coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Send organization_id when the MAS gate lists the application's API keys.

Browse source 
The attended mint run on 2026-11-03 got HTTP 400 from the key listing before
any key was minted. A Console session needs organization_id there.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4541@bnt-lap001
Assistant-Session: 2099b3aa-d7d9-49a9-ab4e-fa8b7d0e39e8
This commit is contained in:
codex 2026-11-03 05:36:45 +01:00
parent fbc4830aa0
commit de13931c75
3 changed files with 24 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

22
scripts/mas_evidence_publisher_gate.py
View file

@ -671,11 +671,16 @@ def write_pair(pair):
return summary
def _app_keys(api):
value = api(
"GET",
"/iam/v1alpha1/api-keys?application_id=" + APPLICATION_ID + "&page_size=100",
)
def _app_keys(api, organization):
"""List the application's keys. A Console session needs organization_id or gets HTTP 400."""
from urllib.parse import urlencode
query = urlencode({
"organization_id": organization,
"application_id": APPLICATION_ID,
"page_size": 100,
})
value = api("GET", "/iam/v1alpha1/api-keys?" + query)
keys = value.get("api_keys") if isinstance(value, dict) else None
if not isinstance(keys, list) or value.get("total_count") != len(keys):
raise GateError("key_inventory_rejected")
@ -699,9 +704,10 @@ def mint_workload_pair(api, prove, write, sleep=time.sleep):
"""
receipt = {"application_id": APPLICATION_ID, "values_recorded": False}
app = api("GET", "/iam/v1alpha1/applications/" + APPLICATION_ID)
if app.get("name") != POLICY_NAME:
organization = app.get("organization_id")
if app.get("name") != POLICY_NAME or not isinstance(organization, str) or not organization:
raise GateError("application_binding_refused")
before = _app_keys(api)
before = _app_keys(api, organization)
receipt["keys_before"] = _key_view(before)
if len(before) != 1 or before[0].get("default_project_id") != PROJECT_ID:
raise GateError("supplier_key_state_requires_review", receipt["keys_before"])
@ -745,7 +751,7 @@ def mint_workload_pair(api, prove, write, sleep=time.sleep):
detail = dict(exc.detail or {}) if isinstance(exc, GateError) and isinstance(exc.detail, dict) else {}
detail["minted_key_deleted"] = deleted
raise GateError(code, detail) from None
receipt["keys_after"] = _key_view(_app_keys(api))
receipt["keys_after"] = _key_view(_app_keys(api, organization))
receipt["status"] = "passed"
return receipt