coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Retire bao.coulomb.social callbacks from the KeyCape openbao-admin client
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 4s
Details

Browse source 
The name was retired on 2026-09-15. Remove both public UI callbacks from
the code-defined client (openbao-client-config.py, create-secrets.sh), stop
probing them in verify-openbao-client.sh, and fail verification in
openbao-client-config.py and verify-t07.sh if either is registered again.
The CLI and operator-tunneled 127.0.0.1:18200 callbacks remain.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 299762@bnt-lap001
Assistant-Session: d3d3cea1-869c-44f1-be2a-3d6d3550e72e
This commit is contained in:
tegwick 2026-09-23 19:41:35 +02:00
parent a356f640ac
commit 3b14469afb
6 changed files with 51 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

19
sso-mfa/k8s/keycape/test_openbao_client_config.py
View file

@ -32,6 +32,25 @@ class OpenBaoClientConfigTest(unittest.TestCase):
[f"openbao-admin.redirectUris missing: {LOOPBACK_CALLBACK}"],
)
def test_retired_public_callbacks_are_not_declared(self) -> None:
for uri in MODULE.RETIRED_OPENBAO_REDIRECT_URIS:
self.assertNotIn(uri, MODULE.OPENBAO_CLIENT["redirectUris"])
def test_retired_public_callback_fails_verification(self) -> None:
client = dict(MODULE.OPENBAO_CLIENT)
retired = MODULE.RETIRED_OPENBAO_REDIRECT_URIS[0]
client["redirectUris"] = [*MODULE.OPENBAO_CLIENT["redirectUris"], retired]
self.assertEqual(
MODULE.retired_redirect_errors({"clients": [client]}),
[f"openbao-admin.redirectUris retired: {retired}"],
)
def test_upsert_removes_retired_callbacks(self) -> None:
stale = dict(MODULE.OPENBAO_CLIENT)
stale["redirectUris"] = [*MODULE.OPENBAO_CLIENT["redirectUris"], *MODULE.RETIRED_OPENBAO_REDIRECT_URIS]
updated = MODULE.upsert_client({"clients": [stale]}, MODULE.OPENBAO_CLIENT)
self.assertEqual(MODULE.retired_redirect_errors(updated), [])
def test_upsert_preserves_unrelated_clients(self) -> None:
config = {"clients": [{"clientId": "unrelated", "clientType": "public"}]}
updated = MODULE.upsert_client(config, MODULE.OPENBAO_CLIENT)