Commit 23a9e4e4 authored by Sergio Gimenez's avatar Sergio Gimenez Committed by Dimitrios Gogos
Browse files

docs: propagate ADR-0038 to platform architecture + future-architecture 

FM EWBI gateway pattern and the platform boundary/role tables now describe
OAuth2 Client-Credentials + signed JWT (Keycloak federation realm, fed-mgmt
scope) for partner E/WBI, with mTLS as deferred defense-in-depth. The
future-architecture federation-partner row likewise moves from mTLS to OAuth2
JWT. ADR-0038 is referenced where the platform-wide boundary is stated.
parent a8734e1d

platform/architecture.md

+3 −3
Changes for platform/architecture.md: 3 added lines, 3 removed lines.
Original line number Diff line number Diff line
@@ -705,7 +705,7 @@ These decisions are **binding** — they have been made and should not be reopen 
**What it is not:** FM does not expose APIs to developers. It does not fulfill requests itself — it publishes commands to the DataBus, and SRM handles fulfillment. FM does not import TF-SDK.



**Key design patterns:**

- **EWBI gateway:** Single Python/FastAPI service (ADR-0016). Nginx terminates mTLS and forwards the client certificate in a header; FM middleware validates the thumbprint, whitelists partner IPs at the Nginx level, and strips internal headers. Outbound EWBI mTLS uses `httpx` with per-partner client certificates.

- **EWBI gateway:** Single Python/FastAPI service (ADR-0016). Authorization is OAuth2 Client-Credentials + signed JWT against the platform's centralized Keycloak, dedicated `federation` realm (ADR-0038) — not mTLS. Nginx terminates HTTPS and routes `/ewbi/*` to FM, whitelists partner IPs, and strips internal headers; client-certificate mTLS is a deferred defense-in-depth layer once Nginx does real mTLS termination.

- **Topology hiding:** Mandatory removal of all internal IPs, cluster names, namespace names, and trace IDs before any response crosses the operator boundary.

- **Same fulfillment pipeline:** FM publishes the same `command.srm.*` commands as OEG, with `source=federation` and `federation_partner_ref` set. SRM treats them identically.

- **Settlement events:** After every successful EWBI transaction, FM emits settlement CDRs via the DataBus for inter-operator financial clearing.
@@ -778,7 +778,7 @@ These decisions are **binding** — they have been made and should not be reopen 
| Boundary | Mechanism | Owner |

|----------|-----------|-------|

| App Provider → Nginx → OEG | OAuth 2.0 Bearer JWT (Keycloak realm `oop`) | OEG via oop-commons |

| Partner OP → Nginx → FM | mTLS (mutual TLS with pre-exchanged certificates) | FM |

| Partner OP → Nginx → FM | OAuth 2.0 Client-Credentials + signed JWT (Keycloak realm `federation`, `fed-mgmt` scope) — ADR-0038. mTLS deferred defense-in-depth. | FM |

| OEG → SRM | Internal service call (cluster network trust Phase 1; service JWT Phase 2) | Platform deployment |

| SRM → TF-SDK | In-process library call (no auth boundary) | N/A |

| TF-SDK → NEF | 3GPP OAuth2 or mTLS | TF-SDK adapter config |
@@ -791,7 +791,7 @@ These decisions are **binding** — they have been made and should not be reopen 
|------|--------|-----------|

| `app-provider` | Call CAMARA/TMF APIs, register apps, view own operations | Access admin routes, modify catalog |

| `operator` | Manage catalog, zones, domains, view all operations | N/A |

| `federation-partner` | Submit federated requests via EWBI (mTLS via FM; JWT role where issued) | Access NBI directly |

| `federation-partner` | Submit federated requests via EWBI (OAuth2 Client-Credentials JWT, `fed-mgmt` scope, via FM — ADR-0038; mTLS layered in later as defense-in-depth) | Access NBI directly |



### Data Protection Rules

platform/future-architecture.md

+1 −1
Changes for platform/future-architecture.md: 1 added line, 1 removed line.
Original line number Diff line number Diff line
@@ -94,7 +94,7 @@ When BSS needs network quality data for SLA management, it queries the platform' 
|----------|------|---------------|-------|

| **Developer** | JWT `app-provider` | CAMARA Service APIs | Exists today |

| **Aggregator** | JWT `app-provider` | CAMARA Service + TMF Operate APIs | Exists today |

| **Federation Partner** | mTLS `federation-partner` | EWBI APIs via FM | Phase 3 |

| **Federation Partner** | OAuth2 JWT (Keycloak `federation` realm) `federation-partner` | EWBI APIs via FM | Phase 3; mTLS deferred defense-in-depth (ADR-0038) |

| **Operator (Portal)** | OIDC `operator` | Admin APIs, TMF Open APIs | Exists today |

| **BSS/OSS** | JWT `operator` | TMF Open APIs + CAMARA Service APIs | Future (Phase 6) |

| **Channel Partner** | JWT `channel-partner` | TMF Operate APIs (catalog, onboarding, ordering) | Future (Phase 5) |