coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Broker audit-core dynamic database credentials
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source
This commit is contained in:
codex 2026-08-10 19:36:30 +02:00
parent d140e829eb
commit 9f6bdffec4
5 changed files with 245 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

14
scripts/credential-grants-validate.py
View file

@ -29,7 +29,7 @@ REQUIRED_DENIED_MODES = {
"llm-prompt",
}
ALLOWED_CREDENTIAL_TYPES = {"openbao-token"}
ALLOWED_CREDENTIAL_TYPES = {"openbao-token", "openbao-database-credential"}
ALLOWED_GRANT_CLASSES = {"self-service", "approval-required", "break-glass"}
ALLOWED_GRANT_STATUSES = {"pilot", "active", "deprecated", "disabled"}
DISALLOWED_POLICIES = {"root", "platform-admin"}
@ -151,6 +151,16 @@ def validate_grant(
)
require_list(openbao.get("mount_paths"), f"{prefix}.openbao.mount_paths", errors)
if credential_type == "openbao-database-credential":
database = require_dict(grant_obj.get("database"), f"{prefix}.database", errors)
require_nonempty_string(database.get("role"), f"{prefix}.database.role", errors)
require_nonempty_string(database.get("host"), f"{prefix}.database.host", errors)
require_nonempty_string(database.get("name"), f"{prefix}.database.name", errors)
env = require_dict(database.get("env"), f"{prefix}.database.env", errors)
required_fields = {"username", "password", "host", "port", "database"}
if set(env.values()) != required_fields:
errors.append(f"{prefix}.database.env must map exactly {sorted(required_fields)}")
ttl = require_dict(grant_obj.get("ttl"), f"{prefix}.ttl", errors)
default_ttl = ttl_seconds(ttl.get("default"), f"{prefix}.ttl.default", errors)
max_ttl = ttl_seconds(ttl.get("max"), f"{prefix}.ttl.max", errors)
@ -228,6 +238,8 @@ def validate_grant(
)
if preferred and preferred not in allowed:
errors.append(f"{prefix}.delivery.preferred must be in delivery.allowed")
if credential_type == "openbao-database-credential" and allowed != {"exec-env"}:
errors.append(f"{prefix}.delivery.allowed must be exec-env only for database credentials")
if "local-token-file" in allowed:
local_file = require_dict(
delivery.get("local_token_file"),