tegwick
dd3ce4c109
secrets-engine confirmed T03, and re-verifying against the regenerated destroy fixture found something neither repository can fix alone: a pdp_digest recorded at issue time can never equal the request_digest of a request that carries the claim in its context, because the claim is part of the context that is hashed. Embedding the claim changes the very digest the claim would need to name. Not fixture staleness. It holds for every dual-control request whose claim travels in context -- the shape GH-DEC-2026-008 had just ruled mandatory. Left unresolved that ruling was unimplementable for exactly the case it was written for, and destroy would have been permanently un-allowable in production, failing closed forever on a check that could never pass. flex-auth owns the canonical request digest, so the fix is ours. binding.approval_binding_digest is the same material with context.approval removed, emitted only when a claim was carried. An approval issued against a claim-free Check records that Check's request_digest; the claim-bearing request reproduces it here. DELIBERATELY ADDITIVE, and the reason matters. The tempting fix is to drop context.approval from request_digest entirely. That is wrong: request_digest is the replay identity, and two requests differing only in which approval was presented must not share one, because their decisions differ -- one allows, the other denies dual_control_required. Collapsing them would let an allow obtained with a valid claim be replayed against a request carrying none. So request_digest still covers the claim and still moves; approval_binding_digest deliberately does not, and is documented as not a replay identity. The tests assert the two functions DISAGREE on a claim-bearing request, which is approval-engine's formulation of how to defend a distinction that looks like duplication. The fixture now demonstrates the property rather than asserting it: its claim's pdp_digest equals the envelope's approval_binding_digest with pdp_path true, and changing the claim's contents moved request_digest while leaving approval_binding_digest untouched. Two files a consumer can diff. Also picked up approval-engine's new required binding.pdp_path via the cross-repo schema test added yesterday -- which is the test doing exactly what it was built for, one day later. T03 is done. secrets-engine's own digest-material defect, which our two real envelopes caught, is recorded in the workplan. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JTbVXpEiXA7mNJVpDnEPcB Assistant: claude-code Assistant-Model: opus Assistant-Process: 412054@bnt-lap001 Assistant-Session: 3968fae1-8d59-4209-9bd6-c22594b8ab19
1061 lines
28 KiB
YAML
1061 lines
28 KiB
YAML
[
|
|
{
|
|
"id": "fixture:secrets-engine-apply-allow",
|
|
"request": {
|
|
"id": "check:secrets-engine-apply",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "apply",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "allow",
|
|
"reason": "catalog_lane_policy_matched"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-provision-allow",
|
|
"request": {
|
|
"id": "check:secrets-engine-provision",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "provision",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [
|
|
"password"
|
|
],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "allow",
|
|
"reason": "catalog_lane_policy_matched"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-rotate-allow",
|
|
"request": {
|
|
"id": "check:secrets-engine-rotate",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "rotate",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [
|
|
"password"
|
|
],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "allow",
|
|
"reason": "catalog_lane_policy_matched"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-verify-allow",
|
|
"request": {
|
|
"id": "check:secrets-engine-verify",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "verify",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [
|
|
"password"
|
|
],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "allow",
|
|
"reason": "catalog_lane_policy_matched"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-handoff-allow",
|
|
"request": {
|
|
"id": "check:secrets-engine-handoff",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "handoff",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "allow",
|
|
"reason": "catalog_lane_policy_matched"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-wrap-allow",
|
|
"request": {
|
|
"id": "check:secrets-engine-wrap",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "wrap",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "allow",
|
|
"reason": "catalog_lane_policy_matched"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-exec-allow",
|
|
"request": {
|
|
"id": "check:secrets-engine-exec",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "exec",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [
|
|
"password"
|
|
],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "allow",
|
|
"reason": "catalog_lane_policy_matched"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-deactivate-allow",
|
|
"request": {
|
|
"id": "check:secrets-engine-deactivate",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "deactivate",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "allow",
|
|
"reason": "catalog_lane_policy_matched"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-suspend-allow",
|
|
"request": {
|
|
"id": "check:secrets-engine-suspend",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "suspend",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "allow",
|
|
"reason": "catalog_lane_policy_matched"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-compromise-allow",
|
|
"request": {
|
|
"id": "check:secrets-engine-compromise",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "compromise",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "allow",
|
|
"reason": "catalog_lane_policy_matched"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-reactivate-allow",
|
|
"request": {
|
|
"id": "check:secrets-engine-reactivate",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "reactivate",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "allow",
|
|
"reason": "catalog_lane_policy_matched"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-destroy-dual-control-allow",
|
|
"request": {
|
|
"id": "check:secrets-engine-destroy",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "destroy",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {
|
|
"approval": {
|
|
"schema_version": "0.1",
|
|
"kind": "approval-claim",
|
|
"issuer": "approval-engine",
|
|
"approval_id": "3d1c0a8e-6b7f-4c21-9a0e-1f2b3c4d5e6f",
|
|
"state": "valid",
|
|
"valid_now": true,
|
|
"consumed": false,
|
|
"binding": {
|
|
"action": "secrets.kv.destroy",
|
|
"target": {
|
|
"id": "lane-openbao-root",
|
|
"stage": "prod"
|
|
},
|
|
"actor": "agt-secrets-engine",
|
|
"principal": "bernd",
|
|
"purpose": "rotate-exposed-key",
|
|
"digest": "sha256:3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f",
|
|
"pdp_digest": "sha256:fa07becfaa471394d06aee5fa3cd66352bf0cc69ef24900240489684cda8cd56",
|
|
"pdp_path": true
|
|
},
|
|
"freshness": {
|
|
"observed_at": "2026-09-06T12:00:00+00:00",
|
|
"ttl_seconds": 30,
|
|
"not_after": "2026-09-06T12:00:30+00:00"
|
|
},
|
|
"validity": {
|
|
"not_before": "2026-09-06T11:00:00+00:00",
|
|
"expires_at": "2026-09-06T15:00:00+00:00"
|
|
},
|
|
"reason_code": "ok"
|
|
}
|
|
}
|
|
},
|
|
"expect": {
|
|
"effect": "allow",
|
|
"reason": "catalog_lane_policy_matched"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-destroy-no-claim-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-destroy",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "destroy",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "dual_control_required"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-destroy-insufficient-approvers-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-destroy",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "destroy",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {
|
|
"approval": {
|
|
"schema_version": "0.1",
|
|
"kind": "approval-claim",
|
|
"issuer": "approval-engine",
|
|
"approval_id": "3d1c0a8e-6b7f-4c21-9a0e-1f2b3c4d5e6f",
|
|
"state": "requested",
|
|
"valid_now": false,
|
|
"consumed": false,
|
|
"binding": {
|
|
"action": "secrets.kv.destroy",
|
|
"target": {
|
|
"id": "lane-openbao-root",
|
|
"stage": "prod"
|
|
},
|
|
"actor": "agt-secrets-engine",
|
|
"principal": "bernd",
|
|
"purpose": "rotate-exposed-key",
|
|
"digest": "sha256:3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f",
|
|
"pdp_digest": "sha256:fa07becfaa471394d06aee5fa3cd66352bf0cc69ef24900240489684cda8cd56",
|
|
"pdp_path": true
|
|
},
|
|
"freshness": {
|
|
"observed_at": "2026-09-06T12:00:00+00:00",
|
|
"ttl_seconds": 30,
|
|
"not_after": "2026-09-06T12:00:30+00:00"
|
|
},
|
|
"validity": {
|
|
"not_before": "2026-09-06T11:00:00+00:00",
|
|
"expires_at": "2026-09-06T15:00:00+00:00"
|
|
},
|
|
"reason_code": "insufficient_approvers"
|
|
}
|
|
}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "dual_control_required"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-destroy-consumed-claim-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-destroy",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "destroy",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {
|
|
"approval": {
|
|
"schema_version": "0.1",
|
|
"kind": "approval-claim",
|
|
"issuer": "approval-engine",
|
|
"approval_id": "3d1c0a8e-6b7f-4c21-9a0e-1f2b3c4d5e6f",
|
|
"state": "consumed",
|
|
"valid_now": false,
|
|
"consumed": true,
|
|
"binding": {
|
|
"action": "secrets.kv.destroy",
|
|
"target": {
|
|
"id": "lane-openbao-root",
|
|
"stage": "prod"
|
|
},
|
|
"actor": "agt-secrets-engine",
|
|
"principal": "bernd",
|
|
"purpose": "rotate-exposed-key",
|
|
"digest": "sha256:3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f",
|
|
"pdp_digest": "sha256:fa07becfaa471394d06aee5fa3cd66352bf0cc69ef24900240489684cda8cd56",
|
|
"pdp_path": true
|
|
},
|
|
"freshness": {
|
|
"observed_at": "2026-09-06T12:00:00+00:00",
|
|
"ttl_seconds": 30,
|
|
"not_after": "2026-09-06T12:00:30+00:00"
|
|
},
|
|
"validity": {
|
|
"not_before": "2026-09-06T11:00:00+00:00",
|
|
"expires_at": "2026-09-06T15:00:00+00:00"
|
|
},
|
|
"reason_code": "consumed"
|
|
}
|
|
}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "dual_control_required"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-destroy-revoked-claim-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-destroy",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "destroy",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {
|
|
"approval": {
|
|
"schema_version": "0.1",
|
|
"kind": "approval-claim",
|
|
"issuer": "approval-engine",
|
|
"approval_id": "3d1c0a8e-6b7f-4c21-9a0e-1f2b3c4d5e6f",
|
|
"state": "revoked",
|
|
"valid_now": false,
|
|
"consumed": false,
|
|
"binding": {
|
|
"action": "secrets.kv.destroy",
|
|
"target": {
|
|
"id": "lane-openbao-root",
|
|
"stage": "prod"
|
|
},
|
|
"actor": "agt-secrets-engine",
|
|
"principal": "bernd",
|
|
"purpose": "rotate-exposed-key",
|
|
"digest": "sha256:3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f",
|
|
"pdp_digest": "sha256:fa07becfaa471394d06aee5fa3cd66352bf0cc69ef24900240489684cda8cd56",
|
|
"pdp_path": true
|
|
},
|
|
"freshness": {
|
|
"observed_at": "2026-09-06T12:00:00+00:00",
|
|
"ttl_seconds": 30,
|
|
"not_after": "2026-09-06T12:00:30+00:00"
|
|
},
|
|
"validity": {
|
|
"not_before": "2026-09-06T11:00:00+00:00",
|
|
"expires_at": "2026-09-06T15:00:00+00:00"
|
|
},
|
|
"reason_code": "revoked"
|
|
}
|
|
}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "dual_control_required"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-destroy-approved-not-valid-now-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-destroy",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "destroy",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {
|
|
"approval": {
|
|
"schema_version": "0.1",
|
|
"kind": "approval-claim",
|
|
"issuer": "approval-engine",
|
|
"approval_id": "3d1c0a8e-6b7f-4c21-9a0e-1f2b3c4d5e6f",
|
|
"state": "approved",
|
|
"valid_now": false,
|
|
"consumed": false,
|
|
"binding": {
|
|
"action": "secrets.kv.destroy",
|
|
"target": {
|
|
"id": "lane-openbao-root",
|
|
"stage": "prod"
|
|
},
|
|
"actor": "agt-secrets-engine",
|
|
"principal": "bernd",
|
|
"purpose": "rotate-exposed-key",
|
|
"digest": "sha256:3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f",
|
|
"pdp_digest": "sha256:fa07becfaa471394d06aee5fa3cd66352bf0cc69ef24900240489684cda8cd56",
|
|
"pdp_path": true
|
|
},
|
|
"freshness": {
|
|
"observed_at": "2026-09-06T12:00:00+00:00",
|
|
"ttl_seconds": 30,
|
|
"not_after": "2026-09-06T12:00:30+00:00"
|
|
},
|
|
"validity": {
|
|
"not_before": "2026-09-06T11:00:00+00:00",
|
|
"expires_at": "2026-09-06T15:00:00+00:00"
|
|
},
|
|
"reason_code": "not_yet_valid"
|
|
}
|
|
}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "dual_control_required"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-destroy-foreign-issuer-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-destroy",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "destroy",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {
|
|
"approval": {
|
|
"schema_version": "0.1",
|
|
"kind": "approval-claim",
|
|
"issuer": "some-other-engine",
|
|
"approval_id": "3d1c0a8e-6b7f-4c21-9a0e-1f2b3c4d5e6f",
|
|
"state": "valid",
|
|
"valid_now": true,
|
|
"consumed": false,
|
|
"binding": {
|
|
"action": "secrets.kv.destroy",
|
|
"target": {
|
|
"id": "lane-openbao-root",
|
|
"stage": "prod"
|
|
},
|
|
"actor": "agt-secrets-engine",
|
|
"principal": "bernd",
|
|
"purpose": "rotate-exposed-key",
|
|
"digest": "sha256:3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f",
|
|
"pdp_digest": "sha256:fa07becfaa471394d06aee5fa3cd66352bf0cc69ef24900240489684cda8cd56",
|
|
"pdp_path": true
|
|
},
|
|
"freshness": {
|
|
"observed_at": "2026-09-06T12:00:00+00:00",
|
|
"ttl_seconds": 30,
|
|
"not_after": "2026-09-06T12:00:30+00:00"
|
|
},
|
|
"validity": {
|
|
"not_before": "2026-09-06T11:00:00+00:00",
|
|
"expires_at": "2026-09-06T15:00:00+00:00"
|
|
},
|
|
"reason_code": "ok"
|
|
}
|
|
}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "dual_control_required"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-destroy-wrong-kind-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-destroy",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "destroy",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {
|
|
"approval": {
|
|
"schema_version": "0.1",
|
|
"kind": "action-authorization",
|
|
"issuer": "approval-engine",
|
|
"approval_id": "3d1c0a8e-6b7f-4c21-9a0e-1f2b3c4d5e6f",
|
|
"state": "valid",
|
|
"valid_now": true,
|
|
"consumed": false,
|
|
"binding": {
|
|
"action": "secrets.kv.destroy",
|
|
"target": {
|
|
"id": "lane-openbao-root",
|
|
"stage": "prod"
|
|
},
|
|
"actor": "agt-secrets-engine",
|
|
"principal": "bernd",
|
|
"purpose": "rotate-exposed-key",
|
|
"digest": "sha256:3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f",
|
|
"pdp_digest": "sha256:fa07becfaa471394d06aee5fa3cd66352bf0cc69ef24900240489684cda8cd56",
|
|
"pdp_path": true
|
|
},
|
|
"freshness": {
|
|
"observed_at": "2026-09-06T12:00:00+00:00",
|
|
"ttl_seconds": 30,
|
|
"not_after": "2026-09-06T12:00:30+00:00"
|
|
},
|
|
"validity": {
|
|
"not_before": "2026-09-06T11:00:00+00:00",
|
|
"expires_at": "2026-09-06T15:00:00+00:00"
|
|
},
|
|
"reason_code": "ok"
|
|
}
|
|
}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "dual_control_required"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-revoke-not-an-action-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-revoke",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "revoke",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "unknown_action"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-ungated-plan-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-plan",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "plan",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "unknown_action"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-ungated-route-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-route",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "route",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "unknown_action"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-ungated-audit-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-audit",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "audit",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "unknown_action"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-ungated-catalog-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-catalog",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "catalog",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "unknown_action"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-ungated-evidence-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-evidence",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "evidence",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "unknown_action"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-unknown-subject-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-rotate",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "some-other-service",
|
|
"type": "service"
|
|
},
|
|
"action": "rotate",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [
|
|
"password"
|
|
],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "unknown_subject"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-wrong-subject-type-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-rotate",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "human"
|
|
},
|
|
"action": "rotate",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [
|
|
"password"
|
|
],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "wrong_subject_type"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-wrong-system-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-rotate",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "rotate",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "some-other-system",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [
|
|
"password"
|
|
],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "wrong_system"
|
|
}
|
|
},
|
|
{
|
|
"id": "fixture:secrets-engine-wrong-resource-type-deny",
|
|
"request": {
|
|
"id": "check:secrets-engine-rotate",
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service"
|
|
},
|
|
"action": "rotate",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret",
|
|
"system": "secrets-engine",
|
|
"attributes": {
|
|
"stage": "prod",
|
|
"fields": [
|
|
"password"
|
|
],
|
|
"policy_targets": [],
|
|
"auth_targets": []
|
|
}
|
|
},
|
|
"context": {}
|
|
},
|
|
"expect": {
|
|
"effect": "deny",
|
|
"reason": "wrong_resource_type"
|
|
}
|
|
}
|
|
]
|