Follow-up from @hdbjeff's review on #23 (documentation/assurance point) and the mTLS forwarding work in #27.
What's missing
Symphony's PROXY v2 TLV emission (JA3 0xE0 / JA4 0xE1 fingerprints, and mTLS client-cert chain 0xE2 + SSL/authority/ALPN TLVs from #27) is currently covered only by symphony-side encoder tests — we assert the bytes symphony writes, not that the intended consumer reads them correctly.
The consumer is Harper, whose PROXY v1/v2 decoder lands in HarperFast/harper#1858 (shared decoder + withProxyProtocol for MQTT/raw sockets, synthesized getPeerCertificate). The two sides agree on a wire contract (TLV type numbers, SSL verify semantics, DER-leaf-first chain ordering) that nothing tests jointly.
Proposed
Once symphony #27 and harper #1858 both merge, add an integration test that:
- Stands up a real Harper instance behind symphony (TLS termination + mTLS on a route with
sourceAddressHeader: 'proxyProtocolV2').
- Connects a client with a CA-signed client cert.
- Asserts Harper authenticates the request via the forwarded cert (HTTP and MQTT paths) and sees the correct fingerprint — i.e. the full wire contract round-trips.
This belongs wherever the cross-repo harness lives (symphony's test:integration already pulls Harper as a dev-dep, or a harper-side integration test). Documenting the expected consumer / trust boundary / TLV encoding in the README (partially done in #27) is the lighter-weight half of the same ask.
Blocked on: #27, HarperFast/harper#1858.
🤖 Filed by Claude Fable 5 on Kris's behalf
Follow-up from @hdbjeff's review on #23 (documentation/assurance point) and the mTLS forwarding work in #27.
What's missing
Symphony's PROXY v2 TLV emission (JA3
0xE0/ JA40xE1fingerprints, and mTLS client-cert chain0xE2+ SSL/authority/ALPN TLVs from #27) is currently covered only by symphony-side encoder tests — we assert the bytes symphony writes, not that the intended consumer reads them correctly.The consumer is Harper, whose PROXY v1/v2 decoder lands in HarperFast/harper#1858 (shared decoder +
withProxyProtocolfor MQTT/raw sockets, synthesizedgetPeerCertificate). The two sides agree on a wire contract (TLV type numbers, SSLverifysemantics, DER-leaf-first chain ordering) that nothing tests jointly.Proposed
Once symphony #27 and harper #1858 both merge, add an integration test that:
sourceAddressHeader: 'proxyProtocolV2').This belongs wherever the cross-repo harness lives (symphony's
test:integrationalready pulls Harper as a dev-dep, or a harper-side integration test). Documenting the expected consumer / trust boundary / TLV encoding in the README (partially done in #27) is the lighter-weight half of the same ask.Blocked on: #27, HarperFast/harper#1858.
🤖 Filed by Claude Fable 5 on Kris's behalf