coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0048: adopt {client_id:env} in bind-env and its rollback (1.0 patch)

Browse source 
ops-warden's case planner renders the spec since 23ba584.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 736651@bnt-lap001
Assistant-Session: f6189624-fd64-4109-b53e-f8a59ca8a2d8
This commit is contained in:
tegwick 2026-10-10 10:28:00 +02:00
parent 850907a987
commit 9a9b8e373a
3 changed files with 12 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

8
security-case-types/oidc-browser-relying-party/tests/test_oidc_browser_relying_party.py
View file

@ -175,13 +175,9 @@ def test_forgejo_reference_case_is_accepted_and_matches_the_example():
def test_env_format_spec_renders_the_keycape_env_name():
# {client_id:env} gives the name keycape-client.py derives (env_name): upper
# case, '-' as '_'. The type adopts it once ops-warden's planner renders it
# too (ops-warden message 06303d1d); until then it keeps the literal form.
# case, '-' as '_'. Adopted in 1.0 once ops-warden's planner rendered it too
# (ops-warden 23ba584, message c1df14b7).
t = as_implemented()
for item in t["spec"]["follow_through"] + t["spec"]["rollback"]:
for key in ("entry_point", "action"):
if key in item:
item[key] = item[key].replace("KEYCAPE_<CLIENT_ID>_CLIENT_SECRET", "KEYCAPE_{client_id:env}_CLIENT_SECRET")
assert msgs(v.validate_type(t)) == []
issues, r = v.render_case(with_params(FORGEJO, client_id="my-forge"), t, DECLS)
assert msgs(issues) == []

4
security-case-types/oidc-browser-relying-party/type.yaml
View file

@ -190,7 +190,7 @@ spec:
- id: bind-env
owner: net-kingdom
when: "client_type == confidential"
entry_point: "patch Deployment sso/keycape: env KEYCAPE_<CLIENT_ID>_CLIENT_SECRET from sso/keycape-{client_id}-client"
entry_point: "patch Deployment sso/keycape: env KEYCAPE_{client_id:env}_CLIENT_SECRET from sso/keycape-{client_id}-client"
auth: "operator kube credentials for namespace sso"
lane: key-cape-oidc-login
warden_executes: false
@ -264,7 +264,7 @@ spec:
action: "keycape-client.py apply --operation remove for {client_id}"
- reverses: bind-env
when: "client_type == confidential"
action: "remove env KEYCAPE_<CLIENT_ID>_CLIENT_SECRET from Deployment sso/keycape, after register-client is reversed"
action: "remove env KEYCAPE_{client_id:env}_CLIENT_SECRET from Deployment sso/keycape, after register-client is reversed"
- reverses: deliver-secret
when: "client_type == confidential"
action: "delete ExternalSecret sso/keycape-{client_id}-client and its target"