coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Harden secret provisioning and lifecycle controls
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0217e-8c4c-7383-be6b-f50a6e485306
This commit is contained in:
tegwick 2026-08-23 12:05:58 +02:00
parent 0617923ff1
commit 3a1bd4f1c8
23 changed files with 1369 additions and 162 deletions
Download patch file Download diff file Expand all files Collapse all files

17
src/secrets_engine/routing.py
View file

@ -27,6 +27,7 @@ class RouteResult:
review_url: str
metadata_applied: bool
value_present: bool
missing_fields: list[str]
ready: bool
next_command: str
missing: str
@ -59,16 +60,17 @@ def route_lane(
metadata_applied = False
value_present = False
missing_fields: list[str] = list(entry.fields) if entry.stores_kv_value() else []
if client is not None and client.is_reachable():
if entry.has_delivery_auth:
policy_applied = client.read_policy(entry.policy_name) is not None
role_applied = client.approle_exists(entry.role_name)
metadata_applied = policy_applied and role_applied
if entry.stores_kv_value():
# Presence check uses the engine's own token; reports boolean only.
field = entry.fields[0] if entry.fields else ""
if field:
value_present = client.kv_field_present(entry.mount, entry.path, field)
# One read produces booleans only; readiness requires every field.
presence = client.kv_fields_present(entry.mount, entry.path, entry.fields)
missing_fields = [field for field in entry.fields if not presence.get(field)]
value_present = bool(entry.fields) and not missing_fields
else:
# Auth-capability lanes have no stored value; a fresh secret_id is minted
# on demand through the handoff command once metadata exists.
@ -99,10 +101,12 @@ def route_lane(
"--role-id-file <path> --secret-id-file <path>"
)
elif not value_present:
missing = "provisioned secret value"
names = ", ".join(missing_fields)
missing = f"provisioned secret fields: {names}"
next_field = missing_fields[0] if missing_fields else entry.fields[0]
next_command = (
f"secrets-engine provision {entry.id} --stage {entry.stage} "
f"--field {entry.fields[0]} --from-file <path>"
f"--field {next_field} --from-file <path>"
)
else:
missing = ""
@ -123,6 +127,7 @@ def route_lane(
review_url=review_url,
metadata_applied=metadata_applied,
value_present=value_present,
missing_fields=missing_fields,
ready=ready,
next_command=next_command,
missing=missing,