coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Revoke leases by operator-held lease id
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
session revoke accepts exactly one of --accessor-file or --lease-id-file.
Lease ids are read from a mode-0600 out-of-repo file and fingerprinted in
evidence; the handle is never printed. Production remains fail-closed.

Assistant: grok
Assistant-Session: 01a05f07-ae72-7781-9fcb-19efd61add00
This commit is contained in:
tegwick 2026-09-02 10:08:33 +02:00
parent ce1790f267
commit 85d4548035
7 changed files with 100 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

44
src/secrets_engine/cli.py
View file

@ -13,7 +13,7 @@ Command surface (FR7):
exec --catalog <catalog-id> [--field NAME] [--mode auto|npm-config|exec-env|exec-file] -- CMD...
route <catalog-id> [--json]
revoke <catalog-id>
session revoke --accessor-file F [--stage stage]
session revoke (--accessor-file F | --lease-id-file F) [--stage stage]
lifecycle suspend|deactivate|destroy <catalog-id>
audit <catalog-id> [--json]
secret-use snapshot [--catalog-id ID] [--json]
@ -505,7 +505,16 @@ def cmd_exec(cfg: Config, args) -> int:
def cmd_session_revoke(cfg: Config, args) -> int:
"""Revoke an already-issued token by accessor. Never print the accessor."""
"""Revoke an already-issued token or lease. Never print the handle."""
from secrets_engine.errors import ProvisioningError
accessor_file = getattr(args, "accessor_file", None) or ""
lease_file = getattr(args, "lease_id_file", None) or ""
if bool(accessor_file) == bool(lease_file):
raise ProvisioningError(
"exactly one of --accessor-file or --lease-id-file is required"
)
kind = "accessor" if accessor_file else "lease"
stance_entry = SimpleNamespace(stage=args.stage, approval={"model": "bootstrap-only"})
evidence = PrivilegedActionEvidence(
writer=_writer(cfg),
@ -513,20 +522,28 @@ def cmd_session_revoke(cfg: Config, args) -> int:
catalog_id="",
stage=args.stage,
approval_required=False,
detail={"handle_kind": kind},
)
with evidence:
stance = apply_unreachable_engine_stance(cfg, stance_entry, "session-revoke")
evidence.mark_stance(stance)
accessor = read_strict_token_file(
Path(args.accessor_file), purpose="token accessor"
handle = read_strict_token_file(
Path(accessor_file or lease_file),
purpose="token accessor" if kind == "accessor" else "lease id",
)
fingerprint = accessor_fingerprint(accessor)
fingerprint = accessor_fingerprint(handle)
evidence.detail["session_handle"] = fingerprint
with _open_backend(cfg, args, evidence) as client:
client.revoke_accessor(accessor)
del accessor
print(f"revoked session handle {fingerprint}")
evidence.finish("revoked", detail={"session_handle": fingerprint})
if kind == "accessor":
client.revoke_accessor(handle)
else:
client.revoke_lease(handle)
del handle
print(f"revoked {kind} handle {fingerprint}")
evidence.finish(
"revoked",
detail={"session_handle": fingerprint, "handle_kind": kind},
)
return 0
@ -870,13 +887,18 @@ def build_parser() -> argparse.ArgumentParser:
sessub = sess.add_subparsers(dest="subcmd", required=True)
srev = sessub.add_parser(
"revoke",
help="revoke a token by a non-secret accessor the operator already holds",
help="revoke a token accessor or lease id the operator already holds",
)
srev.add_argument(
"--accessor-file",
required=True,
default=None,
help="mode-0600 out-of-repo file containing the token accessor",
)
srev.add_argument(
"--lease-id-file",
default=None,
help="mode-0600 out-of-repo file containing the lease id",
)
srev.add_argument("--stage", default="prod", choices=("build", "test", "prod"))
add_token_arg(srev)
srev.set_defaults(func=cmd_session_revoke)