Harden secret provisioning and lifecycle controls

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0217e-8c4c-7383-be6b-f50a6e485306

src/secrets_engine/verify.py

@@ -27,6 +27,16 @@ class VerifyResult:
         return f"  {self.check} check: {status}  ({self.detail.get('reason', '')})"
 
 
+def _session_evidence(session: object | None) -> dict[str, Any]:
+    """Extract only the session's explicit non-secret lifecycle record."""
+    if session is None:
+        return {"established": False}
+    evidence = getattr(session, "evidence", None)
+    if callable(evidence):
+        return evidence()
+    return {"established": True}
+
+
 def verify_positive(client: OpenBaoClient, entry: CatalogEntry, field: str) -> VerifyResult:
     """Approved consumer token must be able to read the field."""
     if entry.delivery_auth_method != "approle" or not entry.has_delivery_auth:
@@ -35,15 +45,20 @@ def verify_positive(client: OpenBaoClient, entry: CatalogEntry, field: str) -> V
             False,
             {"reason": "lane has no AppRole delivery auth", "path": entry.path},
         )
+    session = None
     try:
-        token = client.approle_login_token(entry.role_name)
+        with client.approle_session(entry.role_name) as session:
+            present = session.client.kv_field_present(entry.mount, entry.path, field)
     except Exception as e:  # backend errors -> failed verification, not a value leak
         return VerifyResult(
             "positive",
             False,
-            {"reason": f"could not obtain approle token: {e}", "path": entry.path},
+            {
+                "reason": f"scoped verification session failed: {e}",
+                "path": entry.path,
+                "session": _session_evidence(session),
+            },
         )
-    present = client.kv_field_present(entry.mount, entry.path, field, token=token)
     return VerifyResult(
         "positive",
         present,
@@ -54,6 +69,7 @@ def verify_positive(client: OpenBaoClient, entry: CatalogEntry, field: str) -> V
             "path": entry.path,
             "field": field,
             "role": entry.role_name,
+            "session": _session_evidence(session),
         },
     )
 
@@ -76,26 +92,26 @@ def verify_negative(client: OpenBaoClient, entry: CatalogEntry) -> VerifyResult:
 
 def verify_auth_capability_positive(client: OpenBaoClient, entry: CatalogEntry) -> VerifyResult:
     """Approved AppRole token must carry update on every exact allowed path."""
+    missing: list[str] = []
+    session = None
     try:
-        token = client.approle_login_token(entry.role_name)
+        with client.approle_session(entry.role_name) as session:
+            for path in entry.auth_allowed_paths:
+                caps = session.client.token_capabilities(
+                    path, token=session.client.token
+                )
+                if "update" not in caps:
+                    missing.append(path)
     except Exception as e:
         return VerifyResult(
             "positive",
             False,
-            {"reason": f"could not obtain approle token: {e}", "role": entry.role_name},
+            {
+                "reason": f"scoped verification session failed: {e}",
+                "role": entry.role_name,
+                "session": _session_evidence(session),
+            },
         )
-    missing: list[str] = []
-    for path in entry.auth_allowed_paths:
-        try:
-            caps = client.token_capabilities(path, token=token)
-        except Exception as e:
-            return VerifyResult(
-                "positive",
-                False,
-                {"reason": f"could not inspect capabilities: {e}", "path": path},
-            )
-        if "update" not in caps:
-            missing.append(path)
     passed = not missing
     return VerifyResult(
         "positive",
@@ -107,32 +123,33 @@ def verify_auth_capability_positive(client: OpenBaoClient, entry: CatalogEntry)
             "role": entry.role_name,
             "allowed_paths": sorted(entry.auth_allowed_paths),
             "missing_update": missing,
+            "session": _session_evidence(session),
         },
     )
 
 
 def verify_auth_capability_negative(client: OpenBaoClient, entry: CatalogEntry) -> VerifyResult:
     """Approved AppRole token must not gain update outside denial probes."""
+    leaks: list[str] = []
+    session = None
     try:
-        token = client.approle_login_token(entry.role_name)
+        with client.approle_session(entry.role_name) as session:
+            for path in entry.auth_denied_probe_paths:
+                caps = session.client.token_capabilities(
+                    path, token=session.client.token
+                )
+                if "update" in caps or "sudo" in caps or "root" in caps:
+                    leaks.append(path)
     except Exception as e:
         return VerifyResult(
             "negative",
             False,
-            {"reason": f"could not obtain approle token: {e}", "role": entry.role_name},
+            {
+                "reason": f"scoped verification session failed: {e}",
+                "role": entry.role_name,
+                "session": _session_evidence(session),
+            },
         )
-    leaks: list[str] = []
-    for path in entry.auth_denied_probe_paths:
-        try:
-            caps = client.token_capabilities(path, token=token)
-        except Exception as e:
-            return VerifyResult(
-                "negative",
-                False,
-                {"reason": f"could not inspect capabilities: {e}", "path": path},
-            )
-        if "update" in caps or "sudo" in caps or "root" in caps:
-            leaks.append(path)
     passed = not leaks
     return VerifyResult(
         "negative",
@@ -144,6 +161,7 @@ def verify_auth_capability_negative(client: OpenBaoClient, entry: CatalogEntry)
             "role": entry.role_name,
             "denied_probe_paths": entry.auth_denied_probe_paths,
             "leaks": leaks,
+            "session": _session_evidence(session),
         },
     )