coulomb/key-cape
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Correct platform infrastructure client tenant bindings

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e324-abce-7e51-bb2b-496f097afdb0
This commit is contained in:
tegwick 2026-09-27 16:43:31 +02:00
parent 3b0446e0ef
commit 717a97408a
7 changed files with 47 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/cmd/keycape/clients_test.go
View file

@ -57,8 +57,8 @@ func TestServiceRegistrationTenantsAreExactPerDecision(t *testing.T) {
want := map[string]string{
"secrets-engine-approval": "tenant:platform",
"approval-engine-operator": "tenant:platform",
"codex-railiance-platform": "tenant:coulomb",
"secrets-engine-openbao": "tenant:coulomb",
"codex-railiance-platform": "tenant:platform",
"secrets-engine-openbao": "tenant:platform",
// The only browser client here, and the only registration-supplied
// human tenant. Reviewed and added deliberately: this guard exists so a
// new client carrying a tenant cannot arrive unnoticed, and it did its

2
src/internal/config/config_test.go
View file

@ -393,7 +393,7 @@ func TestServiceClientExampleContracts(t *testing.T) {
codingAgent := cfg.Clients[0]
if codingAgent.ClientID != "codex-railiance-platform" ||
codingAgent.ServiceSubject != "service:codex:railiance-platform" ||
codingAgent.Tenant != "tenant:coulomb" ||
codingAgent.Tenant != "tenant:platform" ||
codingAgent.TokenLifetime != "15m" {
t.Fatalf("coding-agent contract drifted: %+v", codingAgent)
}

14
src/internal/server/oidc/tenant_test.go
View file

@ -118,7 +118,7 @@ func TestApprovalClientIssuesExactPlatformTenantAndRejectsAliases(t *testing.T)
GrantTypes: []string{"client_credentials"},
ClientType: "confidential",
ClientSecret: "approval-test-secret",
ServiceSubject: "service:secrets-engine",
ServiceSubject: "service:coulomb-workload-test",
Tenant: "tenant:platform",
Roles: []string{"secrets-engine"},
}
@ -147,22 +147,22 @@ func TestApprovalClientIssuesExactPlatformTenantAndRejectsAliases(t *testing.T)
}
}
// The aligned decision grants no cross-tenant reach: the unrelated OpenBao
// login client keeps tenant:coulomb.
// Platform ownership does not elevate workload clients. Request parameters
// cannot change a workload registration's tenant.
func TestUnrelatedServiceClientKeepsCoulombTenant(t *testing.T) {
h := serviceTokenHandler(t)
h.ClientConfig["secrets-engine-openbao"] = &domain.Client{
ClientID: "secrets-engine-openbao",
h.ClientConfig["coulomb-workload-test"] = &domain.Client{
ClientID: "coulomb-workload-test",
AllowedScopes: []string{"openbao:login"},
GrantTypes: []string{"client_credentials"},
ClientType: "confidential",
ClientSecret: "openbao-test-secret",
ServiceSubject: "service:secrets-engine",
ServiceSubject: "service:coulomb-workload-test",
Tenant: "tenant:coulomb",
Roles: []string{"secrets-engine"},
}
req := tokenRequest(url.Values{"grant_type": {"client_credentials"}, "scope": {"openbao:login"}, "tenant": {"tenant:platform"}})
req.SetBasicAuth("secrets-engine-openbao", "openbao-test-secret")
req.SetBasicAuth("coulomb-workload-test", "openbao-test-secret")
w := httptest.NewRecorder()
h.ServeHTTP(w, req)
if w.Code != http.StatusOK {