From 303a584bd0d46b8efe34458e51f84380e7fee46e Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 9 Sep 2026 02:18:12 +0200 Subject: [PATCH] feat: accept KeyCape approval clients with tested recovery Assistant: codex Assistant-Model: gpt-5.6-luna Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc --- ...026-09-09-keycape-activation-attempts.json | 316 ++++++++++++++++++ ...09-09-keycape-approval-image-exercise.json | 16 +- ...2026-09-09-keycape-verifier-admission.json | 220 ++++++++++++ docs/keycape-approval-clients-rollout.md | 78 +++++ .../k8s/keycape/approval-clients-rollout.py | 60 +++- sso-mfa/k8s/keycape/deployment.yaml | 23 +- .../k8s/keycape/exercise-approval-clients.py | 92 +++++ .../keycape/test_approval_clients_rollout.py | 25 +- 8 files changed, 810 insertions(+), 20 deletions(-) create mode 100644 docs/evidence/2026-09-09-keycape-activation-attempts.json create mode 100644 docs/evidence/2026-09-09-keycape-verifier-admission.json create mode 100644 docs/keycape-approval-clients-rollout.md create mode 100644 sso-mfa/k8s/keycape/exercise-approval-clients.py diff --git a/docs/evidence/2026-09-09-keycape-activation-attempts.json b/docs/evidence/2026-09-09-keycape-activation-attempts.json new file mode 100644 index 0000000..ba9622f --- /dev/null +++ b/docs/evidence/2026-09-09-keycape-activation-attempts.json @@ -0,0 +1,316 @@ +{ + "attempts": [ + { + "schema": "platform.keycape-approval-custody.v1", + "status": "failed", + "lanes": [], + "started_at": "2026-09-08T23:34:28.315053+00:00", + "credential_values_emitted": false, + "client_side_read_admitted": false, + "keycape_rollout_completed": false, + "error": "command_failed", + "finished_at": "2026-09-08T23:34:28.559853+00:00" + }, + { + "schema": "platform.keycape-approval-custody.v1", + "status": "failed", + "lanes": [ + { + "ccr": "CCR-2026-0017", + "source_sha256": "dc2bbd86e213edecc2f2f91a99d0f51136e9a0853a90e55f65dda2b942305416", + "policy_applied": true, + "role_applied": true, + "custody_seeded": true, + "kv_version": 1, + "request_id": "94c98373-33fa-591d-c201-d36dddf9879b", + "native_reader_verified": true, + "cross_path_denied": true, + "parent_listing_denied": true, + "auth_ttl": 900, + "reader_revocation_verified": true, + "wrong_service_account_denied": true, + "coding_agent_deny_wins": true, + "store_ready": true, + "external_secret_ready": true, + "delivery_matches": true, + "secret_uid": "34502b48-ed5d-4a1d-bc43-aa282392775e", + "secret_resource_version": "58736028", + "wrong_namespace_denied": true, + "outside_namespace_store_denied": true + }, + { + "ccr": "CCR-2026-0018", + "source_sha256": "99148133ddf1eb15dce3c03862b51dc001818ca3121045035a0b0e5897c55dad", + "policy_applied": true, + "role_applied": true, + "custody_seeded": true, + "kv_version": 1, + "request_id": "a62ee5c5-b5ba-b7dc-0f51-e6fd8a6dde32", + "native_reader_verified": true, + "cross_path_denied": true, + "parent_listing_denied": true, + "auth_ttl": 900, + "reader_revocation_verified": true, + "wrong_service_account_denied": true, + "coding_agent_deny_wins": true, + "store_ready": true, + "external_secret_ready": true, + "delivery_matches": true, + "secret_uid": "e6f42c4b-dbca-480d-96a4-c475f1298e7f", + "secret_resource_version": "58736036", + "wrong_namespace_denied": true, + "outside_namespace_store_denied": true + } + ], + "started_at": "2026-09-08T23:36:01.727953+00:00", + "credential_values_emitted": false, + "client_side_read_admitted": false, + "keycape_rollout_completed": false, + "issuer_pin_revision": "58713343", + "phase": "keycape_rollout", + "coding_agent_boundary_extended_only_to_new_paths": true, + "initial_values_generation": "independent CSPRNG 48-byte values; memory-to-OpenBao stdin only; CAS=0", + "namespace_probe_cleanup_requested": true, + "keycape": { + "existing_human_login_before": true, + "protected_recovery_retained": true, + "compatible_pair_restored": true + }, + "verifier_delivery_disabled_custody_versions_retained": true, + "error": "keycape_readiness_timeout", + "finished_at": "2026-09-08T23:39:24.210112+00:00" + }, + { + "schema": "platform.keycape-approval-custody.v1", + "status": "failed", + "lanes": [ + { + "ccr": "CCR-2026-0017", + "source_sha256": "dc2bbd86e213edecc2f2f91a99d0f51136e9a0853a90e55f65dda2b942305416", + "custody_seeded": false, + "existing_version_reused": true, + "kv_version": 1, + "initial_request_id": "94c98373-33fa-591d-c201-d36dddf9879b", + "policy_applied": false, + "role_applied": true, + "native_reader_verified": true, + "cross_path_denied": true, + "parent_listing_denied": true, + "auth_ttl": 900, + "reader_revocation_verified": true, + "wrong_service_account_denied": true, + "coding_agent_deny_wins": true, + "store_ready": true, + "external_secret_ready": true, + "delivery_matches": true, + "secret_uid": "b85ce6bb-45c4-49ab-81c9-e92f001500b2", + "secret_resource_version": "58741915", + "wrong_namespace_denied": true, + "outside_namespace_store_denied": true + }, + { + "ccr": "CCR-2026-0018", + "source_sha256": "99148133ddf1eb15dce3c03862b51dc001818ca3121045035a0b0e5897c55dad", + "custody_seeded": false, + "existing_version_reused": true, + "kv_version": 1, + "initial_request_id": "a62ee5c5-b5ba-b7dc-0f51-e6fd8a6dde32", + "policy_applied": false, + "role_applied": true, + "native_reader_verified": true, + "cross_path_denied": true, + "parent_listing_denied": true, + "auth_ttl": 900, + "reader_revocation_verified": true, + "wrong_service_account_denied": true, + "coding_agent_deny_wins": true, + "store_ready": true, + "external_secret_ready": true, + "delivery_matches": true, + "secret_uid": "faad6d54-a6b1-4a3d-9102-4e35aeea67a5", + "secret_resource_version": "58741919", + "wrong_namespace_denied": true, + "outside_namespace_store_denied": true + } + ], + "started_at": "2026-09-08T23:54:16.437123+00:00", + "credential_values_emitted": false, + "client_side_read_admitted": false, + "keycape_rollout_completed": false, + "issuer_pin_revision": "58737048", + "phase": "keycape_rollout", + "custody_versions_unchanged": true, + "namespace_probe_cleanup_requested": true, + "keycape": { + "existing_human_login_before": true, + "protected_recovery_retained": true, + "deployment_uid": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f", + "generation": 32, + "pod_uid": "28a62a5a-1ac6-4d6c-a1e1-4a414a621559", + "single_ready_replica": true, + "clients": [], + "compatible_pair_restored": true + }, + "verifier_delivery_disabled_custody_versions_retained": true, + "error": "contained_operation_failed", + "finished_at": "2026-09-08T23:55:02.310001+00:00" + }, + { + "schema": "platform.keycape-approval-custody.v1", + "status": "failed", + "lanes": [ + { + "ccr": "CCR-2026-0017", + "source_sha256": "dc2bbd86e213edecc2f2f91a99d0f51136e9a0853a90e55f65dda2b942305416", + "custody_seeded": false, + "existing_version_reused": true, + "kv_version": 1, + "initial_request_id": "94c98373-33fa-591d-c201-d36dddf9879b", + "policy_applied": false, + "role_applied": true, + "native_reader_verified": true, + "cross_path_denied": true, + "parent_listing_denied": true, + "auth_ttl": 900, + "reader_revocation_verified": true, + "wrong_service_account_denied": true, + "coding_agent_deny_wins": true, + "store_ready": true, + "external_secret_ready": true, + "delivery_matches": true, + "secret_uid": "827b4e04-6727-4dd4-9cdb-2554ecc84441", + "secret_resource_version": "58743272", + "wrong_namespace_denied": true, + "outside_namespace_store_denied": true + }, + { + "ccr": "CCR-2026-0018", + "source_sha256": "99148133ddf1eb15dce3c03862b51dc001818ca3121045035a0b0e5897c55dad", + "custody_seeded": false, + "existing_version_reused": true, + "kv_version": 1, + "initial_request_id": "a62ee5c5-b5ba-b7dc-0f51-e6fd8a6dde32", + "policy_applied": false, + "role_applied": true, + "native_reader_verified": true, + "cross_path_denied": true, + "parent_listing_denied": true, + "auth_ttl": 900, + "reader_revocation_verified": true, + "wrong_service_account_denied": true, + "coding_agent_deny_wins": true, + "store_ready": true, + "external_secret_ready": true, + "delivery_matches": true, + "secret_uid": "ca949cda-6a4f-4c24-9a06-6a9c7e00e4aa", + "secret_resource_version": "58743276", + "wrong_namespace_denied": true, + "outside_namespace_store_denied": true + } + ], + "started_at": "2026-09-08T23:58:13.955525+00:00", + "credential_values_emitted": false, + "client_side_read_admitted": false, + "keycape_rollout_completed": false, + "issuer_pin_revision": "58742089", + "phase": "keycape_rollout", + "custody_versions_unchanged": true, + "namespace_probe_cleanup_requested": true, + "keycape": { + "existing_human_login_before": true, + "protected_recovery_retained": true, + "deployment_uid": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f", + "generation": 34, + "pod_uid": "dabd15a0-f9c3-47f2-82ee-e53590754558", + "single_ready_replica": true, + "acceptance_phase": "in_pod_verifier", + "clients": [], + "acceptance_client": "secrets-engine-approval", + "failure_class": "LaneError", + "compatible_pair_restored": true + }, + "verifier_delivery_disabled_custody_versions_retained": true, + "error": "command_failed", + "finished_at": "2026-09-08T23:59:06.395926+00:00" + }, + { + "schema": "platform.keycape-approval-custody.v1", + "status": "failed", + "lanes": [ + { + "ccr": "CCR-2026-0017", + "source_sha256": "dc2bbd86e213edecc2f2f91a99d0f51136e9a0853a90e55f65dda2b942305416", + "custody_seeded": false, + "existing_version_reused": true, + "kv_version": 1, + "initial_request_id": "94c98373-33fa-591d-c201-d36dddf9879b", + "policy_applied": false, + "role_applied": true, + "native_reader_verified": true, + "cross_path_denied": true, + "parent_listing_denied": true, + "auth_ttl": 900, + "reader_revocation_verified": true, + "wrong_service_account_denied": true, + "coding_agent_deny_wins": true, + "store_ready": true, + "external_secret_ready": true, + "delivery_matches": true, + "secret_uid": "1e0c888a-c35b-4fe2-8fc5-c510256c19df", + "secret_resource_version": "58745995", + "wrong_namespace_denied": true, + "outside_namespace_store_denied": true + }, + { + "ccr": "CCR-2026-0018", + "source_sha256": "99148133ddf1eb15dce3c03862b51dc001818ca3121045035a0b0e5897c55dad", + "custody_seeded": false, + "existing_version_reused": true, + "kv_version": 1, + "initial_request_id": "a62ee5c5-b5ba-b7dc-0f51-e6fd8a6dde32", + "policy_applied": false, + "role_applied": true, + "native_reader_verified": true, + "cross_path_denied": true, + "parent_listing_denied": true, + "auth_ttl": 900, + "reader_revocation_verified": true, + "wrong_service_account_denied": true, + "coding_agent_deny_wins": true, + "store_ready": true, + "external_secret_ready": true, + "delivery_matches": true, + "secret_uid": "50b18e82-6187-47d1-9b07-199f9b999f47", + "secret_resource_version": "58745999", + "wrong_namespace_denied": true, + "outside_namespace_store_denied": true + } + ], + "started_at": "2026-09-09T00:06:30.650774+00:00", + "credential_values_emitted": false, + "client_side_read_admitted": false, + "keycape_rollout_completed": false, + "issuer_pin_revision": "58743475", + "phase": "keycape_rollout", + "custody_versions_unchanged": true, + "namespace_probe_cleanup_requested": true, + "keycape": { + "existing_human_login_before": true, + "protected_recovery_retained": true, + "deployment_uid": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f", + "generation": 36, + "pod_uid": "011de4b4-c2cd-429d-ba04-e7c72b2f1f9e", + "single_ready_replica": true, + "acceptance_phase": "signature_and_claims", + "clients": [], + "acceptance_client": "secrets-engine-approval", + "failure_class": "ImmatureSignatureError", + "compatible_pair_restored": true + }, + "verifier_delivery_disabled_custody_versions_retained": true, + "error": "contained_operation_failed", + "finished_at": "2026-09-09T00:07:25.670140+00:00" + } + ], + "all_sessions_revoked": true +} diff --git a/docs/evidence/2026-09-09-keycape-approval-image-exercise.json b/docs/evidence/2026-09-09-keycape-approval-image-exercise.json index 12d76ce..fb90dc2 100644 --- a/docs/evidence/2026-09-09-keycape-approval-image-exercise.json +++ b/docs/evidence/2026-09-09-keycape-approval-image-exercise.json @@ -1,13 +1,18 @@ { + "acceptance_phase": "passed", "clients": [ { "client_id": "secrets-engine-approval", "live_jwks_signature_verified": true, "exact_claims_verified": true, "lifetime_seconds": 900, + "maximum_future_iat_seconds": 30, + "expiry_leeway_seconds": 0, "excess_scope_denied": true, "wrong_secret_denied": true, - "pod_verify_client_passed": false, + "pinned_artifact_verifier_passed": true, + "verifier_location": "attended owner process", + "verifier_sha256": "4bf93bbe9afe0bf2e21d51c03373a7e2b4be6864586bcc2d472eeb9abc913d92", "real_predecessor_rotation_tested": false, "observed_wall_clock_expiry": false }, @@ -16,15 +21,20 @@ "live_jwks_signature_verified": true, "exact_claims_verified": true, "lifetime_seconds": 900, + "maximum_future_iat_seconds": 30, + "expiry_leeway_seconds": 0, "excess_scope_denied": true, "wrong_secret_denied": true, - "pod_verify_client_passed": false, + "pinned_artifact_verifier_passed": true, + "verifier_location": "attended owner process", + "verifier_sha256": "4bf93bbe9afe0bf2e21d51c03373a7e2b4be6864586bcc2d472eeb9abc913d92", "real_predecessor_rotation_tested": false, "observed_wall_clock_expiry": false } ], + "acceptance_client": "approval-engine-operator", "human_client_consume_denied": true, "target": "disposable pinned KeyCape image; synthetic keys and clients only", - "pod_cli_verification": "deferred to live in-pod check", + "pinned_native_cli_verification": "passed against loopback HTTPS with synthetic credentials", "cleanup_complete": true } diff --git a/docs/evidence/2026-09-09-keycape-verifier-admission.json b/docs/evidence/2026-09-09-keycape-verifier-admission.json new file mode 100644 index 0000000..6ae6fc7 --- /dev/null +++ b/docs/evidence/2026-09-09-keycape-verifier-admission.json @@ -0,0 +1,220 @@ +{ + "schema": "helixforge.keycape-verifier-admission.v1", + "recorded_at": "2026-09-09T00:14:27.155338+00:00", + "approval": { + "schema": "railiance.keycape-custody-user-approval.v1", + "recorded_at": "2026-09-08T23:05:19.886216+00:00", + "user_response": "I approve, go on.", + "approved_question": "Do you approve CCR-2026-0017 and CCR-2026-0018, as platform operator and KeyCape owner, for the verifier-side credential delivery described in the review packet?", + "review_packet_revision": "52b24eab9a8aff3396e71b2296d0240a44f3b0db", + "roles": [ + "platform-operator", + "key-cape-owner" + ], + "scope": "Two verifier-side KeyCape client credential custody requests, including their governed attended provisioning and compatible rollout sequence.", + "client_side_read_authorized": false, + "factory_spending_authorized": false, + "requests": [ + { + "id": "CCR-2026-0017", + "decision_id": "b533a271-b704-4c5c-98a2-9a5951aadfb6", + "status": "approved", + "decision_status": "resolved", + "reviewed_roles": [ + "platform-operator", + "key-cape-owner" + ] + }, + { + "id": "CCR-2026-0018", + "decision_id": "efa90517-0cae-4eb6-a68d-5b0489c84d65", + "status": "approved", + "decision_status": "resolved", + "reviewed_roles": [ + "platform-operator", + "key-cape-owner" + ] + } + ] + }, + "activation": { + "schema": "platform.keycape-approval-custody.v1", + "status": "custody_and_service_acceptance_passed_pending_fresh_human_login", + "lanes": [ + { + "ccr": "CCR-2026-0017", + "source_sha256": "dc2bbd86e213edecc2f2f91a99d0f51136e9a0853a90e55f65dda2b942305416", + "custody_seeded": false, + "existing_version_reused": true, + "kv_version": 1, + "initial_request_id": "94c98373-33fa-591d-c201-d36dddf9879b", + "policy_applied": false, + "role_applied": true, + "native_reader_verified": true, + "cross_path_denied": true, + "parent_listing_denied": true, + "auth_ttl": 900, + "reader_revocation_verified": true, + "wrong_service_account_denied": true, + "coding_agent_deny_wins": true, + "store_ready": true, + "external_secret_ready": true, + "delivery_matches": true, + "secret_uid": "eaa28bdf-04af-4e4e-a1fc-fe395c7689a7", + "secret_resource_version": "58747058", + "wrong_namespace_denied": true, + "outside_namespace_store_denied": true + }, + { + "ccr": "CCR-2026-0018", + "source_sha256": "99148133ddf1eb15dce3c03862b51dc001818ca3121045035a0b0e5897c55dad", + "custody_seeded": false, + "existing_version_reused": true, + "kv_version": 1, + "initial_request_id": "a62ee5c5-b5ba-b7dc-0f51-e6fd8a6dde32", + "policy_applied": false, + "role_applied": true, + "native_reader_verified": true, + "cross_path_denied": true, + "parent_listing_denied": true, + "auth_ttl": 900, + "reader_revocation_verified": true, + "wrong_service_account_denied": true, + "coding_agent_deny_wins": true, + "store_ready": true, + "external_secret_ready": true, + "delivery_matches": true, + "secret_uid": "599a61a7-8244-4618-8c44-6473195bbe4e", + "secret_resource_version": "58747062", + "wrong_namespace_denied": true, + "outside_namespace_store_denied": true + } + ], + "started_at": "2026-09-09T00:09:28.852280+00:00", + "credential_values_emitted": false, + "client_side_read_admitted": false, + "keycape_rollout_completed": true, + "issuer_pin_revision": "58746187", + "phase": "awaiting_fresh_human_login", + "custody_versions_unchanged": true, + "namespace_probe_cleanup_requested": true, + "keycape": { + "existing_human_login_before": true, + "protected_recovery_retained": true, + "deployment_uid": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f", + "generation": 38, + "pod_uid": "8d62e972-d466-413e-a2e4-08b9a08016bc", + "single_ready_replica": true, + "acceptance_phase": "passed", + "clients": [ + { + "client_id": "secrets-engine-approval", + "live_jwks_signature_verified": true, + "exact_claims_verified": true, + "lifetime_seconds": 900, + "maximum_future_iat_seconds": 30, + "expiry_leeway_seconds": 0, + "excess_scope_denied": true, + "wrong_secret_denied": true, + "pinned_artifact_verifier_passed": true, + "verifier_location": "attended owner process", + "verifier_sha256": "4bf93bbe9afe0bf2e21d51c03373a7e2b4be6864586bcc2d472eeb9abc913d92", + "real_predecessor_rotation_tested": false, + "observed_wall_clock_expiry": false + }, + { + "client_id": "approval-engine-operator", + "live_jwks_signature_verified": true, + "exact_claims_verified": true, + "lifetime_seconds": 900, + "maximum_future_iat_seconds": 30, + "expiry_leeway_seconds": 0, + "excess_scope_denied": true, + "wrong_secret_denied": true, + "pinned_artifact_verifier_passed": true, + "verifier_location": "attended owner process", + "verifier_sha256": "4bf93bbe9afe0bf2e21d51c03373a7e2b4be6864586bcc2d472eeb9abc913d92", + "real_predecessor_rotation_tested": false, + "observed_wall_clock_expiry": false + } + ], + "acceptance_client": "approval-engine-operator", + "human_client_consume_denied": true, + "status": "service_acceptance_passed_pending_fresh_human_login", + "image": "forgejo.coulomb.social/coulomb/key-cape@sha256:7ff54c54e63ee172ae9e6e7fd2da96e427352f712343d74626ee6fe0f6f82611", + "config_resource_version": "58747126", + "signing_key_unchanged": true, + "unrelated_config_bytes_preserved": true, + "existing_human_login_after": false + }, + "finished_at": "2026-09-09T00:10:09.099481+00:00" + }, + "post_rollout_login": { + "schema": "netkingdom.keycape-approval-rollout.v1", + "status": "service_and_existing_human_login_acceptance_passed", + "values_emitted": false, + "deployment_uid": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f", + "generation": 38, + "pod_uid": "8d62e972-d466-413e-a2e4-08b9a08016bc", + "single_ready_replica": true, + "acceptance_phase": "passed", + "clients": [ + { + "client_id": "secrets-engine-approval", + "live_jwks_signature_verified": true, + "exact_claims_verified": true, + "lifetime_seconds": 900, + "maximum_future_iat_seconds": 30, + "expiry_leeway_seconds": 0, + "excess_scope_denied": true, + "wrong_secret_denied": true, + "pinned_artifact_verifier_passed": true, + "verifier_location": "attended owner process", + "verifier_sha256": "4bf93bbe9afe0bf2e21d51c03373a7e2b4be6864586bcc2d472eeb9abc913d92", + "real_predecessor_rotation_tested": false, + "observed_wall_clock_expiry": false + }, + { + "client_id": "approval-engine-operator", + "live_jwks_signature_verified": true, + "exact_claims_verified": true, + "lifetime_seconds": 900, + "maximum_future_iat_seconds": 30, + "expiry_leeway_seconds": 0, + "excess_scope_denied": true, + "wrong_secret_denied": true, + "pinned_artifact_verifier_passed": true, + "verifier_location": "attended owner process", + "verifier_sha256": "4bf93bbe9afe0bf2e21d51c03373a7e2b4be6864586bcc2d472eeb9abc913d92", + "real_predecessor_rotation_tested": false, + "observed_wall_clock_expiry": false + } + ], + "acceptance_client": "approval-engine-operator", + "human_client_consume_denied": true, + "existing_human_login_after": true, + "receipt_written_at": "2026-09-09T00:11:59.113549+00:00" + }, + "attended_envelope": { + "all_attempted_sessions_revoked": true, + "successful_activation_exit_code": 0, + "post_rollout_login_exit_code": 0 + }, + "validation": { + "local_openbao_tests": 8, + "configuration_and_recovery_tests": 10, + "credential_change_tests": 53, + "pinned_image_synthetic_https_and_native_verifier": "passed" + }, + "failed_attempt_receipts": [ + "net-kingdom:docs/evidence/2026-09-09-keycape-activation-attempts.json" + ], + "limits": { + "client_side_read_admitted": false, + "factory_spending_admitted": false, + "wall_clock_jwt_expiry_observed": false, + "actual_predecessor_rotation_observed": false + }, + "temporary_probe_namespaces_remaining": 0, + "owner_manifest_api_defaults_match_live": true +} diff --git a/docs/keycape-approval-clients-rollout.md b/docs/keycape-approval-clients-rollout.md new file mode 100644 index 0000000..10fe9f4 --- /dev/null +++ b/docs/keycape-approval-clients-rollout.md @@ -0,0 +1,78 @@ +# KeyCape approval-client rollout and recovery + +Accepted 2026-09-09 under CCR-2026-0017 and CCR-2026-0018. Both service +registrations are live on one ready KeyCape replica. The existing human OpenBao +login passed after replacement. [Live receipt](evidence/2026-09-09-keycape-verifier-admission.json). +The [attempt receipts](evidence/2026-09-09-keycape-activation-attempts.json) retain +failed checks and confirmed compatible rollback; no failed attempt is counted +as activation. Both OpenBao values remain at their initial version 1. + +The source image is the immutable manifest +`forgejo.coulomb.social/coulomb/key-cape@sha256:7ff54c54e63ee172ae9e6e7fd2da96e427352f712343d74626ee6fe0f6f82611`. +Deployment authority is `sso-mfa/k8s/keycape/deployment.yaml`; the live config +remains in `sso/keycape-config`. The contained helper appends only the two +reviewed client registrations and preserves the signing key and every unrelated +configuration byte. It uses UID/resourceVersion tests for config and deployment +mutations, and retains the previous compatible pair in protected owner storage. + +The platform command `scripts/keycape_approval_custody.py` opens through +`openbao-attended-exec.py` and the governed Warden `openbao-platform-admin-login` +envelope. It owns approved policies/roles, CAS=0 first provision, ESO delivery, +native scope/auth/namespace denials and reader revocation. It invokes this +repository's `sso-mfa/k8s/keycape/approval-clients-rollout.py` for image/config +replacement and service acceptance. Do not run the platform child directly. +On this workstation the verified Railiance kubeconfig is +`/home/worsch/.kube/config-railiance01`; the default config targets another endpoint. + +Use `activate` only for a first provision with absent custody and delivery. +`resume-activate --prior-receipt ` requires a completed compatible +rollback, unchanged version-1 custody, unchanged policies and detached reader roles. +It reattaches the same readers without writing any value. Both actions require a +unique `--receipt` and `--recovery` path. Successful service acceptance is followed +by a fresh attended login running the owner helper's `verify-after-login` action. +Existing active custody can be rechecked with the platform helper's `verify` +action. Repeating first provision against active custody is deliberately refused. + +The verifier binary comes from the pinned image, without starting its extraction +container. Install it in the owner-protected path +`~/.local/share/key-cape/verified-bin/dcebd46/keycape` with mode 0700. Its SHA-256 +must be `4bf93bbe9afe0bf2e21d51c03373a7e2b4be6864586bcc2d472eeb9abc913d92`; +the helper checks this before custody mutation and before each verifier run. +Extraction needs only `docker create`, `docker cp :/keycape `, +and removal of that never-started container. No credential enters that container. + +Run the native verifier in the existing attended owner process. It receives the +same verifier-side credential already read privately for independent JWT checks, +through a child environment that is never printed or written to a file. The +KeyCape pod's internal-only egress policy does not admit its public HTTPS issuer; +this rollout makes no network-policy change. Container readiness checks the +manifest digest in `imageID`, since containerd's `image` field can hold a different +runtime configuration digest. + +Independent JWT checks match the existing native contract: at most 30 seconds +of future issued-at time, strict not-before and expiry, exact audience/subject/ +tenant/role/scope and a 900-second lifetime. Global JWT leeway is not used. +Wrong secrets and excess scopes require the exact issuer HTTP status/error/feature. +The public human OpenBao client is also denied `approval:consume`. + +Reproducible preparation checks: + +```sh +python3 -B sso-mfa/k8s/keycape/test_approval_clients_rollout.py +python3 -B sso-mfa/k8s/keycape/exercise-approval-clients.py --receipt /tmp/.json +``` + +The second command requires Docker, the installed pinned verifier, PyYAML, +PyJWT and cryptography. It runs the pinned image behind loopback HTTPS with +synthetic signing keys and client credentials, including the native verifier. +It removes its container, TLS server and temporary credential files. It neither +reads production config nor opens an attended login. The platform's +`tests/test_keycape_approval_custody.py` separately exercises real ACLs, CAS=0, +revocation and version-preserving resume against disposable local OpenBao. + +KEY-WP-0013-T02 is complete. KEY-WP-0013-T05 retains the approval UI's callback +and MFA/PKCE acceptance. Separate client-side delivery remains RPF-WP-0035-T05; +audit custody remains AUDIT-WP-0009-T09; claim/consume and native execution proof +remain APPROVAL-WP-0002 and SECRETS-WP-0009-T03. Initial provisioning did not +exercise natural JWT expiry or actual predecessor rotation. HFACT-WP-0001 retains +factory execution/grant/spend admission and Railiance worker acceptance. diff --git a/sso-mfa/k8s/keycape/approval-clients-rollout.py b/sso-mfa/k8s/keycape/approval-clients-rollout.py index 13ea0b0..7d0634c 100644 --- a/sso-mfa/k8s/keycape/approval-clients-rollout.py +++ b/sso-mfa/k8s/keycape/approval-clients-rollout.py @@ -4,6 +4,7 @@ from __future__ import annotations import argparse import base64 import copy +import hashlib import importlib.util import json import os @@ -26,11 +27,18 @@ spec = importlib.util.spec_from_file_location('pin', Path(__file__).with_name('o pin = importlib.util.module_from_spec(spec); spec.loader.exec_module(pin) ISSUER = 'https://kc.coulomb.social' IMAGE = 'forgejo.coulomb.social/coulomb/key-cape@sha256:7ff54c54e63ee172ae9e6e7fd2da96e427352f712343d74626ee6fe0f6f82611' +VERIFIER = Path('/home/worsch/.local/share/key-cape/verified-bin/dcebd46/keycape') +VERIFIER_SHA256 = '4bf93bbe9afe0bf2e21d51c03373a7e2b4be6864586bcc2d472eeb9abc913d92' PRIOR_IMAGE = 'forgejo.coulomb.social/coulomb/key-cape:main-153258b' IDS = ('secrets-engine-approval', 'approval-engine-operator') SECRET_NAMES = ('keycape-secrets-engine-approval-client', 'keycape-approval-engine-operator-client') +def verify_artifact(): + require(VERIFIER.is_file() and not VERIFIER.is_symlink() + and hashlib.sha256(VERIFIER.read_bytes()).hexdigest() == VERIFIER_SHA256, 'pinned_verifier_artifact_required') + + def registrations(): source = yaml.safe_load((KEYCAPE / 'config/service-clients.example.yaml').read_text())['clients'] result = [next(c for c in source if c['clientId'] == name) for name in IDS] @@ -115,7 +123,9 @@ def ready(kube, image, timeout=150): podlist = data(command(kube + ['-n', 'sso', 'get', 'pods', '-l', 'app.kubernetes.io/name=keycape', '-o', 'json']))['items'] if len(podlist) == 1 and not podlist[0]['metadata'].get('deletionTimestamp'): containers = podlist[0].get('status', {}).get('containerStatuses', []) - if any(c['name'] == 'keycape' and c['ready'] and c['image'] == image for c in containers): + if any(c['name'] == 'keycape' and c['ready'] and + (c.get('imageID', '').removeprefix('docker-pullable://') == image + if '@sha256:' in image else c.get('image') == image) for c in containers): return {'deployment_uid': dep['metadata']['uid'], 'generation': dep['metadata']['generation'], 'pod_uid': podlist[0]['metadata']['uid'], 'single_ready_replica': True} time.sleep(3) @@ -141,7 +151,10 @@ def http(path, fields=None, credentials=None): with opener.open(request, timeout=20) as response: return response.status, json.load(response) except urllib.error.HTTPError as error: - return error.code, json.load(error) + try: + return error.code, json.load(error) + except (ValueError, TypeError): + raise LaneError('http_' + str(error.code) + '_non_json_error') from None def denied(result, status, feature): @@ -150,53 +163,79 @@ def denied(result, status, feature): and body.get('feature') == feature, 'keycape_denial_inconclusive') + +def verified_claims(token, public_key): + # Match authclient/client.go: tolerate at most 30s future iat, but no + # extension to expiry or not-before. PyJWT's global leeway would extend both. + claims = jwt.decode(token, public_key, algorithms=['RS256'], issuer=ISSUER, audience='approval-engine', + options={'verify_iat': False, 'require': ['exp', 'iat', 'sub', 'iss', 'aud']}) + require(type(claims['iat']) is int and type(claims['exp']) is int + and claims['iat'] <= int(time.time()) + 30 and claims['iat'] < claims['exp'], 'issued_at_binding_failed') + return claims + + def acceptance(kube, receipt): + receipt['acceptance_phase'] = 'discovery' code, discovery = http('/.well-known/openid-configuration') require(code == 200 and discovery['issuer'] == ISSUER and discovery['token_endpoint'] == ISSUER + '/token' and discovery['jwks_uri'].startswith(ISSUER + '/'), 'discovery_binding_mismatch') + receipt['acceptance_phase'] = 'jwks' code, jwks = http(discovery['jwks_uri'].removeprefix(ISSUER)) require(code == 200, 'jwks_failed') receipt['clients'] = [] for client, secret_name in zip(registrations(), SECRET_NAMES): + receipt['acceptance_client'] = client['clientId'] + receipt['acceptance_phase'] = 'verifier_secret_read' secret = get(kube, 'secret', secret_name) credential = base64.b64decode(secret['data']['client-secret'], validate=True).decode() scopes = ' '.join(client['allowedScopes']) + receipt['acceptance_phase'] = 'token_exchange' result, response = http('/token', {'grant_type': 'client_credentials', 'scope': scopes}, (client['clientId'], credential)) require(result == 200 and response.get('token_type') == 'Bearer' and response.get('expires_in') == 900, 'service_issuance_failed') + receipt['acceptance_phase'] = 'signature_and_claims' token = response['access_token']; header = jwt.get_unverified_header(token) keys = [key for key in jwks['keys'] if key['kid'] == header.get('kid')] require(header.get('alg') == 'RS256' and len(keys) == 1, 'signing_key_selection_failed') - claims = jwt.decode(token, jwt.PyJWK.from_dict(keys[0]).key, algorithms=['RS256'], - issuer=ISSUER, audience='approval-engine', - options={'require': ['exp', 'iat', 'sub', 'iss', 'aud']}) + claims = verified_claims(token, jwt.PyJWK.from_dict(keys[0]).key) require(claims['sub'] == client['serviceSubject'] and claims['tenant'] == 'tenant:platform' + and claims['aud'] == 'approval-engine' and claims['roles'] == client['roles'] and claims['exp'] - claims['iat'] == 900 and claims['principal_type'] == 'service' and set(claims['scope'].split()) == set(client['allowedScopes']), 'exact_claims_mismatch') excessive = 'approval:approve' if client['clientId'] == IDS[0] else 'approval:consume' + receipt['acceptance_phase'] = 'excess_scope_denial' denied(http('/token', {'grant_type': 'client_credentials', 'scope': excessive}, (client['clientId'], credential)), 400, 'scope') + receipt['acceptance_phase'] = 'wrong_secret_denial' denied(http('/token', {'grant_type': 'client_credentials', 'scope': scopes}, (client['clientId'], secrets.token_urlsafe(48))), 401, 'Authorization') - args = kube + ['-n', 'sso', 'exec', 'deployment/keycape', '--', '/keycape', 'verify-client', + args = [str(VERIFIER), 'verify-client', '-issuer', ISSUER, '-client-id', client['clientId'], '-audience', 'approval-engine', '-scope', scopes, '-secret-env', client['secretRef'].removeprefix('env:'), '-expect-subject', client['serviceSubject'], '-expect-tenant', 'tenant:platform', '-expect-roles', ','.join(client['roles']), '-deny-scope', excessive] - command(args) + receipt['acceptance_phase'] = 'pinned_artifact_verifier' + verify_artifact() + verifier_env = os.environ.copy() + verifier_env[client['secretRef'].removeprefix('env:')] = credential + command(args, env=verifier_env) receipt['clients'].append({'client_id': client['clientId'], 'live_jwks_signature_verified': True, - 'exact_claims_verified': True, 'lifetime_seconds': 900, 'excess_scope_denied': True, - 'wrong_secret_denied': True, 'pod_verify_client_passed': True, + 'exact_claims_verified': True, 'lifetime_seconds': 900, 'maximum_future_iat_seconds': 30, 'expiry_leeway_seconds': 0, 'excess_scope_denied': True, + 'wrong_secret_denied': True, 'pinned_artifact_verifier_passed': True, + 'verifier_location': 'attended owner process', 'verifier_sha256': VERIFIER_SHA256, 'real_predecessor_rotation_tested': False, 'observed_wall_clock_expiry': False}) + receipt['acceptance_phase'] = 'human_consume_denial' query = urllib.parse.urlencode({'client_id': 'openbao-admin', 'response_type': 'code', 'redirect_uri': 'http://localhost:8250/oidc/callback', 'scope': 'openid approval:consume', 'code_challenge_method': 'S256', 'code_challenge': 'A' * 43, 'state': secrets.token_urlsafe(32)}) denied(http('/authorize?' + query), 400, 'scope') receipt['human_client_consume_denied'] = True + receipt['acceptance_phase'] = 'passed' def rollout(kube, receipt, recovery_path): assert_cluster(kube) + verify_artifact() before = get(kube, 'secret', 'keycape-config') deployment = get(kube, 'deployment', 'keycape') require(before['metadata']['uid'] == '2e94519d-1550-41c7-9701-2efe47fe1fd3' @@ -223,7 +262,8 @@ def rollout(kube, receipt, recovery_path): receipt.update(status='service_acceptance_passed_pending_fresh_human_login', image=IMAGE, config_resource_version=after['metadata']['resourceVersion'], signing_key_unchanged=True, unrelated_config_bytes_preserved=True, existing_human_login_after=False) - except Exception: + except Exception as failure: + receipt['failure_class'] = type(failure).__name__ # Read after uncertain API outcomes too; never assume a timeout means no write. now = get(kube, 'secret', 'keycape-config') require(now['metadata']['uid'] == before['metadata']['uid'], 'rollback_config_identity_drift') diff --git a/sso-mfa/k8s/keycape/deployment.yaml b/sso-mfa/k8s/keycape/deployment.yaml index db88062..522feba 100644 --- a/sso-mfa/k8s/keycape/deployment.yaml +++ b/sso-mfa/k8s/keycape/deployment.yaml @@ -1,8 +1,8 @@ # Deployment + Service — KeyCape (namespace: sso) # -# KeyCape is the OIDC orchestration layer. It is stateless: all persistent -# state lives in Authelia (session), LLDAP (users), and privacyIDEA (MFA tokens). -# No PVC is required. +# KeyCape orchestrates OIDC. Pending logins and authorization codes are process-local; +# use one replica with Recreate during replacement. Persistent identity state remains +# in Authelia, LLDAP and privacyIDEA. No PVC is required. # # Configuration is stored entirely in the keycape-config Secret, which holds # a complete config.yaml and the RSA private key used to sign OIDC tokens @@ -33,7 +33,7 @@ spec: matchLabels: app.kubernetes.io/name: keycape strategy: - type: RollingUpdate # stateless — safe to roll + type: Recreate # one issuer instance; process-local login/code state template: metadata: labels: @@ -50,7 +50,7 @@ spec: - name: keycape # Image published to the self-hosted Forgejo OCI registry (KEY-WP-0002). # KEY-WP-0012: canonical OIDC subject resolution for /userinfo. - image: forgejo.coulomb.social/coulomb/key-cape:main-153258b + image: forgejo.coulomb.social/coulomb/key-cape@sha256:7ff54c54e63ee172ae9e6e7fd2da96e427352f712343d74626ee6fe0f6f82611 imagePullPolicy: IfNotPresent ports: @@ -67,6 +67,17 @@ spec: name: keycape-rapp-qonto-client key: client-secret + - name: KEYCAPE_SECRETS_ENGINE_APPROVAL_CLIENT_SECRET + valueFrom: + secretKeyRef: + name: keycape-secrets-engine-approval-client + key: client-secret + - name: KEYCAPE_APPROVAL_ENGINE_OPERATOR_CLIENT_SECRET + valueFrom: + secretKeyRef: + name: keycape-approval-engine-operator-client + key: client-secret + volumeMounts: # keycape-config Secret provides config.yaml and key.pem - name: config-secret @@ -89,7 +100,7 @@ spec: failureThreshold: 3 readinessProbe: httpGet: - path: /healthz + path: /readyz port: 8080 initialDelaySeconds: 0 periodSeconds: 10 diff --git a/sso-mfa/k8s/keycape/exercise-approval-clients.py b/sso-mfa/k8s/keycape/exercise-approval-clients.py new file mode 100644 index 0000000..ca54905 --- /dev/null +++ b/sso-mfa/k8s/keycape/exercise-approval-clients.py @@ -0,0 +1,92 @@ +import base64, importlib.util, json, os, secrets, socket, subprocess, tempfile, time +from pathlib import Path +from unittest.mock import patch +from cryptography.hazmat.primitives import serialization +from cryptography.hazmat.primitives.asymmetric import rsa +import yaml +import http.server, ssl, threading, urllib.request, urllib.error, datetime, ipaddress +from cryptography import x509 +from cryptography.x509.oid import NameOID +import argparse +parser=argparse.ArgumentParser(description='Exercise the pinned image and verifier over loopback HTTPS using synthetic credentials only.') +parser.add_argument('--receipt', required=True, type=Path) +args=parser.parse_args() +spec=importlib.util.spec_from_file_location('rollout',Path(__file__).with_name('approval-clients-rollout.py')) +m=importlib.util.module_from_spec(spec); spec.loader.exec_module(m) +m.verify_artifact() +def call(args): + p=subprocess.run(args,capture_output=True,timeout=45) + if p.returncode: raise RuntimeError('contained_docker_command_failed') + return p +sock=socket.socket(); sock.bind(('127.0.0.1',0)); port=sock.getsockname()[1]; sock.close() +class Proxy(http.server.BaseHTTPRequestHandler): + def log_message(self, *args): pass + def handle_proxy(self): + body = self.rfile.read(int(self.headers.get('Content-Length', 0))) if self.command == 'POST' else None + req = urllib.request.Request(f'http://127.0.0.1:{port}'+self.path, data=body, + headers={k:self.headers[k] for k in ['Content-Type','Authorization'] if k in self.headers}) + try: + response=urllib.request.urlopen(req,timeout=20) + except urllib.error.HTTPError as error: response=error + with response: + self.send_response(response.code) + self.send_header('Content-Type', response.headers.get('Content-Type','application/json')) + self.end_headers(); self.wfile.write(response.read()) + do_GET=handle_proxy + do_POST=handle_proxy +server=http.server.ThreadingHTTPServer(('127.0.0.1',0),Proxy) +https_port=server.server_address[1] +name='keycape-approval-exercise-'+secrets.token_hex(5) +with tempfile.TemporaryDirectory(prefix='keycape-private-exercise-') as temp: + root=Path(temp) + key=rsa.generate_private_key(public_exponent=65537,key_size=2048) + (root/'key.pem').write_bytes(key.private_bytes(serialization.Encoding.PEM,serialization.PrivateFormat.PKCS8,serialization.NoEncryption())) + os.chmod(root/'key.pem',0o600) + name_attr=x509.Name([x509.NameAttribute(NameOID.COMMON_NAME,'KeyCape local exercise')]) + cert=(x509.CertificateBuilder().subject_name(name_attr).issuer_name(name_attr).public_key(key.public_key()) + .serial_number(x509.random_serial_number()).not_valid_before(datetime.datetime.now(datetime.timezone.utc)-datetime.timedelta(minutes=1)) + .not_valid_after(datetime.datetime.now(datetime.timezone.utc)+datetime.timedelta(hours=1)) + .add_extension(x509.SubjectAlternativeName([x509.IPAddress(ipaddress.ip_address('127.0.0.1'))]),False) + .add_extension(x509.BasicConstraints(ca=True,path_length=None),True)) + from cryptography.hazmat.primitives import hashes + (root/'cert.pem').write_bytes(cert.sign(key,hashes.SHA256()).public_bytes(serialization.Encoding.PEM)) + context=ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER); context.load_cert_chain(root/'cert.pem',root/'key.pem') + server.socket=context.wrap_socket(server.socket,server_side=True) + threading.Thread(target=server.serve_forever,daemon=True).start() + config=yaml.safe_load((m.KEYCAPE/'config/dev-config.yaml').read_text()) + config.update(issuer=f'https://127.0.0.1:{https_port}') + config['authelia']['issuer']='https://auth.coulomb.social' + config['clients'].extend(m.registrations()) + (root/'config.yaml').write_text(yaml.safe_dump(config,sort_keys=False)) + os.chmod(root/'config.yaml',0o600) + values={c['clientId']:secrets.token_urlsafe(48) for c in m.registrations()} + (root/'env').write_text('KEYCAPE_CONFIG=/etc/keycape/config.yaml\n'+''.join(c['secretRef'].removeprefix('env:')+'='+values[c['clientId']]+'\n' for c in m.registrations())) + os.chmod(root/'env',0o600) + created=False + try: + call(['docker','run','-d','--rm','--name',name,'--user',str(os.getuid()),'--publish',f'127.0.0.1:{port}:8080', + '--env-file',str(root/'env'),'--mount','type=bind,source='+temp+',target=/etc/keycape,readonly',m.IMAGE]) + created=True + with patch.object(m,'ISSUER',config['issuer']), patch.dict(os.environ,{'SSL_CERT_FILE':str(root/'cert.pem')}): + for _ in range(30): + try: + status,_=m.http('/.well-known/openid-configuration') + if status==200: break + except Exception: pass + time.sleep(.5) + else: raise RuntimeError('scratch_keycape_not_ready') + def fake_get(kube,kind,name): + index=m.SECRET_NAMES.index(name) + return {'data': {'client-secret':base64.b64encode(values[m.IDS[index]].encode()).decode()}} + receipt={} + with patch.object(m,'get',side_effect=fake_get): + m.acceptance([],receipt) + receipt.update(target='disposable pinned KeyCape image; synthetic keys and clients only', + pinned_native_cli_verification='passed against loopback HTTPS with synthetic credentials',cleanup_complete=False) + finally: + if created: call(['docker','stop','--time=5',name]) + server.shutdown(); server.server_close() + receipt['cleanup_complete']=True + fd=os.open(args.receipt,os.O_WRONLY|os.O_CREAT|os.O_EXCL,0o600) + with os.fdopen(fd,'w') as out: out.write(json.dumps(receipt,indent=2)+'\n') +print('Pinned-image scratch acceptance passed; synthetic credentials removed.') diff --git a/sso-mfa/k8s/keycape/test_approval_clients_rollout.py b/sso-mfa/k8s/keycape/test_approval_clients_rollout.py index ee73eae..cc1d670 100644 --- a/sso-mfa/k8s/keycape/test_approval_clients_rollout.py +++ b/sso-mfa/k8s/keycape/test_approval_clients_rollout.py @@ -83,7 +83,7 @@ class RolloutTests(unittest.TestCase): changed['metadata']['resourceVersion'] = str(int(changed['metadata']['resourceVersion']) + 1) state[kind] = changed return copy.deepcopy(changed) - with tempfile.TemporaryDirectory() as directory, patch.object(m, 'assert_cluster'), \ + with tempfile.TemporaryDirectory() as directory, patch.object(m, 'assert_cluster'), patch.object(m, 'verify_artifact'), \ patch.object(m, 'get', side_effect=lambda kube, kind, name: copy.deepcopy(state[kind])), \ patch.object(m, 'patch_object', side_effect=fake_patch), patch.object(m, 'ready', return_value={}), \ patch.object(m, 'acceptance', side_effect=m.LaneError('synthetic_acceptance_failure')): @@ -95,6 +95,29 @@ class RolloutTests(unittest.TestCase): self.assertEqual(state['deployment']['spec'], original['deployment']['spec']) self.assertEqual((Path(directory) / 'recovery.json').stat().st_mode & 0o777, 0o600) + def test_ready_matches_manifest_imageid_not_runtime_config_id(self): + dep = deployment(); dep['metadata']['generation'] = 30 + dep['status'] = {'observedGeneration': 30, 'updatedReplicas': 1, 'readyReplicas': 1, 'availableReplicas': 1, 'replicas': 1} + pod = {'metadata': {'uid': 'fixture-pod'}, 'status': {'containerStatuses': [ + {'name': 'keycape', 'ready': True, 'image': 'sha256:runtime-config-id', 'imageID': m.IMAGE}]}} + from types import SimpleNamespace + with patch.object(m, 'get', return_value=dep), patch.object(m, 'command', return_value=SimpleNamespace(stdout=json.dumps({'items': [pod]}).encode())): + self.assertTrue(m.ready([], m.IMAGE, timeout=1)['single_ready_replica']) + + def test_iat_skew_matches_native_contract_without_extending_expiry(self): + from cryptography.hazmat.primitives.asymmetric import rsa + key = rsa.generate_private_key(public_exponent=65537, key_size=2048) + now = int(m.time.time()) + claims = {'iss': m.ISSUER, 'aud': 'approval-engine', 'sub': 'synthetic-service', 'iat': now + 2, 'exp': now + 902} + encoded = m.jwt.encode(claims, key, algorithm='RS256') + self.assertEqual(m.verified_claims(encoded, key.public_key())['iat'], now + 2) + future = m.jwt.encode(dict(claims, iat=now+60), key, algorithm='RS256') + with self.assertRaisesRegex(m.LaneError, 'issued_at_binding_failed'): + m.verified_claims(future, key.public_key()) + expired = m.jwt.encode(dict(claims, iat=now-900, exp=now-1), key, algorithm='RS256') + with self.assertRaises(m.jwt.ExpiredSignatureError): + m.verified_claims(expired, key.public_key()) + def test_unrelated_refusal_never_passes(self): for status, body in [(500, {}), (400, {'error': 'invalid_profile_usage', 'feature': 'client_id'}), (401, {'error': 'invalid_profile_usage', 'feature': 'scope'})]: