Add named engine auth and accessor-file session revoke

Select service-jwt, bootstrap, or env exclusively: JWT login uses a JSON
file, self-revokes, and never falls back to bootstrap or BAO_TOKEN. The
platform JWT mount/role is still unpublished, so auto keeps named
bootstrap/env providers.

session revoke --accessor-file revokes an already-issued token with
fingerprint-only evidence. Production remains fail-closed.

Assistant: grok
Assistant-Session: 01a05f07-ae72-7781-9fcb-19efd61add00

tests/test_engine_auth.py

@@ -0,0 +1,157 @@
+import copy
+from types import SimpleNamespace
+
+import pytest
+import yaml
+
+from secrets_engine.catalog import validate_entry
+from secrets_engine.config import Config
+from secrets_engine.engine_auth import (
+    login_service_jwt,
+    select_engine_auth,
+)
+from secrets_engine.errors import BackendError
+from secrets_engine.openbao import OpenBaoClient
+from tests.test_catalog import VALID
+
+
+def _cfg(tmp_path, **overrides):
+    values = dict(
+        catalog_dir=tmp_path,
+        policy_dir=tmp_path,
+        evidence_dir=tmp_path / "evidence",
+        hub_url="",
+        bao_addr="http://127.0.0.1:8200",
+        topic_id="test-topic",
+    )
+    values.update(overrides)
+    return Config(**values)
+
+
+def _jwt_contract(tmp_path, issuer="https://keycape.example.test"):
+    path = tmp_path / "jwt-login.yaml"
+    path.write_text(
+        yaml.safe_dump({"mount": "jwt", "role": "secrets-engine", "bound_issuer": issuer}),
+        encoding="utf-8",
+    )
+    return path
+
+
+def test_auto_without_jwt_contract_keeps_bootstrap_and_env(tmp_path):
+    cfg = _cfg(tmp_path)
+    env = select_engine_auth(cfg, SimpleNamespace(auth="auto", bootstrap_token_file=None))
+    assert env.provider == "env"
+    boot = select_engine_auth(
+        cfg, SimpleNamespace(auth="auto", bootstrap_token_file="/tmp/bootstrap.token")
+    )
+    assert boot.provider == "bootstrap"
+    assert boot.break_glass is True
+
+
+def test_service_jwt_refuses_bootstrap_file_and_does_not_read_env(tmp_path, monkeypatch):
+    monkeypatch.setenv("BAO_TOKEN", "must-not-be-used")
+    cfg = _cfg(tmp_path, openbao_jwt_login_file=_jwt_contract(tmp_path))
+    with pytest.raises(BackendError, match="no fallback"):
+        select_engine_auth(
+            cfg,
+            SimpleNamespace(auth="auto", bootstrap_token_file="/tmp/bootstrap.token"),
+        )
+    with pytest.raises(BackendError, match="no fallback"):
+        select_engine_auth(
+            cfg,
+            SimpleNamespace(auth="service-jwt", bootstrap_token_file="/tmp/bootstrap.token"),
+        )
+    selected = select_engine_auth(
+        cfg, SimpleNamespace(auth="auto", bootstrap_token_file=None)
+    )
+    assert selected.provider == "service-jwt"
+
+
+def test_explicit_service_jwt_fails_closed_without_contract(tmp_path, monkeypatch):
+    monkeypatch.setenv("BAO_TOKEN", "must-not-be-used")
+    cfg = _cfg(tmp_path)
+    selected = select_engine_auth(
+        cfg, SimpleNamespace(auth="service-jwt", bootstrap_token_file=None)
+    )
+    assert selected.provider == "service-jwt"
+    with pytest.raises(BackendError, match="JWT mount/role contract is not published"):
+        login_service_jwt(cfg)
+
+
+def test_jwt_login_failure_does_not_fall_back_to_env(tmp_path, monkeypatch):
+    monkeypatch.setenv("BAO_TOKEN", "must-not-be-used")
+    secret = tmp_path / "client.secret"
+    secret.write_text("client-secret-value", encoding="utf-8")
+    secret.chmod(0o600)
+    cfg = _cfg(
+        tmp_path,
+        openbao_jwt_login_file=_jwt_contract(tmp_path),
+        keycape_token_url="https://keycape.example.test/token",
+        keycape_issuer="https://keycape.example.test",
+        keycape_client_secret_file=secret,
+    )
+    monkeypatch.setattr(
+        "secrets_engine.engine_auth.KeyCapeServiceAuthProvider.exchange",
+        lambda *_args, **_kwargs: (_ for _ in ()).throw(BackendError("exchange failed")),
+    )
+    resolved = []
+    monkeypatch.setattr(
+        OpenBaoClient,
+        "resolve",
+        lambda *_args, **_kwargs: resolved.append("used") or pytest.fail("fallback"),
+    )
+    with pytest.raises(BackendError, match="exchange failed"):
+        login_service_jwt(cfg)
+    assert resolved == []
+
+
+def test_login_jwt_keeps_jwt_out_of_argv_and_revokes(monkeypatch):
+    client = OpenBaoClient(addr="http://example.invalid", token="", bao_bin="bao")
+    captured = {}
+
+    def fake_json_call(args, payload):
+        captured["args"] = list(args)
+        captured["payload"] = dict(payload)
+        return '{"auth":{"client_token":"jwt-child-token","accessor":"jwt-accessor"}}'
+
+    monkeypatch.setattr(client, "_run_ok_with_json_file", fake_json_call)
+    session = client.login_jwt("jwt", "secrets-engine", "header.payload.sig")
+    assert "header.payload.sig" not in " ".join(captured["args"])
+    assert captured["payload"]["jwt"] == "header.payload.sig"
+    assert "jwt-accessor" not in session.accessor_fingerprint
+    revoke = []
+    monkeypatch.setattr(
+        session.client,
+        "_run_ok",
+        lambda args, **_kwargs: revoke.append(list(args)) or "",
+    )
+    session.close()
+    assert revoke == [["token", "revoke", "-self"]]
+    assert session.client.token == ""
+
+
+def test_provision_jwt_auth_never_reaches_openbao_on_missing_contract(
+    tmp_path, monkeypatch
+):
+    from secrets_engine import cli
+
+    entry = validate_entry(copy.deepcopy(VALID))
+    monkeypatch.setattr(cli, "get_entry", lambda *_args: entry)
+    monkeypatch.setattr(cli, "_require_lane_approval", lambda *_args, **_kwargs: None)
+    monkeypatch.setattr(
+        cli.OpenBaoClient,
+        "resolve",
+        lambda *_args, **_kwargs: pytest.fail("backend must not be reached"),
+    )
+    args = SimpleNamespace(
+        catalog_id=entry.id,
+        stage=entry.stage,
+        field="api_token",
+        generate=False,
+        from_file="/tmp/test-value-file",
+        bootstrap_token_file=None,
+        auth="service-jwt",
+    )
+    cfg = _cfg(tmp_path)
+    with pytest.raises(BackendError, match="JWT mount/role contract is not published"):
+        cli.cmd_provision(cfg, args)

tests/test_layer_conformance.py

@@ -171,11 +171,13 @@ def test_classify_does_not_grant_permission():
     destroy = classify("lifecycle-destroy", "build")
     apply_prod = classify("apply", "prod")
     heartbeat = classify("evidence-heartbeat", "prod")
+    session_revoke = classify("session-revoke", "prod")
     assert prod_provision.kind == "load-bearing"
     assert test_provision.kind == "attributive"
     assert destroy.kind == "load-bearing"
     assert apply_prod.kind == "attributive"
     assert heartbeat.kind == "heartbeat"
+    assert session_revoke.kind == "load-bearing"
     assert prod_provision.completeness_claimed is False
     assert CLASSIFICATION.exists()
 

tests/test_session_revoke.py

@@ -0,0 +1,104 @@
+import json
+from types import SimpleNamespace
+
+import pytest
+
+from secrets_engine import cli
+from secrets_engine.config import Config
+from secrets_engine.errors import BackendError, DecisionError
+from secrets_engine.openbao import OpenBaoClient, accessor_fingerprint
+
+
+ACCESSOR = "test-known-accessor-value"
+
+
+def _config(tmp_path):
+    return Config(
+        catalog_dir=tmp_path,
+        policy_dir=tmp_path,
+        evidence_dir=tmp_path / "evidence",
+        hub_url="",
+        bao_addr="http://127.0.0.1:8200",
+        topic_id="test-topic",
+    )
+
+
+def _accessor_file(tmp_path, value=ACCESSOR, mode=0o600):
+    path = tmp_path / "accessor.handle"
+    path.write_text(value, encoding="utf-8")
+    path.chmod(mode)
+    return path
+
+
+def test_session_revoke_uses_fingerprint_only(tmp_path, monkeypatch):
+    seen = {}
+
+    class _Client:
+        def revoke_accessor(self, accessor):
+            seen["accessor"] = accessor
+
+    monkeypatch.setattr(
+        cli, "_open_backend", lambda *_args, **_kwargs: _ctx(_Client())
+    )
+    args = SimpleNamespace(
+        accessor_file=str(_accessor_file(tmp_path)),
+        stage="test",
+        bootstrap_token_file=None,
+        auth="auto",
+    )
+    rc = cli.cmd_session_revoke(_config(tmp_path), args)
+    assert rc == 0
+    assert seen["accessor"] == ACCESSOR
+    records = [
+        json.loads(line)
+        for line in next((tmp_path / "evidence").glob("evidence-*.jsonl")).read_text().splitlines()
+    ]
+    dumped = json.dumps(records)
+    assert ACCESSOR not in dumped
+    assert records[-1]["detail"]["session_handle"] == accessor_fingerprint(ACCESSOR)
+    assert records[-1]["result"] == "revoked"
+
+
+class _ctx:
+    def __init__(self, client):
+        self.client = client
+
+    def __enter__(self):
+        return self.client
+
+    def __exit__(self, *_args):
+        return False
+
+
+def test_session_revoke_production_fails_closed_before_backend(tmp_path, monkeypatch):
+    monkeypatch.delenv("SECRETS_ENGINE_UNSAFE_DEMO", raising=False)
+    monkeypatch.setattr(
+        cli.OpenBaoClient,
+        "resolve",
+        lambda *_args, **_kwargs: pytest.fail("backend must not be reached"),
+    )
+    args = SimpleNamespace(
+        accessor_file=str(_accessor_file(tmp_path)),
+        stage="prod",
+        bootstrap_token_file=None,
+        auth="auto",
+    )
+    cfg = Config(
+        catalog_dir=tmp_path,
+        policy_dir=tmp_path,
+        evidence_dir=tmp_path / "evidence",
+        hub_url="http://127.0.0.1:8000",
+        bao_addr="http://127.0.0.1:8200",
+        topic_id="test-topic",
+    )
+    with pytest.raises(DecisionError, match="production action 'session-revoke'"):
+        cli.cmd_session_revoke(cfg, args)
+
+
+def test_revoke_accessor_rejects_blank(monkeypatch):
+    client = OpenBaoClient(addr="http://example.invalid", token="t", bao_bin="bao")
+    monkeypatch.setattr(
+        client, "_run_ok", lambda *_args, **_kwargs: pytest.fail("must not call bao")
+    )
+    with pytest.raises(BackendError, match="missing or invalid"):
+        client.revoke_accessor(" ")