From 4d707432523139e1fafd26eb66dfed4f7d425cec Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 7 Nov 2026 15:11:56 +0100 Subject: [PATCH] NK-WP-0054-T04: keycape alias helper reads bao list's bare-array JSON Founder dry run 2 (receipt 20261107T140929Z): session, mounts and envelope checks passed; the role list failed with TypeError. Fake bao now prints the real CLI shape. Read-only; no live change. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 149903@bnt-lap001 Assistant-Session: 4c20a536-1452-4a85-bc09-e1987d9817d6 --- tools/service-identity/keycape_alias_disable.py | 4 +++- tools/service-identity/tests/test_keycape_alias_disable.py | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/tools/service-identity/keycape_alias_disable.py b/tools/service-identity/keycape_alias_disable.py index 6031efc..2a5f6b9 100755 --- a/tools/service-identity/keycape_alias_disable.py +++ b/tools/service-identity/keycape_alias_disable.py @@ -70,7 +70,9 @@ def session() -> dict: def alias_view() -> dict: view: dict = {} try: - view["roles"] = sorted(bao_json("list", "auth/keycape/role")["data"].get("keys", [])) + listed = bao_json("list", "auth/keycape/role") # `bao list -format=json` prints a bare array + keys = listed if isinstance(listed, list) else listed.get("data", {}).get("keys", []) + view["roles"] = sorted(str(k) for k in keys) except subprocess.CalledProcessError: view["roles"] = None try: diff --git a/tools/service-identity/tests/test_keycape_alias_disable.py b/tools/service-identity/tests/test_keycape_alias_disable.py index 873a3c9..ca5982f 100644 --- a/tools/service-identity/tests/test_keycape_alias_disable.py +++ b/tools/service-identity/tests/test_keycape_alias_disable.py @@ -25,7 +25,7 @@ elif args == ["read", "auth/token/lookup-self"]: sys.exit(2) out({"path": "auth/%s/oidc/callback" % state["session"], "policies": ["default", "platform-admin"]}) elif args == ["list", "auth/keycape/role"]: - out({"keys": ["platform-admin"]}) + print(json.dumps(["platform-admin"])) # the real CLI prints a bare array for list elif args == ["read", "auth/keycape/config"]: out({"oidc_client_id": "openbao-admin", "default_role": "platform-admin", "oidc_client_secret": "never"}) elif args[:2] == ["auth", "disable"]: