl HTTPFetcherBuilder {
             request_timeout: None,
             update_interval: Duration::from_secs(120),
             mode: FetchMode::default(),
+            tls_config: None,
         }
     }
 
@@ -174,6 +180,11 @@ impl HTTPFetcherBuilder {
         self
     }
 
+    pub fn tls_config(mut self, tls_config: TlsConfig) -> Self {
+        self.tls_config = Some(tls_config);
+        self
+    }
+
     pub fn build(self) -> Result<HTTPFetcher, Error> {
         let retry_policy = ExponentialBackoff::builder()
             .retry_bounds(Duration::from_secs(1), Duration::from_secs(30))
@@ -205,6 +216,11 @@ impl HTTPFetcherBuilder {
             }
         }
 
+        // Apply TLS configuration if provided
+        if let Some(tls_config) = &self.tls_config {
+            client_builder = configure_tls(client_builder, tls_config)?;
+        }
+
         let client = client_builder
             .build()
             .map_err(|e| Error::Internal(format!("failed to create client: {e}")))?;
@@ -476,6 +492,65 @@ impl HTTPFetcher {
     }
 }
 
+fn configure_tls(
+    mut builder: reqwest::ClientBuilder,
+    tls_config: &TlsConfig,
+) -> Result<reqwest::ClientBuilder, Error> {
+    // Handle insecure mode
+    if tls_config.insecure_skip_verify.unwrap_or(false) {
+        builder = builder.danger_accept_invalid_certs(true);
+    }
+
+    // Handle custom CA certificates
+    if let Some(ca_cert_data) = &tls_config.ca_cert_data {
+        let cert_bytes = BASE64_STANDARD
+            .decode(ca_cert_data)
+            .map_err(|e| Error::Internal(format!("Invalid CA cert data: {e}")))?;
+        let cert = reqwest::Certificate::from_pem(&cert_bytes)
+            .map_err(|e| Error::Internal(format!("Invalid CA certificate: {e}")))?;
+        builder = builder.add_root_certificate(cert);
+    } else if let Some(ca_cert_file) = &tls_config.ca_cert_file {
+        let cert_bytes = std::fs::read(ca_cert_file)
+            .map_err(|e| Error::Internal(format!("Failed to read CA cert file: {e}")))?;
+        let cert = reqwest::Certificate::from_pem(&cert_bytes)
+            .map_err(|e| Error::Internal(format!("Invalid CA certificate file: {e}")))?;
+        builder = builder.add_root_certificate(cert);
+    }
+
+    // Handle client certificates for mutual TLS
+    if let (Some(cert_data), Some(key_data)) = (
+        &tls_config.client_cert_data,
+        &tls_config.client_key_data,
+    ) {
+        let cert_bytes = BASE64_STANDARD
+            .decode(cert_data)
+            .map_err(|e| Error::Internal(format!("Invalid client cert data: {e}")))?;
+        let key_bytes = BASE64_STANDARD
+            .decode(key_data)
+            .map_err(|e| Error::Internal(format!("Invalid client key data: {e}")))?;
+        let mut combined = cert_bytes.clone();
+        combined.extend_from_slice(&key_bytes);
+        let identity = reqwest::Identity::from_pem(&combined)
+            .map_err(|e| Error::Internal(format!("Invalid client certificate: {e}")))?;
+        builder = builder.identity(identity);
+    } else if let (Some(cert_file), Some(key_file)) = (
+        &tls_config.client_cert_file,
+        &tls_config.client_key_file,
+    ) {
+        let cert_bytes = std::fs::read(cert_file)
+            .map_err(|e| Error::Internal(format!("Failed to read client cert file: {e}")))?;
+        let key_bytes = std::fs::read(key_file)
+            .map_err(|e| Error::Internal(format!("Failed to read client key file: {e}")))?;
+        let mut combined = cert_bytes.clone();
+        combined.extend_from_slice(&key_bytes);
+        let identity = reqwest::Identity::from_pem(&combined)
+            .map_err(|e| Error::Internal(format!("Invalid client certificate files: {e}")))?;
+        builder = builder.identity(identity);
+    }
+
+    Ok(builder)
+}
+
 #[cfg(test)]
 mod tests {
     use futures::FutureExt;
@@ -484,6 +559,10 @@ mod tests {
     use crate::http::Authentication;
     use crate::http::FetchMode;
     use crate::http::HTTPFetcherBuilder;
+    use crate::http::configure_tls;
+    use crate::TlsConfig;
+    use base64::prelude::BASE64_STANDARD;
+    use base64::Engine as Base64Engine;
     use tokio::sync::mpsc;
 
     #[tokio::test]
@@ -774,4 +853,171 @@ mod tests {
 
         assert_eq!(unwrapped_string, Authentication::JwtToken("secret".into()));
     }
+
+    #[test]
+    fn test_tls_config_insecure_skip_verify() {
+        let tls_config = TlsConfig {
+            insecure_skip_verify: Some(true),
+            ca_cert_file: None,
+            ca_cert_data: None,
+            client_cert_file: None,
+            client_key_file: None,
+            client_cert_data: None,
+            client_key_data: None,
+        };
+
+        let builder = reqwest::Client::builder();
+        let result = configure_tls(builder, &tls_config);
+        assert!(result.is_ok());
+    }
+
+    #[test]
+    fn test_tls_config_custom_ca_cert_data() {
+        // Use the existing localhost.crt for testing
+        let cert_pem = include_str!("testdata/localhost.crt");
+        let cert_b64 = BASE64_STANDARD.encode(cert_pem);
+
+        let tls_config = TlsConfig {
+            ca_cert_data: Some(cert_b64),
+            insecure_skip_verify: None,
+            ca_cert_file: None,
+            client_cert_file: None,
+            client_key_file: None,
+            client_cert_data: None,
+            client_key_data: None,
+        };
+
+        let builder = reqwest::Client::builder();
+        let result = configure_tls(builder, &tls_config);
+        assert!(result.is_ok());
+    }
+
+    #[test]
+    fn test_tls_config_custom_ca_cert_file() {
+        let tls_config = TlsConfig {
+            ca_cert_file: Some("src/testdata/localhost.crt".to_string()),
+            insecure_skip_verify: None,
+            ca_cert_data: None,
+            client_cert_file: None,
+            client_key_file: None,
+            client_cert_data: None,
+            client_key_data: None,
+        };
+
+        let builder = reqwest::Client::builder();
+        let result = configure_tls(builder, &tls_config);
+        assert!(result.is_ok());
+    }
+
+    #[test]
+    fn test_tls_config_client_certificates_data() {
+        let cert_pem = include_str!("testdata/localhost.crt");
+        let key_pem = include_str!("testdata/localhost.key");
+        let cert_b64 = BASE64_STANDARD.encode(cert_pem);
+        let key_b64 = BASE64_STANDARD.encode(key_pem);
+
+        let tls_config = TlsConfig {
+            client_cert_data: Some(cert_b64),
+            client_key_data: Some(key_b64),
+            insecure_skip_verify: None,
+            ca_cert_file: None,
+            ca_cert_data: None,
+            client_cert_file: None,
+            client_key_file: None,
+        };
+
+        let builder = reqwest::Client::builder();
+        let result = configure_tls(builder, &tls_config);
+        assert!(result.is_ok());
+    }
+
+    #[test]
+    fn test_tls_config_client_certificates_files() {
+        let tls_config = TlsConfig {
+            client_cert_file: Some("src/testdata/localhost.crt".to_string()),
+            client_key_file: Some("src/testdata/localhost.key".to_string()),
+            insecure_skip_verify: None,
+            ca_cert_file: None,
+            ca_cert_data: None,
+            client_cert_data: None,
+            client_key_data: None,
+        };
+
+        let builder = reqwest::Client::builder();
+        let result = configure_tls(builder, &tls_config);
+        assert!(result.is_ok());
+    }
+
+    #[test]
+    fn test_tls_config_invalid_ca_cert_data() {
+        let tls_config = TlsConfig {
+            ca_cert_data: Some("invalid_base64".to_string()),
+            insecure_skip_verify: None,
+            ca_cert_file: None,
+            client_cert_file: None,
+            client_key_file: None,
+            client_cert_data: None,
+            client_key_data: None,
+        };
+
+        let builder = reqwest::Client::builder();
+        let result = configure_tls(builder, &tls_config);
+        assert!(result.is_err());
+        assert!(result.unwrap_err().to_string().contains("Invalid CA cert data"));
+    }
+
+    #[test]
+    fn test_tls_config_invalid_ca_cert_file() {
+        let tls_config = TlsConfig {
+            ca_cert_file: Some("nonexistent.crt".to_string()),
+            insecure_skip_verify: None,
+            ca_cert_data: None,
+            client_cert_file: None,
+            client_key_file: None,
+            client_cert_data: None,
+            client_key_data: None,
+        };
+
+        let builder = reqwest::Client::builder();
+        let result = configure_tls(builder, &tls_config);
+        assert!(result.is_err());
+        assert!(result.unwrap_err().to_string().contains("Failed to read CA cert file"));
+    }
+
+    #[test]
+    fn test_tls_config_combined_options() {
+        let cert_pem = include_str!("testdata/localhost.crt");
+        let cert_b64 = BASE64_STANDARD.encode(cert_pem);
+
+        let tls_config = TlsConfig {
+            ca_cert_data: Some(cert_b64),
+            insecure_skip_verify: Some(true),
+            ca_cert_file: None,
+            client_cert_file: None,
+            client_key_file: None,
+            client_cert_data: None,
+            client_key_data: None,
+        };
+
+        let builder = reqwest::Client::builder();
+        let result = configure_tls(builder, &tls_config);
+        assert!(result.is_ok());
+    }
+
+    #[test]
+    fn test_tls_config_empty() {
+        let tls_config = TlsConfig {
+            insecure_skip_verify: None,
+            ca_cert_file: None,
+            ca_cert_data: None,
+            client_cert_file: None,
+            client_key_file: None,
+            client_cert_data: None,
+            client_key_data: None,
+        };
+
+        let builder = reqwest::Client::builder();
+        let result = configure_tls(builder, &tls_config);
+        assert!(result.is_ok());
+    }
 }

flipt-engine-ffi/src/lib.rs

@@ -99,6 +99,25 @@ pub struct EngineOpts {
     reference: Option<String>,
     error_strategy: Option<ErrorStrategy>,
     snapshot: Option<String>,
+    tls_config: Option<TlsConfig>,
+}
+
+#[derive(Deserialize, Debug, PartialEq)]
+pub struct TlsConfig {
+    /// Path to custom CA certificate file (PEM format)
+    ca_cert_file: Option<String>,
+    /// Raw CA certificate content (PEM format, base64 encoded for JSON)
+    ca_cert_data: Option<String>,
+    /// Skip certificate verification (insecure - for development only)
+    insecure_skip_verify: Option<bool>,
+    /// Client certificate file for mutual TLS (PEM format)
+    client_cert_file: Option<String>,
+    /// Client key file for mutual TLS (PEM format)
+    client_key_file: Option<String>,
+    /// Raw client certificate content (PEM format, base64 encoded for JSON)
+    client_cert_data: Option<String>,
+    /// Raw client key content (PEM format, base64 encoded for JSON)
+    client_key_data: Option<String>,
 }
 
 impl Default for EngineOpts {
@@ -114,6 +133,7 @@ impl Default for EngineOpts {
             fetch_mode: Some(FetchMode::default()),
             error_strategy: Some(ErrorStrategy::Fail),
             snapshot: None,
+            tls_config: None,
         }
     }
 }
@@ -706,6 +726,10 @@ unsafe extern "C" fn _initialize_engine(opts: *const c_char) -> *mut c_void {
             fetcher_builder = fetcher_builder.reference(reference);
         }
 
+        if let Some(tls_config) = engine_opts.tls_config {
+            fetcher_builder = fetcher_builder.tls_config(tls_config);
+        }
+
         let fetcher = fetcher_builder.build().unwrap();
 
         let evaluator = Evaluator::new(&namespace);
@@ -1037,5 +1061,52 @@ mod tests {
         assert_eq!(opts.fetch_mode, Some(FetchMode::default()));
         assert_eq!(opts.error_strategy, Some(ErrorStrategy::Fail));
         assert_eq!(opts.snapshot, None);
+        assert_eq!(opts.tls_config, None);
+    }
+
+    #[test]
+    fn test_engine_opts_with_tls_config() {
+        let json = r#"{
+            "url": "https://localhost:8443",
+            "tls_config": {
+                "ca_cert_file": "/path/to/ca.crt",
+                "insecure_skip_verify": true
+            }
+        }"#;
+
+        let opts: EngineOpts = serde_json::from_str(json).unwrap();
+        assert_eq!(opts.url, Some("https://localhost:8443".to_string()));
+        
+        let tls_config = opts.tls_config.unwrap();
+        assert_eq!(tls_config.ca_cert_file, Some("/path/to/ca.crt".to_string()));
+        assert_eq!(tls_config.insecure_skip_verify, Some(true));
+        assert_eq!(tls_config.ca_cert_data, None);
+        assert_eq!(tls_config.client_cert_file, None);
+        assert_eq!(tls_config.client_key_file, None);
+        assert_eq!(tls_config.client_cert_data, None);
+        assert_eq!(tls_config.client_key_data, None);
+    }
+
+    #[test]
+    fn test_engine_opts_with_client_certificates() {
+        let json = r#"{
+            "url": "https://localhost:8443",
+            "tls_config": {
+                "client_cert_data": "Y2VydGRhdGE=",
+                "client_key_data": "a2V5ZGF0YQ=="
+            }
+        }"#;
+
+        let opts: EngineOpts = serde_json::from_str(json).unwrap();
+        assert_eq!(opts.url, Some("https://localhost:8443".to_string()));
+        
+        let tls_config = opts.tls_config.unwrap();
+        assert_eq!(tls_config.client_cert_data, Some("Y2VydGRhdGE=".to_string()));
+        assert_eq!(tls_config.client_key_data, Some("a2V5ZGF0YQ==".to_string()));
+        assert_eq!(tls_config.insecure_skip_verify, None);
+        assert_eq!(tls_config.ca_cert_file, None);
+        assert_eq!(tls_config.ca_cert_data, None);
+        assert_eq!(tls_config.client_cert_file, None);
+        assert_eq!(tls_config.client_key_file, None);
     }
 }