Files that changed from the base of the PR and between 46b01e9 and fdb31a6.

• op-defender/cmd/defender/cli.go (1 hunks)
• op-defender/psp_executor/cli.go (4 hunks)
• op-defender/psp_executor/defender.go (4 hunks)

op-defender/cmd/defender/cli.go (2)

Line range hint 1-78: Verify mTLS implementation in related files

While this file now includes a validation step for the configuration, which is a positive change, the mTLS implementation mentioned in the PR objectives is not directly visible here.

To ensure that mTLS is properly implemented, let's examine related files:

#!/bin/bash
# Description: Search for mTLS-related code in the project

# Test 1: Search for mTLS configuration in Config struct
ast-grep --lang go --pattern 'type Config struct {
  $$$
  // Look for fields related to mTLS
  $_ $_
  $$$
}'

# Test 2: Search for mTLS setup in server initialization
rg --type go -A 10 'func New.*Server'

# Test 3: Search for mTLS-related flags
rg --type go 'cli\.StringFlag.*mTLS'

These checks will help verify that mTLS is properly configured and implemented across the project.

---

59-61: Approve: Good addition of configuration validation

The addition of the cfg.Check() call improves the robustness of the application by ensuring that only valid configurations are processed. This aligns well with the PR objectives of enhancing security and reliability.

Consider enhancing the error handling to provide more context:

 if err := cfg.Check(); err != nil {
-    return nil, err
+    return nil, fmt.Errorf("invalid configuration: %w", err)
 }

This will make debugging easier by providing more information about the nature of the configuration error.

To ensure that the cfg.Check() method includes all necessary validations, especially for mTLS, let's examine its implementation:

op-defender/psp_executor/cli.go (5)

5-5: Import statement for TLS configuration added correctly

The import of the optls package is necessary for TLS configuration and is appropriately included.

---

30-30: Addition of TLSConfig field to CLIConfig struct

The TLSConfig field is added to the CLIConfig struct to incorporate TLS settings, aligning with the objective of introducing mTLS authentication.

---

43-43: Initialize TLSConfig in ReadCLIFlags function

The TLSConfig field is properly initialized using optls.ReadCLIConfig(ctx), ensuring that TLS configurations are read from the CLI context.

---

50-50: Refactor CLIFlags function to use a local flags variable

Assigning the initial flags to a local variable flags allows for appending additional flags later, which is necessary for incorporating the new TLS flags.

---

123-128: Ensure TLSConfig.Check() handles optional TLS configuration

If mTLS is optional, verify that the Check() method of TLSConfig does not return an error when TLS settings are not provided.

Run the following script to confirm that the application initializes correctly without TLS configurations:

This ensures that the application remains functional when mTLS is not enabled, and TLSConfig.Check() handles the absence of TLS settings gracefully.