tegwick
777f8df707
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 327203@bnt-lap001 Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0
56 lines
3 KiB
Bash
Executable file
56 lines
3 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# MASON-WP-0005-T05 — operator-side proof of the fluid-telegram operator lane.
|
|
#
|
|
# ./scripts/verify-fluid-telegram-lane.sh member # sign in as a fluid-telegram-operators member (aal2)
|
|
# ./scripts/verify-fluid-telegram-lane.sh non-member # sign in as someone outside the group
|
|
#
|
|
# Logs in on the lane's OIDC role, asks OpenBao what the token may do on each
|
|
# path (sys/capabilities-self: names only, never a value), revokes the token,
|
|
# and writes a 0600 receipt. The token is held in a shell variable only: never
|
|
# printed, never stored in the token helper, so your own session is untouched.
|
|
# The login URL appears on stderr as usual; only the token goes to stdout.
|
|
set -euo pipefail
|
|
|
|
export BAO_ADDR="${BAO_ADDR:-http://127.0.0.1:18200}"
|
|
ROLE=fluid-telegram-hall-of-helix-workload-kv
|
|
BASE=platform/data/workloads/coulomb/fluid-telegram/hall-of-helix
|
|
RECEIPTS="$(getent passwd "$(id -u)" | cut -d: -f6)/.local/state/railiance/receipts"
|
|
mode="${1:-}"
|
|
case "$mode" in member|non-member) ;; *) echo "usage: $0 member|non-member" >&2; exit 2 ;; esac
|
|
|
|
umask 077
|
|
mkdir -p "$RECEIPTS"
|
|
receipt="$RECEIPTS/fluid-telegram-lane-$mode.txt"
|
|
echo "Sign in as the $mode identity in your browser (URL below). Use a private window so" >&2
|
|
echo "an existing KeyCape session (e.g. platform-root) is not reused." >&2
|
|
|
|
if ! token="$(bao login -token-only -method=oidc -path=netkingdom role="$ROLE")" || [ -z "$token" ]; then
|
|
{ echo "mode=$mode at=$(date -u +%FT%TZ)"; echo "login=refused"; } > "$receipt"
|
|
if [ "$mode" = non-member ]; then
|
|
echo "login refused, as expected for a non-member; receipt: $receipt" >&2
|
|
else
|
|
echo "login REFUSED for the member run. If the browser reused another KeyCape session" >&2
|
|
echo "(e.g. platform-root), retry in a private window signed in as a group member." >&2
|
|
fi
|
|
[ "$mode" = non-member ] && exit 0 || exit 1
|
|
fi
|
|
|
|
{
|
|
echo "mode=$mode at=$(date -u +%FT%TZ)"
|
|
echo "login=ok"
|
|
for p in \
|
|
"$BASE/operator-app" "$BASE/operator-session" "$BASE/bot-token" "$BASE/redaction-salt" \
|
|
"platform/data/workloads/coulomb/fluid-telegram/hall-of-helix" \
|
|
"platform/data/workloads/coulomb/fluid-telegram/other-campaign/bot-token" \
|
|
"platform/data/workloads/coulomb/whynot-design/npm-publish" \
|
|
"platform/metadata/workloads/coulomb/fluid-telegram/hall-of-helix/operator-session" \
|
|
"platform/data/workloads/keycape/secrets-engine-openbao" \
|
|
"sys/policies/acl/agent-high-risk-boundary"; do
|
|
echo "$p: $(BAO_TOKEN="$token" bao token capabilities "$p" 2>/dev/null || echo error)"
|
|
done
|
|
echo "policies=$(BAO_TOKEN="$token" bao token lookup -format=json 2>/dev/null | python3 -c 'import json,sys; print(",".join(json.load(sys.stdin)["data"]["policies"]))' || echo error)"
|
|
} > "$receipt"
|
|
BAO_TOKEN="$token" bao token revoke -self >/dev/null 2>&1 && echo "revoked=yes" >> "$receipt" || echo "revoked=FAILED" >> "$receipt"
|
|
unset token
|
|
echo "receipt: $receipt" >&2
|
|
[ "$mode" = member ]
|