Advance blocked assurance and operator callback work

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883

scripts/openbao_operator_loopback_callback.py

@@ -0,0 +1,49 @@
+#!/usr/bin/env python3
+"""Silent contained callback update; preserve the existing administrator role."""
+import json
+import subprocess
+import sys
+
+ROLE = 'auth/netkingdom/role/platform-admin'
+CALLBACK = 'http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback'
+
+
+def read_role():
+    result = subprocess.run(['bao', 'read', '-format=json', ROLE],
+                            capture_output=True, check=True, timeout=30)
+    role = json.loads(result.stdout)['data']
+    if (role.get('role_type') != 'oidc'
+            or 'platform-admin' not in role.get('token_policies', role.get('policies', []))
+            or not isinstance(role.get('allowed_redirect_uris'), list)
+            or not all(isinstance(uri, str) for uri in role['allowed_redirect_uris'])):
+        raise ValueError('unexpected role')
+    return role
+
+
+def update(read=read_role, write=None):
+    original = read()
+    if CALLBACK in original['allowed_redirect_uris']:
+        return False
+    desired = dict(original, allowed_redirect_uris=original['allowed_redirect_uris'] + [CALLBACK])
+    if read() != original:
+        raise ValueError('role changed before write')
+    # The endpoint has no CAS: this detects observed drift, not an atomic lock.
+    if write is None:
+        subprocess.run(['bao', 'write', ROLE, '-'], input=json.dumps(desired).encode(),
+                       capture_output=True, check=True, timeout=30)
+    else:
+        write(desired)
+    if read() != desired:
+        raise ValueError('role readback differs')
+    return True
+
+
+if __name__ == '__main__':
+    try:
+        if sys.argv[1:] == ['--check-only']:
+            sys.exit(0 if CALLBACK in read_role()['allowed_redirect_uris'] else 3)
+        if sys.argv[1:]:
+            sys.exit(2)
+        update()
+    except Exception:
+        sys.exit(1)