coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: exclude correlation fields from the flex-auth request digest
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Verified the digest join against flex-auth's T03 replay fixtures and found
request_digest was hashing fields docs/canonical-request-digest.md excludes.
The material is tenant, subject, action, resource, context only: id is
correlation, policy_version lives in provenance, caring_context is hashed
separately. This engine included all three when present.

Because the join adopts the served request id, every real production request
would have carried one, so the computed digest would have matched no issued
decision and failed closed against every correct allow. Same unsatisfiable
shape as the removed AUTHORITY constant.

The old pinned constant was computed with the id inside the material, so it
was wrong and its passing proved nothing. Replaced with fixture-driven tests
over two real envelopes (vendored with provenance) plus a structural test
that correlation fields do not move the digest. Both fixtures are needed:
input_claim_digests.context appears only with a non-empty context.

Also stops computing the native claim digest. The claim's binding.action and
binding.target speak approval-engine's vocabulary while ours speaks the
catalog's, and no mapping is published; flex-auth makes no cross-check and
states the correspondence is ours via pdp_digest. A claim recording no
pdp_digest now fails closed naming the missing mapping rather than comparing
two different languages. That mapping is a prerequisite for destroy.

274 tests pass. Production still fails closed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M65ovP3eiiPHubibvWs9mD

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 393550@bnt-lap001
Assistant-Session: 4bb359f9-1f12-4410-9e76-079cf23c82e4
This commit is contained in:
tegwick 2026-09-06 14:17:38 +02:00
parent 083bee7333
commit 6e9c15228c
11 changed files with 562 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

21
tests/test_action_authorization.py
View file

@ -77,7 +77,15 @@ def _validate(envelope, expected=None):
)
def test_digest_matches_flex_auth_contract_example():
def test_digest_is_stable_and_ignores_correlation_fields():
"""The pinned digest contract now lives in tests/test_decision_replay.py.
That file verifies against two real DecisionEnvelopes issued by the
published package. The constant previously pinned here was computed with
the request `id` inside the hashed material, which
docs/canonical-request-digest.md excludes -- it matched no issued decision.
Kept here: the structural property, checked without a hand-maintained pin.
"""
request = {
"id": "check:secrets-engine-destroy-example",
"subject": {"id": "user:alice", "type": "Human"},
@ -95,12 +103,11 @@ def test_digest_matches_flex_auth_contract_example():
},
"context": {"purpose": "contract-test"},
}
# Generated independently with flex-auth's Go api.CheckRequest and
# encoding/json. The action_authorization.json example carried a stale
# digest when this consumer contract was implemented.
assert request_digest(request) == (
"sha256:73d5d7d5b3363f1a1db8f4c0e79c8f33dae5d77ffb97f21e449438bc0defa4c3"
)
baseline = request_digest(request)
assert baseline.startswith("sha256:") and len(baseline) == 71
assert request_digest({k: v for k, v in request.items() if k != "id"}) == baseline
assert request_digest({**request, "action": "deactivate"}) != baseline
def test_valid_allow_envelope_passes():
result = _validate(_envelope())