Add bounded resource audiences and enforce browser scope grants

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06e87-e039-7ed2-b85c-20ad37f8a21b

src/cmd/keycape/clients_test.go

@@ -0,0 +1,38 @@
+package main
+
+import (
+	"keycape/internal/config"
+	"testing"
+	"time"
+)
+
+func TestServiceRegistrationAudienceAndScopeIsolation(t *testing.T) {
+	cfg, err := config.Load("../../../config/service-clients.example.yaml")
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, c := range cfg.Clients {
+		t.Setenv(c.SecretRef[4:], "test-only-secret")
+	}
+	registry, err := buildClientRegistry(cfg.Clients)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, id := range []string{"secrets-engine-approval", "approval-engine-operator"} {
+		c := registry[id]
+		if c == nil || c.Audience != "approval-engine" || c.TokenLifetime != 15*time.Minute {
+			t.Fatalf("invalid registration for %s", id)
+		}
+		for _, scope := range c.AllowedScopes {
+			if id == "approval-engine-operator" && scope == "approval:consume" {
+				t.Fatal("operator may not consume")
+			}
+			if id == "secrets-engine-approval" && scope != "approval:read" && scope != "approval:consume" {
+				t.Fatal("excess PEP scope")
+			}
+		}
+	}
+	if registry["secrets-engine-openbao"].Audience != "" {
+		t.Fatal("OpenBao audience default changed")
+	}
+}

src/cmd/keycape/main.go

@@ -290,6 +290,7 @@ func buildClientRegistry(cfgClients []config.ClientConfig) (map[string]*domain.C
 			ClientType:      c.ClientType,
 			SecretRef:       c.SecretRef,
 			ClientSecret:    clientSecret,
+			Audience:        c.Audience,
 			ServiceSubject:  c.ServiceSubject,
 			Tenant:          c.Tenant,
 			Roles:           c.Roles,