enable auth in participant admin API

apps/app/src/main/scala/org/lfdecentralizedtrust/splice/config/ConfigTransforms.scala

@@ -197,6 +197,7 @@ object ConfigTransforms {
       makeAllTimeoutsBounded,
       ensureNovelDamlNames(testId),
       useSelfSignedTokensForLedgerApiAuth("test"),
+      useSelfSignedTokensForParticipantAdminApiAuth("test", "test-scope"),
       reducePollingInterval,
       withPausedSvDomainComponentsOffboardingTriggers(),
       disableOnboardingParticipantPromotionDelay(),
@@ -581,7 +582,7 @@ object ConfigTransforms {
         config
           .focus(_.participantClient.ledgerApi.clientConfig.port)
           .modify(setPortPrefix(range))
-          .focus(_.participantClient.adminApi.port)
+          .focus(_.participantClient.adminApi.clientConfig.port)
           .modify(setPortPrefix(range))
           .focus(_.localSynchronizerNodes.current)
           .modify(setSvSynchronizerConfigPortsPrefix(range, _))
@@ -640,7 +641,7 @@ object ConfigTransforms {
         config
           .focus(_.participantClient.ledgerApi.clientConfig.port)
           .modify(setPortPrefix(range))
-          .focus(_.participantClient.adminApi.port)
+          .focus(_.participantClient.adminApi.clientConfig.port)
           .modify(setPortPrefix(range))
           .focus(_.adminApi.internalPort)
           .modify(_.map(setPortPrefix(range)))
@@ -697,7 +698,7 @@ object ConfigTransforms {
         config
           .focus(_.participantClient.ledgerApi.clientConfig.port)
           .modify(setPortPrefix(range))
-          .focus(_.participantClient.adminApi.port)
+          .focus(_.participantClient.adminApi.clientConfig.port)
           .modify(setPortPrefix(range))
           .focus(_.adminApi.internalPort)
           .modify(_.map(setPortPrefix(range)))
@@ -854,7 +855,7 @@ object ConfigTransforms {
       mediator = portTransform(bump, c.mediator),
     )
 
-  private def portTransform(bump: Int, c: LedgerApiClientConfig): LedgerApiClientConfig =
+  private def portTransform(bump: Int, c: ClientConfigWithAuth): ClientConfigWithAuth =
     c.focus(_.clientConfig).modify(portTransform(bump, _))
 
   private def portTransform(
@@ -905,7 +906,7 @@ object ConfigTransforms {
   }
 
   private def updateAllLedgerApiClientConfigs(
-      enableAuth: (String, LedgerApiClientConfig) => LedgerApiClientConfig
+      enableAuth: (String, ClientConfigWithAuth) => ClientConfigWithAuth
   ): ConfigTransform = {
     combineAllTransforms(
       updateAllValidatorConfigs_(c => {
@@ -928,8 +929,8 @@ object ConfigTransforms {
 
   def selfSignedTokenAuthSourceTransform(clockConfig: ClockConfig, secret: String)(
       user: String,
-      c: LedgerApiClientConfig,
-  ): LedgerApiClientConfig = {
+      c: ClientConfigWithAuth,
+  ): ClientConfigWithAuth = {
     val userToken = AuthUtil.LedgerApi.testToken(
       user = user,
       secret = secret,
@@ -942,6 +943,51 @@ object ConfigTransforms {
     )
   }
 
+  def useSelfSignedTokensForParticipantAdminApiAuth(
+      secret: String,
+      scope: String,
+  ): ConfigTransform = { config =>
+    modifyAllParticipantAdminApiConfigs { (adminApi, _) =>
+      adminApi.copy(
+        authConfig = AuthTokenSourceConfig.Static(
+          token = AuthUtil.CantonAdminApi.testToken(secret, scope),
+          adminToken = Some(AuthUtil.CantonAdminApi.testToken(secret, scope)),
+        )
+      )
+    }(config)
+  }
+
+  private def modifyAllParticipantAdminApiConfigs(
+      modify: (ClientConfigWithAuth, BaseParticipantClientConfig) => ClientConfigWithAuth
+  ): ConfigTransform =
+    combineAllTransforms(
+      updateAllValidatorConfigs_(
+        _.focus(_.participantClient).modify(participantClient =>
+          participantClient.copy(adminApi = modify(participantClient.adminApi, participantClient))
+        )
+      ),
+      updateAllSvAppConfigs_(
+        _.focus(_.participantClient).modify(participantClient =>
+          participantClient.copy(adminApi = modify(participantClient.adminApi, participantClient))
+        )
+      ),
+      updateAllScanAppConfigs_(
+        _.focus(_.participantClient).modify(participantClient =>
+          participantClient.copy(adminApi = modify(participantClient.adminApi, participantClient))
+        )
+      ),
+      updateAllSplitwellAppConfigs_(
+        _.focus(_.participantClient).modify(participantClient =>
+          participantClient.copy(adminApi = modify(participantClient.adminApi, participantClient))
+        )
+      ),
+      updateAllRemoteSplitwellAppConfigs_(
+        _.focus(_.participantClient).modify(participantClient =>
+          participantClient.copy(adminApi = modify(participantClient.adminApi, participantClient))
+        )
+      ),
+    )
+
   def useSplitwellUpgradeDomain(): ConfigTransform =
     updateAllSplitwellAppConfigs_(c => {
       c.copy(

apps/app/src/main/scala/org/lfdecentralizedtrust/splice/config/SpliceConfig.scala

@@ -480,8 +480,8 @@ object SpliceConfig {
     implicit val ingestionConfig: ConfigReader[IngestionConfig] = deriveReader[IngestionConfig]
     implicit val automationConfig: ConfigReader[AutomationConfig] =
       deriveReader[AutomationConfig]
-    implicit val LedgerApiClientConfigReader: ConfigReader[LedgerApiClientConfig] =
-      deriveReader[LedgerApiClientConfig]
+    implicit val LedgerApiClientConfigReader: ConfigReader[ClientConfigWithAuth] =
+      deriveReader[ClientConfigWithAuth]
     implicit val ParticipantClientConfigReader: ConfigReader[ParticipantClientConfig] =
       deriveReader[ParticipantClientConfig]
     implicit val appInstanceReader: ConfigReader[AppInstance] =
@@ -1033,8 +1033,8 @@ object SpliceConfig {
     implicit val ingestionConfig: ConfigWriter[IngestionConfig] = deriveWriter[IngestionConfig]
     implicit val automationConfig: ConfigWriter[AutomationConfig] =
       deriveWriter[AutomationConfig]
-    implicit val LedgerApiClientConfigWriter: ConfigWriter[LedgerApiClientConfig] =
-      deriveWriter[LedgerApiClientConfig]
+    implicit val LedgerApiClientConfigWriter: ConfigWriter[ClientConfigWithAuth] =
+      deriveWriter[ClientConfigWithAuth]
     implicit val ParticipantClientConfigWriter: ConfigWriter[ParticipantClientConfig] =
       deriveWriter[ParticipantClientConfig]
     implicit val appInstanceWriter: ConfigWriter[AppInstance] =

apps/app/src/main/scala/org/lfdecentralizedtrust/splice/console/SpliceInstanceReference.scala

@@ -258,16 +258,26 @@ trait AppBackendReference extends AppReference with LocalInstanceReference {
   private def getRemoteParticipantConfigWithToken(
       participantClientConfig: BaseParticipantClientConfig
   )(implicit ec: ExecutionContext): RemoteParticipantConfig = {
-    val tokenStrO = Await.result(
-      spliceConsoleEnvironment.httpClient
-        .getToken(participantClientConfig.ledgerApi.authConfig)
-        .map(_.map(_.accessToken)),
+    val (maybeLedgerApiToken, maybeAdminApiToken) = Await.result(
+      {
+        val maybeLedgerApiTokenF = spliceConsoleEnvironment.httpClient
+          .getToken(participantClientConfig.ledgerApi.authConfig)
+          .map(_.map(_.accessToken))
+        val maybeAdminApiTokenF = spliceConsoleEnvironment.httpClient
+          .getToken(participantClientConfig.adminApi.authConfig)
+          .map(_.map(_.accessToken))
+        for {
+          maybeLedgerApiToken <- maybeLedgerApiTokenF
+          maybeAdminApiToken <- maybeAdminApiTokenF
+        } yield (maybeLedgerApiToken, maybeAdminApiToken)
+      },
       30.seconds,
     )
     RemoteParticipantConfig(
-      participantClientConfig.adminApi,
+      participantClientConfig.adminApi.clientConfig,
       participantClientConfig.ledgerApi.clientConfig,
-      token = tokenStrO,
+      ledgerApiToken = maybeLedgerApiToken,
+      adminApiToken = maybeAdminApiToken,
     )
   }
   implicit val ec: ExecutionContext = executionContext

apps/app/src/test/resources/include/participant-admin-api-auth-test.conf

@@ -0,0 +1,11 @@
+_shared_participant_admin_api {
+  auth-services = [
+    # used by most of our tests
+    {
+      type = unsafe-jwt-hmac-256
+      secret = "test"
+      target-scope = "test-scope"
+      privileged = true
+    }
+  ]
+}

apps/app/src/test/resources/include/participants.conf

@@ -1,5 +1,6 @@
 include required("storage-postgres.conf")
 include required("ledger-api-auth-test.conf")
+include required("participant-admin-api-auth-test.conf")
 
 _participant_template {
   init {
@@ -9,6 +10,7 @@ _participant_template {
     identity.type = manual
   }
   ledger-api.auth-services = ${_shared.auth-services}
+  admin-api.auth-services = ${_shared_participant_admin_api.auth-services}
   storage = ${_shared.storage}
   parameters {
     # tune the synchronisation protocols contract store cache

apps/app/src/test/resources/include/scans/_scan.conf

@@ -13,6 +13,7 @@
   instance-lock-enabled = false
   admin-api.address = 0.0.0.0
   participant-client {
+    admin-api.auth-config.type = "none"
     ledger-api.auth-config.type = "none"
   }
 

apps/app/src/test/resources/include/scans/sv1-scan.conf

@@ -2,7 +2,7 @@
   include required("_scan")
 
   participant-client = {
-    admin-api.port = 5102
+    admin-api.client-config.port = 5102
     ledger-api.client-config.port = 5101
   }
   synchronizer-nodes.current.sequencer.port = 5109

apps/app/src/test/resources/include/scans/sv2-scan.conf

@@ -2,7 +2,7 @@
   include required("_scan")
 
   participant-client = {
-    admin-api.port = 5202
+    admin-api.client-config.port = 5202
     ledger-api.client-config.port = 5201
   }
   synchronizer-nodes.current.sequencer.port = 5209

apps/app/src/test/resources/include/scans/sv3-scan.conf

@@ -2,7 +2,7 @@
   include required("_scan")
 
   participant-client = {
-    admin-api.port = 5302
+    admin-api.client-config.port = 5302
     ledger-api.client-config.port = 5301
   }
   synchronizer-nodes.current.sequencer.port = 5309

apps/app/src/test/resources/include/scans/sv4-scan.conf

@@ -2,7 +2,7 @@
   include required("_scan")
 
   participant-client = {
-    admin-api.port = 5402
+    admin-api.client-config.port = 5402
     ledger-api.client-config.port = 5401
   }
   synchronizer-nodes.current.sequencer.port = 5409

apps/app/src/test/resources/include/svs/_sv.conf

@@ -10,8 +10,9 @@
   }
   instance-lock-enabled = false
   participant-client = {
-    admin-api.port = 5102
+    admin-api.client-config.port = 5102
     ledger-api.client-config.port = 5101
+    admin-api.auth-config.type = "none"
     ledger-api.auth-config.type = "none" # we override this via config transform
   }
   auth {

apps/app/src/test/resources/include/svs/sv2.conf

@@ -1,7 +1,7 @@
 {
   include required("_sv")
   participant-client = {
-    admin-api.port = 5202
+    admin-api.client-config.port = 5202
     ledger-api.client-config.port = 5201
   }
   admin-api.port = 5214

apps/app/src/test/resources/include/svs/sv3.conf

@@ -1,7 +1,7 @@
 {
   include required("_sv")
   participant-client = {
-    admin-api.port = 5302
+    admin-api.client-config.port = 5302
     ledger-api.client-config.port = 5301
   }
   admin-api.port = 5314

apps/app/src/test/resources/include/svs/sv4.conf

@@ -1,7 +1,7 @@
 {
   include required("_sv")
   participant-client = {
-    admin-api.port = 5402
+    admin-api.client-config.port = 5402
     ledger-api.client-config.port = 5401
   }
   admin-api.port = 5414

apps/app/src/test/resources/include/validators/_validator.conf

@@ -10,6 +10,7 @@
   instance-lock-enabled = false
 
   participant-client = {
+    admin-api.auth-config.type = "none"
     ledger-api.auth-config.type = "none"
   }
   auth {

apps/app/src/test/resources/include/validators/alice-validator.conf

@@ -3,7 +3,7 @@
 
   admin-api.port = 5503
   participant-client = {
-    admin-api.port = 5502
+    admin-api.client-config.port = 5502
     ledger-api.client-config.port = 5501
   }
   ledger-api-user = "alice_validator_user"

apps/app/src/test/resources/include/validators/bob-validator.conf

@@ -3,7 +3,7 @@
 
   admin-api.port = 5603
   participant-client = {
-    admin-api.port = 5602
+    admin-api.client-config.port = 5602
     ledger-api.client-config.port = 5601
   }
   ledger-api-user = "bob_validator_user"

apps/app/src/test/resources/include/validators/splitwell-validator.conf

@@ -3,7 +3,7 @@
 
   admin-api.port = 5703
   participant-client = {
-    admin-api.port = 5702
+    admin-api.client-config.port = 5702
     ledger-api.client-config.port = 5701
   }
   ledger-api-user = "splitwell_validator_user"

apps/app/src/test/resources/include/validators/sv1-validator.conf

@@ -3,7 +3,7 @@
 
   admin-api.port = 5103
   participant-client = {
-    admin-api.port = 5102
+    admin-api.client-config.port = 5102
     ledger-api.client-config.port = 5101
   }
   ledger-api-user = "sv1_validator_user"

apps/app/src/test/resources/include/validators/sv2-validator.conf

@@ -3,7 +3,7 @@
 
   admin-api.port = 5203
   participant-client = {
-    admin-api.port = 5202
+    admin-api.client-config.port = 5202
     ledger-api.client-config.port = 5201
   }
   ledger-api-user = "sv2_validator_user"

apps/app/src/test/resources/include/validators/sv3-validator.conf

@@ -3,7 +3,7 @@
 
   admin-api.port = 5303
   participant-client = {
-    admin-api.port = 5302
+    admin-api.client-config.port = 5302
     ledger-api.client-config.port = 5301
   }
   ledger-api-user = "sv3_validator_user"

apps/app/src/test/resources/include/validators/sv4-validator.conf

@@ -3,7 +3,7 @@
 
   admin-api.port = 5403
   participant-client = {
-    admin-api.port = 5402
+    admin-api.client-config.port = 5402
     ledger-api.client-config.port = 5401
   }
   ledger-api-user = "sv4_validator_user"

apps/app/src/test/resources/local-sv-node/scan-app/app.conf

@@ -1,9 +1,10 @@
 include required("../../include/storage-postgres.conf")
 _scan_participant_client {
-  admin-api = {
+  admin-api.client-config = {
     address = "0.0.0.0"
     port = 9102
   }
+  admin-api.auth-config.type = "none"
 
   ledger-api.client-config = {
     address = "0.0.0.0"

apps/app/src/test/resources/local-sv-node/sv-app/app.conf

@@ -11,7 +11,8 @@ _sv {
   }
 
   participant-client = {
-    admin-api.port = 9102
+    admin-api.client-config.port = 9102
+    admin-api.auth-config.type = "none"
     ledger-api.client-config.port = 9101
     ledger-api.auth-config.type = "none"
   }

apps/app/src/test/resources/local-sv-node/validator-app/app.conf

@@ -13,7 +13,8 @@ canton {
 
       admin-api.port = 5103
       participant-client = {
-        admin-api.port = 9102
+        admin-api.client-config.port = 9102
+        admin-api.auth-config.type = "none"
         ledger-api.client-config.port = 9101
         ledger-api.auth-config.type = "none"
       }

apps/app/src/test/resources/local-validator-node/validator-app/app.conf

@@ -13,7 +13,8 @@ canton {
 
       admin-api.port = 5503
       participant-client = {
-        admin-api.port = 27502
+        admin-api.client-config.port = 27502
+        admin-api.auth-config.type = "none"
         ledger-api.client-config.port = 27501
         ledger-api.auth-config.type = "none"
       }