0b2e7ddb5f
Package the reviewed keycape-services JWT mount, secrets-engine-openbao role and secrets-engine-login-self policy as CCR-2026-0038 and teach the delegated applier a narrow service-jwt-login request type: fixed mount, generated login-self policy, allow-listed role/config keys, bounded TTL/uses, refusal on a foreign mount type and a value-free readback compare. The policy now denies the client-secret data/metadata paths explicitly (MASON-WP-0009 invariant ii). Proposed only; founder approval and delegated apply pending. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 327203@bnt-lap001 Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0
32 lines
2.1 KiB
Python
32 lines
2.1 KiB
Python
"""Source safety bounds; live JWT verification remains attended acceptance."""
|
|
import json
|
|
import re
|
|
import unittest
|
|
from pathlib import Path
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
|
|
class ServiceJWTContract(unittest.TestCase):
|
|
def test_platform_identity_is_exact_and_cannot_be_an_applier(self):
|
|
role = json.loads((ROOT / "openbao/auth/secrets-engine-jwt-role.json").read_text())
|
|
self.assertEqual(role["bound_audiences"], ["secrets-engine-openbao"])
|
|
self.assertEqual(role["bound_subject"], "service:secrets-engine")
|
|
self.assertEqual(role["bound_claims"], dict(principal_type="service", tenant="tenant:platform", roles="secrets-engine", scope="openbao:login"))
|
|
self.assertEqual(role["bound_claims_type"], "string")
|
|
self.assertEqual(role["token_policies"], ["secrets-engine-login-self"])
|
|
self.assertTrue(role["token_no_default_policy"])
|
|
self.assertFalse(role["verbose_oidc_logging"])
|
|
self.assertEqual(role["token_type"], "service")
|
|
self.assertEqual(role["token_num_uses"], 8)
|
|
for key in ("token_ttl", "token_max_ttl", "token_explicit_max_ttl"):
|
|
self.assertEqual(role[key], "5m")
|
|
self.assertNotIn("token_period", role)
|
|
|
|
def test_only_self_endpoints_and_pinned_signature_verifier(self):
|
|
policy = (ROOT / "openbao/policies/secrets-engine-login-self.hcl").read_text()
|
|
grants = re.findall(r'path "([^"]+)"\s*{\s*capabilities = \["([^"]+)"\]', policy)
|
|
self.assertEqual(grants, [("auth/token/lookup-self", "read"), ("sys/capabilities-self", "update"), ("auth/token/revoke-self", "update"),
|
|
("platform/data/workloads/keycape/secrets-engine-openbao", "deny"),
|
|
("platform/metadata/workloads/keycape/secrets-engine-openbao", "deny")])
|
|
self.assertNotIn("*", policy)
|
|
config = json.loads((ROOT / "openbao/auth/keycape-services-config.json").read_text())
|
|
self.assertEqual(config, dict(jwks_url="https://kc.coulomb.social/jwks", bound_issuer="https://kc.coulomb.social", jwt_supported_algs=["RS256"]))
|