feat(provider): add public identity attestation endpoint - #337
Draft
miguel502 wants to merge 2 commits into
Draft
Conversation
miguel502
marked this pull request as draft
August 13, 2026 16:22
github-actions
Bot
force-pushed
the
staging
branch
from
August 13, 2026 22:44
2845a76 to
fa45761
Compare
Add GET /api/identity, which returns the compressed secp256k1 public key derived from the running instance's APP_IDENTITY private key — the same value published as identity in the governance registry — so CI can fetch <registry url>/api/identity and compare. The key is derived from the environment per request rather than read from application_settings, so the response cannot go stale after an APP_IDENTITY rotation and does not depend on the database or on bootstrap having completed. Whether the instance is operational is a separate question, already answered by /api/health. The route is unauthenticated by design: the value is a public key already published in the governance repository.
miguel502
force-pushed
the
feature/provider-identity-endpoint
branch
from
August 15, 2026 23:33
dbf5441 to
0bdf0a3
Compare
Provider serves an admin portal API on the same port, but only the API needs to be public. Add docs/guides/provider/expose-api.md with the verified path allowlist, a default-deny nginx configuration, and commands to verify the result. Correct the path table in docker-compose/README.md: it was missing POST /api/suppliers/address-groups, without which address-group sync breaks.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add
GET /api/identity, which returns the compressed secp256k1 public key derived from the running instance'sAPP_IDENTITYprivate key — the same value published asidentityin the governance registry — so CI can fetch<registry url>/api/identityand compare.The key is derived from the environment per request rather than read from
application_settings, so the response cannot go stale after anAPP_IDENTITYrotation and does not depend on the database or on bootstrap having completed. Whether the instance is operational is a separate question, already answered by/api/health.The route is unauthenticated by design: the value is a public key already published in the governance repository.