fix: respect env vars in XKS config.sh

aws_xks/scripts/utils/config.sh

@@ -1,12 +1,12 @@
 # Change this to your XKS Proxy endpoint to test.
-export XKS_PROXY_HOST="localhost:9998"
+export XKS_PROXY_HOST="${XKS_PROXY_HOST:-localhost:9998}"
 # Change this to the URI_PREFIX of a logical keystore supported by your XKS Proxy.
-export URI_PREFIX="aws"
+export URI_PREFIX="${URI_PREFIX:-aws}"
 # Change this to the Access key ID for request authentication to your logical keystore.
 # Valid characters are a-z, A-Z, 0-9, /, - (hyphen), and _ (underscore)
-export SIGV4_ACCESS_KEY_ID="AKIAIOSFODNN7EXAMPLE"
+export SIGV4_ACCESS_KEY_ID="${SIGV4_ACCESS_KEY_ID:-AKIAIOSFODNN7EXAMPLE}"
 # Change this to the Secret access key for request authentication to your logical keystore.
 # Secret access key must have between 43 and 64 characters. Valid characters are a-z, A-Z, 0-9, /, +, and =
-export SIGV4_SECRET_ACCESS_KEY="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
+export SIGV4_SECRET_ACCESS_KEY="${SIGV4_SECRET_ACCESS_KEY:-wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY}"
 # Change this to a test key id supported by your logical keystore.
-export KEY_ID="aws_xks_kek"
+export KEY_ID="${KEY_ID:-aws_xks_kek}"

configs/server/auth_verifier.toml

@@ -1,69 +1,4 @@
-# KMS server configured with Authentication Verifier (auth-verifier)
-# as the primary auth method, served over HTTPS.
-#
-# The KMS server:
-#   1. Terminates TLS using a PEM server certificate and private key.
-#   2. Validates bearer tokens against the verifier's JWKS endpoint.
-#   3. Exposes the Web UI login form (GET /ui/auth_method returns "AUTH_VERIFIER")
-#      and proxies credentials to the verifier via POST /ui/login_as.
-#
-# Because kms_public_url uses https://, the session cookie will carry the Secure
-# flag — browsers only send it over HTTPS, which is the expected behaviour for
-# production.  For local dev with a self-signed certificate the KMS client must
-# set accept_invalid_certs = true.
-#
-# Prerequisites:
-#   - A running Authentication Verifier at auth_verifier_url below.
-#   - The verifier's JWKS endpoint must be reachable from the KMS server.
-#   - The TLS cert/key files below must exist (relative to the repo root).
-#
-# Bound to port 9998 (default KMS port).
-
-default_username = "admin"
-kms_public_url = "https://localhost:9998"
-
-[http]
-port = 9998
-hostname = "0.0.0.0"
-
-[tls]
-# Server certificate and private key (PEM).  No client CA → server-TLS only
-# (no mutual authentication required).
-tls_cert_file = "test_data/certificates/client_server/server/kmserver.acme.com.crt"
-tls_key_file  = "test_data/certificates/client_server/server/kmserver.acme.com.key"
-
-[db]
-database_type = "sqlite"
-sqlite_path = "./sqlite-data-auth-verifier"
-clear_database = false
-
-# ── Authentication Verifier ──────────────────────────────────────────────────
-# When both `auth_verifier_url` and `auth_verifier_realm` are set, the
-# KMS server:
-#   1. Validates bearer tokens against the verifier's JWKS endpoint
-#   2. Exposes the Web UI login form (GET /ui/auth_method returns "AUTH_VERIFIER")
-#   3. Proxies login credentials to the verifier via POST /ui/login_as
-#
-# `auth_verifier_accept_invalid_certs` allows the JWKS fetch to target an HTTP
-# URL (or a server with a self-signed certificate).  In production the verifier
-# must be reachable over HTTPS with a valid certificate, and this flag must be
-# set to false.
 [auth_verifier]
-auth_verifier_url = "https://localhost:8443"
-auth_verifier_realm = "_"
-auth_verifier_accept_invalid_certs = true   # dev/test only — never in production
-
-[ui_config]
-ui_index_html_folder = "./ui/dist"
-# A stable session salt ties the session cookie encryption key to this server's
-# public URL, making it deterministic across restarts and portable across
-# load-balanced instances.
-# Generate your own with: openssl rand -hex 32
-ui_session_salt = "change-me-use-openssl-rand-hex-32"
-
-[logging]
-rust_log = "info,cosmian_kms=debug"
-quiet = false
-log_to_syslog = false
-environment = "development"
-ansi_colors = true
+auth_verifier_url                  = "https://localhost:8443"
+auth_verifier_realm                = "_"
+auth_verifier_accept_invalid_certs = true

configs/server/rbac/crypto_officer_users.toml

@@ -0,0 +1,31 @@
+# Test KMS server — RBAC mode with privileged users, no ceremony.
+# Loaded by start_default_test_kms_server_with_crypto_officer_users() and
+# start_default_test_kms_server_with_multi_crypto_officer_users().
+# The crypto_officer_users field is overridden at runtime by the test helper.
+# Port and database paths are allocated dynamically at runtime.
+#
+# CO users: injected at runtime (owner.client@acme.com, user.privileged@acme.com, …)
+
+default_username = "tech@cosmian.com"
+kms_public_url = "https://localhost:10005"
+
+[http]
+port = 10005
+hostname = "0.0.0.0"
+
+[db]
+database_type = "sqlite"
+sqlite_path = "/tmp/kms_test_crypto_officer_users"
+clear_database = true
+
+[workspace]
+root_data_path = "/tmp/kms_test_workspace_crypto_officer_users"
+tmp_path = "/tmp"
+
+[tls]
+tls_cert_file = "test_data/certificates/client_server/server/kmserver.acme.com.crt"
+tls_key_file = "test_data/certificates/client_server/server/kmserver.acme.com.key"
+clients_ca_cert_file = "test_data/certificates/client_server/ca/ca.crt"
+
+[roles]
+crypto_officer_require_ceremony = false