* docs: spec for unifying response signing with auth key
Design для замены отдельной SignatureConfig на подпись ответов
RSA-ключом, взятым из auth.server.provider-private-key.
Made-with: Cursor
* docs: implementation plan for auth-based response signing
План реализации по спеке 2026-04-20-response-signing-with-auth-key-design.md.
Разбит на 9 задач: новые RsaSigner/DisabledSigner по TDD, переработка фабрики
под AuthorizationConfig, удаление SignatureConfig/signed-response, снятие
cache-гейта в EthereumLocalReader, обновление документации.
Made-with: Cursor
* feat(signature): add RsaSigner using SHA256withRSA
Made-with: Cursor
* feat(signature): add DisabledSigner that throws on sign()
Made-with: Cursor
* refactor(signature): ResponseSigner.sign returns non-null Signature
Made-with: Cursor
* refactor(signature): build signer from AuthorizationConfig
Made-with: Cursor
* refactor(config): remove signed-response YAML section and SignatureConfig
Made-with: Cursor
* refactor(signature): remove EcdsaSigner and NoSigner
Remove the obsolete ECDSA signer and the transitional NoSigner stub.
Replace NoSigner usages in tests with DisabledSigner, and pass
DisabledSigner to BroadcastReader in tests (signer is now non-null).
Made-with: Cursor
* refactor(local-reader): serve cached results for requests with nonce
Made-with: Cursor
* docs: replace signed-response with auth section incl. response signing
Made-with: Cursor
* docs: correct auth section YAML and expand Response Signing note
- docs/reference-configuration.adoc: fix the YAML shape of the auth
section (server.keys.{provider-private-key,external-public-key} and
publicKeyOwner) to match AuthorizationConfigReader, and expand the
Response Signing subsection with the actual signed-message format.
- .gitignore: ignore /demo/response-signing/ (local sandbox with keys
and generated gRPC stubs — regenerate with generate-keys.sh + protoc)
and /docs/superpowers/ (specs/plans kept local-only for now). Any
previously tracked files under these paths are untracked here.
Made-with: Cursor
* feat(upstream): auto-inject secure-signed label when signing is enabled
Expose ResponseSigner.enabled and thread the bean through UpstreamCreator
so Generic/Ethereum/Bitcoin creators can enrich each upstream's labels
with secure-signed=true whenever auth-backed response signing is active.
A user-provided value for the label is preserved.
Made-with: Cursor
