Adds a lane: secret|login field to RouteEntry. The login lane is an interactive auth bootstrap: it skips the caller-auth precheck (no token yet — that's the point) and the secret-read gate (it establishes the identity the gate needs), runs the owner's login command interactively as the caller via inherited stdio, and rejects --exec. The token stays in the caller's own store; warden never captures it (G2 holds). Audited as action: login. key-cape-oidc-login populated as the reference login entry. Advisory proxy hint updated now that T3 has shipped. 172 passed, lint clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| __init__.py | ||
| test_access.py | ||
| test_ca.py | ||
| test_cli.py | ||
| test_config.py | ||
| test_flex_auth_registry.py | ||
| test_integration.py | ||
| test_inventory.py | ||
| test_models.py | ||
| test_policy.py | ||
| test_principals_drift.py | ||
| test_proxy.py | ||
| test_routing.py | ||
| test_scorecard.py | ||
| test_vault.py | ||