From 922f1ee04148fc5c8b5d627ccbf81d9f034dbc2f Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 9 Oct 2026 12:26:17 +0200 Subject: [PATCH] NK-WP-0048-T06: write the Forgejo reference case (accepted) security-cases/forgejo-netkingdom-oidc.yaml carries the founder's 2026-10-08 acceptance of the key-cape request; validates and renders plan-only. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 469893@bnt-lap001 Assistant-Session: 49296f15-2171-4137-b972-2443bab95edb --- .../tests/test_oidc_browser_relying_party.py | 10 ++++++ security-cases/forgejo-netkingdom-oidc.yaml | 33 +++++++++++++++++++ workplans/NK-WP-0048-security-case-types.md | 13 ++++++++ 3 files changed, 56 insertions(+) create mode 100644 security-cases/forgejo-netkingdom-oidc.yaml diff --git a/security-case-types/oidc-browser-relying-party/tests/test_oidc_browser_relying_party.py b/security-case-types/oidc-browser-relying-party/tests/test_oidc_browser_relying_party.py index 5131b99..1903346 100644 --- a/security-case-types/oidc-browser-relying-party/tests/test_oidc_browser_relying_party.py +++ b/security-case-types/oidc-browser-relying-party/tests/test_oidc_browser_relying_party.py @@ -161,3 +161,13 @@ def test_public_client_without_mfa_skips_delivery_and_mfa_checks(): _, r = v.render_case(PUBLIC, as_implemented(), DECLS) checks = {c["id"] for c in r["verification"]} assert not {"secret-delivered", "mfa-pinned"} & checks + + +def test_forgejo_reference_case_is_accepted_and_matches_the_example(): + # The live reference case (NK-WP-0048-T06) is the example plus its acceptance. + case = yaml.safe_load((REPO / "security-cases" / "forgejo-netkingdom-oidc.yaml").read_text()) + assert case["spec"]["parameters"] == FORGEJO["spec"]["parameters"] + assert case["spec"]["status"] == "accepted" + assert {b["role"] for b in case["spec"]["acceptance"]["by"]} == {"owner", "founder"} + assert msgs(v.validate_case(case, TYPE, require_implemented=False)) == [] + assert msgs(v.validate_case(case, as_implemented())) == [] diff --git a/security-cases/forgejo-netkingdom-oidc.yaml b/security-cases/forgejo-netkingdom-oidc.yaml new file mode 100644 index 0000000..a52629d --- /dev/null +++ b/security-cases/forgejo-netkingdom-oidc.yaml @@ -0,0 +1,33 @@ +# First KnownSecurityCase of oidc-browser-relying-party 1.0 (NK-WP-0048-T06). +# Parameters are the request the founder accepted on 2026-10-08 +# (key-cape docs/forgejo-oidc-client-request.yaml, KEY-WP-0038-T01); that +# acceptance carries over as this case's acceptance. One difference: custody is +# derived by the type (platform/workloads/keycape/forgejo), not the request's +# proposed platform/workloads/forgejo/netkingdom-oidc-client. The founder +# acknowledged that derivation with the type (memo r4, 2026-10-09). +apiVersion: netkingdom.io/security-case/v0.1 +kind: SecurityCase +spec: + id: forgejo-netkingdom-oidc + type: oidc-browser-relying-party@1.0 + status: accepted + acceptance: + at: "2026-10-08" + record: "key-cape docs/forgejo-oidc-client-request.yaml (status accepted-2026-10-08, KEY-WP-0038-T01); type acknowledged via informed-decision memo nk-wp-0048-t05-oidc-browser-relying-party-r4, hub decision e418263e" + by: + - {role: owner, name: "founder (for railiance-apps)"} + - {role: founder, name: founder} + owner: + repo: railiance-apps + person: founder + parameters: + client_id: forgejo + display_name: Forgejo source forge + redirect_uris: https://forgejo.coulomb.social/user/oauth2/netkingdom/callback + allowed_scopes: openid,profile,email,groups + client_type: confidential + mfa_required: "true" + access_groups: forge-admins,forge-coulomb-owners,forge-coulomb-readers + initial_members: forge-admins=tegwick;forge-coulomb-owners=tegwick + consuming_service: forgejo + consumer_owner_repo: railiance-apps diff --git a/workplans/NK-WP-0048-security-case-types.md b/workplans/NK-WP-0048-security-case-types.md index c41e672..27686de 100644 --- a/workplans/NK-WP-0048-security-case-types.md +++ b/workplans/NK-WP-0048-security-case-types.md @@ -339,6 +339,19 @@ this reference case is live. This replaces the hand-built path proposed for KEY-WP-0038-T02. +2026-10-09: case written, `security-cases/forgejo-netkingdom-oidc.yaml`, status +`accepted`: the example's parameters plus the founder's 2026-10-08 acceptance of +the key-cape request (owner and founder), with the custody-path derivation +covered by the type's acknowledgment (memo r4). It validates and renders (plan +`execution.permitted: false`; three attended steps on `key-cape-oidc-login`); +it needs `--allow-unimplemented` until it is live, since it is the case that +makes the type `implemented`. A test keeps it equal to the type's example. +Still open before it runs: ops-mason renders and builds it (MASON-WP-0010-T02, +T03, unblocked by T05), ops-warden plans and runs it (WARDEN-WP-0044-T02, T03), +railiance-platform's `keycape-client-secret-generate` lane (asked by ops-mason +`789feb39` and ops-warden `d9f889b1`, both unread), and a founder-approved +identity-provisioner rollout containing 630ebfd. + ```task id: NK-WP-0048-T07 status: wait