schema_version: 1
kind: credential-change-request-schema
description: Non-secret schema contract for credential/security change requests.

required_top_level:
  - id
  - kind
  - schema_version
  - request_type
  - title
  - status
  - created
  - updated
  - requester
  - target
  - openbao
  - access_frontdoor
  - risk
  - verification
  - lifecycle

allowed_statuses:
  - draft
  - in_flight
  - proposed
  - needs_changes
  - approved
  - denied
  - apply_pending
  - applied
  - verified
  - active
  - deactivated
  - rotated
  - compromised
  - superseded
  - cancelled

allowed_request_types:
  - workload-kv-read

secret_markers_rejected:
  - AGE-SECRET-KEY-1
  - "-----BEGIN PRIVATE KEY-----"
  - "-----BEGIN OPENSSH PRIVATE KEY-----"
  - OPENBAO_ROOT_TOKEN=
  - VAULT_TOKEN=
  - BAO_TOKEN=
  - hvb.
  - hvc.
  - hvs.
  - npm_
  - ghp_
  - sk-

# Optional. Set when this CCR is the runtime bind for a rapp (RAILIANCE-WP-0015-T06).
# target.rapp is a rapp-* slug. It does not replace target.workload.
optional_target_fields:
  - rapp

workload_kv_read:
  required:
    openbao:
      - mount
      - kv_path
      - fields
      - policy_name
      - policy_file
      - auth
    openbao.auth:
      - method
      - policies
    access_frontdoor:
      - type
      - catalog_id
      - readiness
      - resolvable
    verification:
      - positive
      - negative
      - activation_conditions
    lifecycle:
      - deactivate
      - rotate
      - compromised
  conditional:
    status=in_flight:
      required:
        - in_flight.missing_fields
        - in_flight.blocking_reason
        - in_flight.owner
      allowed_missing_fields:
        - openbao.policy_file
        - openbao.auth
    openbao.auth.method=token:
      required:
        - openbao.eso_policy_name
        - openbao.eso_policy_file
        - openbao.auth.token_secret
        - openbao.auth.bootstrap_script
        - openbao.auth.ttl
        - openbao.auth.kubernetes_followup
      note: Transitional ESO token auth; delegated applier does not create the token.
    openbao.auth.method=kubernetes:
      required:
        - mount
        - role
        - bound_claims
        - bound_claims_confirmed
    openbao.auth.method=oidc:
      required:
        - mount
        - role
        - bound_claims
        - bound_claims_confirmed
        - allowed_redirect_uris
      allowed_redirect_uris: non-empty list of OpenBao callback URIs accepted by the role
      groups_claim: requires openbao.auth.oidc_scopes to include groups

access_frontdoor_readiness:
  allowed:
    - template
    - pending-review
    - approved-pending-apply
    - applied-pending-verify
    - ready
    - disabled
    - compromised
  resolvable_true_requires_status: active
  ops_warden_should_consume_only:
    readiness: ready
    resolvable: true

guardrails:
  apply_plan_requires_status:
    - approved
  active_requires_status:
    - verified
  disallowed_policy_names:
    - root
    - platform-admin
  disallowed_path_fragments:
    - "*"
    - ".."
