coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0048: adopt {client_id:env} in bind-env and its rollback (1.0 patch)

Browse source 
ops-warden's case planner renders the spec since 23ba584.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 736651@bnt-lap001
Assistant-Session: f6189624-fd64-4109-b53e-f8a59ca8a2d8
This commit is contained in:
tegwick 2026-10-10 10:28:00 +02:00
parent 850907a987
commit 9a9b8e373a
3 changed files with 12 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

8
security-case-types/oidc-browser-relying-party/tests/test_oidc_browser_relying_party.py
View file

@ -175,13 +175,9 @@ def test_forgejo_reference_case_is_accepted_and_matches_the_example():
def test_env_format_spec_renders_the_keycape_env_name():
# {client_id:env} gives the name keycape-client.py derives (env_name): upper
# case, '-' as '_'. The type adopts it once ops-warden's planner renders it
# too (ops-warden message 06303d1d); until then it keeps the literal form.
# case, '-' as '_'. Adopted in 1.0 once ops-warden's planner rendered it too
# (ops-warden 23ba584, message c1df14b7).
t = as_implemented()
for item in t["spec"]["follow_through"] + t["spec"]["rollback"]:
for key in ("entry_point", "action"):
if key in item:
item[key] = item[key].replace("KEYCAPE_<CLIENT_ID>_CLIENT_SECRET", "KEYCAPE_{client_id:env}_CLIENT_SECRET")
assert msgs(v.validate_type(t)) == []
issues, r = v.render_case(with_params(FORGEJO, client_id="my-forge"), t, DECLS)
assert msgs(issues) == []

4
security-case-types/oidc-browser-relying-party/type.yaml
View file

@ -190,7 +190,7 @@ spec:
- id: bind-env
owner: net-kingdom
when: "client_type == confidential"
entry_point: "patch Deployment sso/keycape: env KEYCAPE_<CLIENT_ID>_CLIENT_SECRET from sso/keycape-{client_id}-client"
entry_point: "patch Deployment sso/keycape: env KEYCAPE_{client_id:env}_CLIENT_SECRET from sso/keycape-{client_id}-client"
auth: "operator kube credentials for namespace sso"
lane: key-cape-oidc-login
warden_executes: false
@ -264,7 +264,7 @@ spec:
action: "keycape-client.py apply --operation remove for {client_id}"
- reverses: bind-env
when: "client_type == confidential"
action: "remove env KEYCAPE_<CLIENT_ID>_CLIENT_SECRET from Deployment sso/keycape, after register-client is reversed"
action: "remove env KEYCAPE_{client_id:env}_CLIENT_SECRET from Deployment sso/keycape, after register-client is reversed"
- reverses: deliver-secret
when: "client_type == confidential"
action: "delete ExternalSecret sso/keycape-{client_id}-client and its target"

8
workplans/NK-WP-0048-security-case-types.md
View file

@ -373,6 +373,14 @@ text is now checked for unknown placeholders too (patch-level, canon section 6).
The type keeps the literal until ops-warden's planner (`text.format`) renders the
spec as well; asked of ops-warden. 53 tests pass.
2026-10-10: ops-warden rendered `{param:env}` in `warden case plan`
(23ba584, message `c1df14b7`; other specs and `!conversion` refused). The type
adopts it as a 1.0 patch (canon section 6): `bind-env` and its rollback now read
`KEYCAPE_{client_id:env}_CLIENT_SECRET`. ops-mason reports the Forgejo case
rendered and built (message `1ebddae9`; CCR drafts handed to railiance-platform),
so T06 now waits on the platform apply, the mint-secret lane and the attended
register-client session.
```task
id: NK-WP-0048-T07
status: wait