coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

correct exact source case-type pin

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
codex 2026-10-11 18:46:21 +02:00
parent 93ac156adf
commit 62bbdee811
3 changed files with 53 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

6
scripts/keycape_client_secret_generate.py
View file

@ -16,7 +16,7 @@ Steps (every one fails closed):
the broker issuer policy for this grant.
2. Re-derive the case reference from ``--case-file`` (sha256 over its exact
bytes) and require: it equals ``--case-ref``; type
``oidc-browser-relying-party@1.0``; status ``materialized``; client_type
``oidc-browser-relying-party@1.1``; status ``materialized``; client_type
``confidential``; ``parameters.client_id`` equals ``--client-id``, which
matches the type's pattern and is not a reserved entry.
3. Mint a 5-minute grant token through token role
@ -57,8 +57,8 @@ ISSUER_POLICY = 'credential-broker-keycape-client-secret-generate-issuer'
PREFIX = 'workloads/keycape'
RESERVED = {'secrets-engine-openbao'}
FIELD = 'CLIENT_SECRET'
CASE_TYPE = 'oidc-browser-relying-party@1.0'
# oidc-browser-relying-party@1.0 parameter client_id.
CASE_TYPE = 'oidc-browser-relying-party@1.1'
# oidc-browser-relying-party@1.1 parameter client_id.
CLIENT_ID_RE = re.compile(r'^[a-z0-9][a-z0-9-]{1,62}$')
CASE_REF_RE = re.compile(r'^[a-z0-9][a-z0-9-]*@sha256:[0-9a-f]{64}$')
# 48 random bytes -> 64 URL-safe characters, confirmed by key-cape 2026-10-10