v1.3.0

[spbsoluble]

CHANGELOG

Features

• Add support for fetching an oauth2 token using the client_credentials grant type without connecting to Keyfactor Command.
• Add placeholders for omitted Authorization header in the curl command string output in trace logging.

Bug Fixes

• Log curl command string at trace level after request is sent to include any transport mutations.

Chores

• Bump Go version to 1.24.

[irby]

This is a good callout. We are setting the skip verify in the test suite. Should we use this value?

[Copilot]

Pull Request Overview

This PR prepares v1.3.0 by upgrading the Go toolchain, adding client-credentials OAuth2 support, enhancing curl-style trace logging with masked Authorization headers, and bumping module dependencies.

• Bump Go version to 1.24 and update indirect dependencies
• Implement GetAccessToken on CommandConfigOauth and improve OAuth2 transport logging
• Enhance RequestToCurl to mask credentials and add new tests

Reviewed Changes

Copilot reviewed 13 out of 14 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
go.mod	Bump to Go 1.24 and update SDK/dependency versions
auth_providers/auth_oauth.go	Add GetAccessToken, debug logging in transport RoundTrip
auth_providers/auth_oauth_test.go	Add TestCommandConfigOauth_GetAccessToken & untrusted cert tests
auth_providers/auth_core.go	Move curl logging after request, mask Authorization headers
auth_providers/auth_core_test.go	Add TestRequestToCurl for Basic/Bearer auth header masking
auth_providers/auth_basic_test.go	Update skip-test env var for basic auth tests
.github/workflows/go_tests.yml	Update Go version and new test env vars
.github/config/**	Expose new Terraform variables for ses_2441 environment

Files not reviewed (1)

• .github/config/.terraform.lock.hcl: Language not supported

Comments suppressed due to low confidence (5)

auth_providers/auth_core.go:521

• Using filepath.Dir(outputPath) creates the parent directory rather than the intended outputPath directory. If outputPath is meant as a directory, create it directly with MkdirAll(outputPath, ...).

if dirErr := os.MkdirAll(filepath.Dir(outputPath), os.ModePerm); dirErr != nil {

auth_providers/auth_core.go:526

• Removing the hostname-based .crt filename means outputFile is now just the path. If callers expect <hostname>.crt, reintroduce suffix logic or clearly document that full file paths must be provided.

outputFile := filepath.Join(outputPath)

auth_providers/auth_oauth_test.go:266

• [nitpick] Using very generic substrings like "fail" and "invalid" may match unexpected errors; consider using more specific markers (e.g., "unauthorized_client") to validate the exact failure reason.

"oauth2", "fail", "invalid", "client",

auth_providers/auth_oauth_test.go:367

• [nitpick] This test uses authOauthTest which also invokes Authenticate. If the goal is only to validate GetAccessToken, extract a dedicated test for GetAccessToken to avoid unintended network calls to Authenticate.

authOauthTest(t, "w/ GetAccessToken w/ full params variables", false, fullParamsConfig)

auth_providers/auth_basic_test.go:29

• The skip condition for basic-auth tests now checks TEST_KEYFACTOR_OAUTH instead of the intended KEYFACTOR_KC_AUTH; this will incorrectly skip basic auth tests when OAuth is enabled.

if os.Getenv("TEST_KEYFACTOR_OAUTH") == "1" || os.Getenv("TEST_KEYFACTOR_OAUTH") == "true" {