0f0282a436
credential-change.py generates sys/capabilities-self (update) when openbao.token_capabilities_self is true. Proposed CCR-2026-0045 sets it for workload-kv-read-reuse-surface-runtime so the ops-mason proof stops calling sys/capabilities with a root token. The OpenBao login page keeps its platform-admin button and adds an allow-listed workload role choice. Repo only; nothing applied to OpenBao or the cluster. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 1041694@bnt-lap001 Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52
122 lines
2 KiB
CSS
122 lines
2 KiB
CSS
:root {
|
|
color-scheme: light;
|
|
--bg: #f0f2f5;
|
|
--card: #ffffff;
|
|
--text: #1f2a37;
|
|
--muted: #5b6b7c;
|
|
--border: #d9dee3;
|
|
--accent: #1565c0;
|
|
--accent-hover: #0d47a1;
|
|
}
|
|
|
|
* {
|
|
box-sizing: border-box;
|
|
}
|
|
|
|
body {
|
|
margin: 0;
|
|
min-height: 100vh;
|
|
font-family: system-ui, -apple-system, "Segoe UI", Roboto, sans-serif;
|
|
background: var(--bg);
|
|
color: var(--text);
|
|
display: flex;
|
|
align-items: center;
|
|
justify-content: center;
|
|
padding: 1.5rem;
|
|
}
|
|
|
|
.login-card {
|
|
width: min(100%, 26rem);
|
|
background: var(--card);
|
|
border: 1px solid var(--border);
|
|
border-radius: 8px;
|
|
box-shadow: 0 8px 24px rgba(16, 24, 40, 0.08);
|
|
padding: 2rem 1.75rem 1.75rem;
|
|
}
|
|
|
|
.login-card h1 {
|
|
margin: 0 0 0.75rem;
|
|
font-size: 1.45rem;
|
|
font-weight: 600;
|
|
line-height: 1.3;
|
|
}
|
|
|
|
.login-card p {
|
|
margin: 0 0 1.5rem;
|
|
color: var(--muted);
|
|
font-size: 0.9rem;
|
|
line-height: 1.45;
|
|
}
|
|
|
|
.login-button {
|
|
width: 100%;
|
|
border: 0;
|
|
border-radius: 6px;
|
|
padding: 0.8rem 1rem;
|
|
font-size: 0.95rem;
|
|
font-weight: 600;
|
|
color: #fff;
|
|
background: var(--accent);
|
|
cursor: pointer;
|
|
}
|
|
|
|
.login-button:hover:not(:disabled) {
|
|
background: var(--accent-hover);
|
|
}
|
|
|
|
.login-button:disabled {
|
|
opacity: 0.7;
|
|
cursor: wait;
|
|
}
|
|
|
|
.login-error {
|
|
display: none;
|
|
margin-top: 1rem;
|
|
padding: 0.75rem 0.9rem;
|
|
border-radius: 6px;
|
|
background: #fdecea;
|
|
color: #8a1c13;
|
|
font-size: 0.85rem;
|
|
line-height: 1.4;
|
|
}
|
|
|
|
.login-error.is-visible {
|
|
display: block;
|
|
}
|
|
.login-workload {
|
|
margin-top: 1.25rem;
|
|
border-top: 1px solid var(--border);
|
|
padding-top: 1rem;
|
|
font-size: 0.9rem;
|
|
}
|
|
|
|
.login-workload summary {
|
|
cursor: pointer;
|
|
color: var(--accent);
|
|
font-weight: 600;
|
|
}
|
|
|
|
.login-workload p {
|
|
margin: 0.75rem 0;
|
|
}
|
|
|
|
.login-workload label {
|
|
display: block;
|
|
margin-bottom: 0.35rem;
|
|
color: var(--muted);
|
|
}
|
|
|
|
.login-workload select {
|
|
width: 100%;
|
|
padding: 0.55rem 0.6rem;
|
|
margin-bottom: 0.9rem;
|
|
border: 1px solid var(--border);
|
|
border-radius: 6px;
|
|
font: inherit;
|
|
background: var(--card);
|
|
color: var(--text);
|
|
}
|
|
|
|
.login-button-secondary {
|
|
background: var(--muted);
|
|
}
|