fix(security): harden agent provisioning execution

.env.demo

@@ -382,4 +382,18 @@ ADMIN_KEYCLOAK_SECRET=
 # Add in case the keycloak id of the old platform client is changed and want to update all the users in database with the new admin client
 PLATFORM_ADMIN_OLD_CLIENT_ID=
 
+# --- OpenBao secret storage (PR #1679) ---
+# Enable remote secrets fetching via OpenBao. Set to false to fall back to
+# plain environment variables (default local behaviour).
+ENABLE_BAO=true
+# Secret provider: only 'openbao' is supported today
+SECRETS_PROVIDER=openbao
+# OpenBao server URL (docker-compose.openbao.yml maps 8200)
+BAO_URL=http://127.0.0.1:8200
+# Default KV v2 path fetched at boot and injected into process.env
+BAO_SECRET_PATH=secret/data/credebl_resend_api_key
+# AppRole credentials. Generate your own via: ./openbao-init.sh
+# (values below are for the local 'openbao' container created by docker-compose.openbao.yml)
+BAO_ROLE_ID=ca2a350b-1871-0851-8557-42b36aa9c623
+BAO_SECRET_ID=3f0d8d45-c232-f5c1-2984-fe58e5144be8
 HIDE_EXPERIMENTAL_OIDC_CONTROLLERS=false

.github/dependabot.yml

@@ -32,6 +32,15 @@ updates:
     allow:
       - dependency-type: "all"
 
+    # uuid 11+ is ESM-only and cannot be loaded by the CommonJS jest runtime
+    # (see revert of the uuid 14.0.0 bump). Re-enable once the app migrates to ESM.
+    ignore:
+      - dependency-name: "uuid"
+        update-types:
+          - "version-update:semver-major"
+          - "version-update:semver-minor"
+          - "version-update:semver-patch"
+
     labels:
       - "dependencies"
       - "pnpm"

.github/workflows/continuous-delivery.yml

@@ -42,7 +42,7 @@ jobs:
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Extract Git Tag
         id: get_tag

.github/workflows/scorecard.yml

@@ -32,12 +32,12 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
         with:
           results_file: results.sarif
           results_format: sarif

.github/workflows/test.yml

@@ -0,0 +1,37 @@
+name: Test
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+jobs:
+  test:
+    name: Jest (unit + integration)
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1
+
+      - name: Setup Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
+        with:
+          node-version: 24
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile --ignore-scripts
+
+      - name: Generate Prisma client
+        run: pnpm exec prisma generate --schema=libs/prisma-service/prisma/schema.prisma
+
+      - name: Run tests
+        run: pnpm jest --config jest.ci.config.js --runInBand

CONTRIBUTING.md

@@ -11,4 +11,12 @@ end-user and developer demos (if any) in the repo should include updates or exte
 
 If you would like to propose a significant change, please open an issue first to discuss the work with the community.
 
-Contributions are made pursuant to the Developer's Certificate of Origin, available at [https://developercertificate.org](https://developercertificate.org), and licensed under the Apache License, version 2.0 (Apache-2.0).
+## Dependency updates
+
+[Dependabot](https://github.com/credebl/platform/blob/main/.github/dependabot.yml) opens grouped pull requests for npm (patch and minor), GitHub Actions, Docker, and Docker Compose dependencies on a weekly schedule.
+
+Because the unit specs mock the affected libraries away, dependency and security bumps should be verified against the real runtime packages before merging. Run the matching `*.integration.spec.ts` suite from the [README Testing section](https://github.com/credebl/platform/blob/main/README.md#testing) (e.g. SMTP for nodemailer changes, the HTTP suite for axios, the tracer suite for @opentelemetry/sdk-node, the multipart upload suite for form-data/multer). These suites run entirely in-process and require no external services or credentials.
+
+When Dependabot PRs conflict with merged updates, prefer rebasing the PR onto `main` (resolving the lockfile with `pnpm install --lockfile-only`) over closing and reopening, so review history is preserved. All commits must remain signed and DCO-compliant.
+
+Contributions are made pursuant to the Developer's Certificate of Origin, available at [https://developercertificate.org](https://developercertificate.org), and licensed under the Apache License, version 2.0 (Apache-2.0).

README.md

@@ -5,20 +5,24 @@ This repository hosts the codebase for CREDEBL SSI Platform backend.
 ## Prerequisites
 
 ### • Install Docker and Docker Compose
+
 See: https://docs.docker.com/engine/install/
 
 ### • Install Node.js
+
 Version: >= 18.17.0  
 See: https://nodejs.dev/en/learn/how-to-install-nodejs/
 
 ### • Install NestJS CLI
+
 ```bash
-npm i @nestjs/cli@latest 
+npm i @nestjs/cli@latest
 ```
 
 ## Setup Instructions
 
 ### • Setup and Run PostgreSQL
+
 Start the PostgreSQL service using Docker:
 
 ```bash
@@ -57,23 +61,75 @@ docker pull nats:latest
 ```
 
 ### • Run NATS using Docker Compose
+
 The `docker-compose.yml` file is available in the root folder.
 
 ```bash
 docker-compose up
 ```
 
+## OpenBao Secret Storage (Optional)
+
+The platform can source the credentials used by email and file-storage integrations from an [OpenBao](https://openbao.org) server instead of plain environment variables. This is opt-in and disabled by default.
+
+### • Run OpenBao using Docker Compose
+
+```bash
+docker compose -f docker-compose.openbao.yml up -d
+```
+
+This starts an OpenBao server on `http://127.0.0.1:8200` with file-backed storage persisted on a named volume. Server settings live in `config.hcl`.
+
+### • Provision the server
+
+OpenBao starts sealed and uninitialized. Run the one-shot provisioning script (idempotent — safe to re-run):
+
+```bash
+./openbao-init.sh
+```
+
+The script initializes and unseals the server, enables the KV v2 secrets engine at `secret/`, enables the AppRole auth method, creates a `credebl` role scoped to the `credebl_*` secret paths, stores the secret values found in the environment (e.g. `RESEND_API_KEY`, `SMTP_HOST`, `AWS_ACCESS_KEY`), and prints the values to copy into your env file:
+
+```bash
+BAO_URL=http://127.0.0.1:8200
+BAO_SECRET_PATH=secret/data/credebl_resend_api_key
+BAO_ROLE_ID=<generated>
+BAO_SECRET_ID=<generated>
+```
+
+Keep the printed `BAO_UNSEAL_KEY` and `BAO_ROOT_TOKEN` safe — they are shown only once. On later runs, pass `BAO_ROOT_TOKEN` (and `BAO_SECRET_ID` to re-print it).
+
+### • Configure the platform
+
+Add the following to your `.env` (values are already present as placeholders in `.env.demo`):
+
+```bash
+ENABLE_BAO=true
+SECRETS_PROVIDER=openbao
+BAO_URL=http://127.0.0.1:8200
+BAO_SECRET_PATH=secret/data/credebl_resend_api_key
+BAO_ROLE_ID=<from openbao-init.sh>
+BAO_SECRET_ID=<from openbao-init.sh>
+```
+
+At startup every microservice authenticates to OpenBao via AppRole, fetches the secrets at `BAO_SECRET_PATH`, and injects them into `process.env` before the NATS listener starts. Email and S3 integrations re-fetch their own credential paths on demand (e.g. `secret/data/credebl_smtp_config`, `secret/data/credebl_aws_keys`) with a 10-minute TTL cache.
+
+Set `ENABLE_BAO=false` (or omit it) to fall back to local environment variables.
+
 ## Run CREDEBL Microservices
 
 ### • Install Dependencies
+
 ```bash
 npm install
 ```
 
 ### • Configure Environment Variables
+
 Configure environment variables in `.env` before you start the API Gateway.
 
 ### • Running the API Gateway
+
 You can optionally use the `--watch` flag during development/testing.
 
 ```bash
@@ -100,6 +156,31 @@ nest start agent-provisioning [--watch]
 nest start agent-service [--watch]
 ```
 
+### Agent provisioning
+
+Deploy `agent-service` and `agent-provisioning` together: ledger JSON is now passed directly as a process argument. Local and Docker scripts need `SCHEMA_FILE_SERVER_URL` and `AGENT_API_KEY`; AWS settings are required only for the corresponding ECS/Fargate scripts.
+
+## Testing
+
+Tests are written with [Jest](https://jestjs.io) and run via pnpm (the repo's package manager):
+
+```bash
+pnpm install
+pnpm jest                 # run the full suite
+pnpm jest <path/to/spec>  # run a single spec file or folder
+```
+
+Two kinds of suites exist:
+
+- **Unit specs** (`*.spec.ts`) mock external libraries and run quickly.
+- **Integration specs** (`*.integration.spec.ts`) exercise the real wire protocol of the runtime dependencies against in-process loopback servers — no external services or credentials are needed. They cover:
+  - SMTP delivery with **nodemailer** (plain SMTP, implicit TLS on port 465, STARTTLS on port 587) using self-signed fixtures in `libs/common/src/__fixtures__/smtp/`;
+  - real outbound HTTP through **@nestjs/axios** (`HttpService`), including the `HTTP_PROXY` path;
+  - **@opentelemetry/sdk-node** boot and OTLP span export;
+  - **multipart file upload** through form-data/multer.
+
+These suites are the recommended way to verify Dependabot or security-relevant dependency bumps before merging — the unit specs mock the affected libraries away. Before running tests, generate the Prisma client as described in [Setup Instructions](#setup-instructions).
+
 ## Access Microservice Endpoints
 
 To access microservice endpoints using the API Gateway, navigate to:
@@ -110,7 +191,7 @@ http://localhost:5000/api
 
 ## Credit
 
-The CREDEBL platform is built by AYANWORKS team. 
+The CREDEBL platform is built by AYANWORKS team.
 For the core SSI capabilities, it leverages the great work from multiple open-source projects such as Hyperledger Aries, Bifold, Asker, Indy, etc.
 
 ## Contributing
@@ -119,4 +200,4 @@ Pull requests are welcome! Please read our [contributions guide](https://github.
 
 ## License
 
-[Apache License Version 2.0](https://github.com/credebl/platform/blob/main/LICENSE)
+[Apache License Version 2.0](https://github.com/credebl/platform/blob/main/LICENSE)

apps/agent-provisioning/src/agent-config-generation.spec.ts

@@ -0,0 +1,67 @@
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+// Exercise the real configuration template, stopping before container startup.
+// No Docker, network calls, or real credentials are needed for this regression.
+describe('Indy ledger configuration generation', () => {
+  const genesisTransactions = [
+    JSON.stringify({ txn: { data: { alias: 'Node "One"', path: 'C:\\ledger' } } }),
+    JSON.stringify({ txn: { data: { alias: 'Node Two' } } })
+  ].join('\n');
+  const ledger = { genesisTransactions, indyNamespace: 'test:ledger' };
+  let directory: string;
+  let scriptPath: string;
+
+  beforeEach(() => {
+    directory = mkdtempSync(join(tmpdir(), 'agent-config-test-'));
+    mkdirSync(join(directory, 'apps/agent-provisioning/AFJ/port-file'), { recursive: true });
+    const source = readFileSync(join(__dirname, '../AFJ/scripts/start_agent.sh'), 'utf8');
+    const stopBefore = '\nFILE_NAME="docker-compose_';
+    expect(source.split(stopBefore)).toHaveLength(2);
+    const [configurationScript] = source.split(stopBefore);
+    scriptPath = join(directory, 'generate-config.sh');
+    writeFileSync(scriptPath, configurationScript, { mode: 0o700 });
+  });
+
+  afterEach(() => {
+    rmSync(directory, { recursive: true, force: true });
+  });
+
+  it.each([
+    ['empty', []],
+    ['multiple with quoted and multiline genesis', [ledger, { ...ledger, indyNamespace: 'test:second' }]]
+  ])('preserves %s ledger data passed without shell escaping', (_name, ledgers) => {
+    execFileSync(
+      scriptPath,
+      [
+        'org-test',
+        '127.0.0.1',
+        'wallet',
+        'test-wallet-key',
+        'seed',
+        'https://webhook.example.test',
+        'postgres',
+        '5432',
+        'user',
+        'test-storage-key',
+        'agent-test',
+        'http',
+        'false',
+        'credo:test',
+        JSON.stringify(ledgers),
+        '127.0.0.1',
+        'https://schema.example.test',
+        'test-api-key'
+      ],
+      { cwd: directory, timeout: 5000, stdio: 'pipe' }
+    );
+
+    const config = JSON.parse(
+      readFileSync(join(directory, 'apps/agent-provisioning/AFJ/agent-config/org-test_agent-test.json'), 'utf8')
+    );
+    expect(config.indyLedger).toEqual(ledgers);
+    expect(config.walletId).toBe('wallet');
+  });
+});