coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

Refuse explicit policy authentication and binding denials before side effects
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
tegwick 2026-09-08 16:46:00 +02:00
parent 11e5e8be0f
commit 31d9b6671c
5 changed files with 151 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

11
src/warden/policy.py
View file

@ -131,6 +131,12 @@ def check_sign_policy(cfg: PolicyConfig, spec: CertSpec) -> str | None:
response = httpx.post(url, json=request, headers=headers, timeout=10.0)
response.raise_for_status()
except httpx.HTTPStatusError as e:
if e.response.status_code in {401, 403}:
spec.policy_outcome = "deny"
raise CAError(
f"flex-auth refused sign policy check (HTTP {e.response.status_code}); "
"caller authentication or system binding was rejected"
) from e
_evaluator_failure(
f"flex-auth rejected sign policy check (HTTP {e.response.status_code}) "
f"for security zone {zone!r}",
@ -213,6 +219,11 @@ def check_fetch_policy(
response = httpx.post(url, json=request, headers=headers, timeout=10.0)
response.raise_for_status()
except httpx.HTTPStatusError as e:
if e.response.status_code in {401, 403}:
raise CAError(
f"flex-auth refused fetch policy check (HTTP {e.response.status_code}); "
"caller authentication or system binding was rejected"
) from e
_evaluator_failure(
f"flex-auth rejected fetch policy check (HTTP {e.response.status_code})",
fail_closed=fail_closed,