coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0054-T04: keycape alias helper reads bao list's bare-array JSON

Browse source 
Founder dry run 2 (receipt 20261107T140929Z): session, mounts and envelope
checks passed; the role list failed with TypeError. Fake bao now prints the
real CLI shape. Read-only; no live change.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 149903@bnt-lap001
Assistant-Session: 4c20a536-1452-4a85-bc09-e1987d9817d6
This commit is contained in:
tegwick 2026-11-07 15:11:56 +01:00
parent 9db7f5fa1c
commit 4d70743252
2 changed files with 4 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
tools/service-identity/keycape_alias_disable.py
View file

@ -70,7 +70,9 @@ def session() -> dict:
def alias_view() -> dict:
view: dict = {}
try:
view["roles"] = sorted(bao_json("list", "auth/keycape/role")["data"].get("keys", []))
listed = bao_json("list", "auth/keycape/role") # `bao list -format=json` prints a bare array
keys = listed if isinstance(listed, list) else listed.get("data", {}).get("keys", [])
view["roles"] = sorted(str(k) for k in keys)
except subprocess.CalledProcessError:
view["roles"] = None
try:

2
tools/service-identity/tests/test_keycape_alias_disable.py
View file

@ -25,7 +25,7 @@ elif args == ["read", "auth/token/lookup-self"]:
sys.exit(2)
out({"path": "auth/%s/oidc/callback" % state["session"], "policies": ["default", "platform-admin"]})
elif args == ["list", "auth/keycape/role"]:
out({"keys": ["platform-admin"]})
print(json.dumps(["platform-admin"])) # the real CLI prints a bare array for list
elif args == ["read", "auth/keycape/config"]:
out({"oidc_client_id": "openbao-admin", "default_role": "platform-admin", "oidc_client_secret": "never"})
elif args[:2] == ["auth", "disable"]: