Revoke leases by operator-held lease id

session revoke accepts exactly one of --accessor-file or --lease-id-file.
Lease ids are read from a mode-0600 out-of-repo file and fingerprinted in
evidence; the handle is never printed. Production remains fail-closed.

Assistant: grok
Assistant-Session: 01a05f07-ae72-7781-9fcb-19efd61add00

tests/test_session_revoke.py

@@ -5,7 +5,7 @@ import pytest
 
 from secrets_engine import cli
 from secrets_engine.config import Config
-from secrets_engine.errors import BackendError, DecisionError
+from secrets_engine.errors import BackendError, DecisionError, ProvisioningError
 from secrets_engine.openbao import OpenBaoClient, accessor_fingerprint
 
 
@@ -42,6 +42,7 @@ def test_session_revoke_uses_fingerprint_only(tmp_path, monkeypatch):
     )
     args = SimpleNamespace(
         accessor_file=str(_accessor_file(tmp_path)),
+        lease_id_file=None,
         stage="test",
         bootstrap_token_file=None,
         auth="auto",
@@ -95,6 +96,53 @@ def test_session_revoke_production_fails_closed_before_backend(tmp_path, monkeyp
         cli.cmd_session_revoke(cfg, args)
 
 
+def test_session_revoke_lease_uses_fingerprint_only(tmp_path, monkeypatch):
+    lease = "kv/data/test/team/thing/lease-id-secretish"
+    seen = {}
+
+    class _Client:
+        def revoke_lease(self, lease_id):
+            seen["lease"] = lease_id
+
+        def revoke_accessor(self, _accessor):
+            pytest.fail("must not revoke accessor")
+
+    monkeypatch.setattr(cli, "_open_backend", lambda *_args, **_kwargs: _ctx(_Client()))
+    path = tmp_path / "lease.handle"
+    path.write_text(lease, encoding="utf-8")
+    path.chmod(0o600)
+    args = SimpleNamespace(
+        accessor_file=None,
+        lease_id_file=str(path),
+        stage="test",
+        bootstrap_token_file=None,
+        auth="auto",
+    )
+    rc = cli.cmd_session_revoke(_config(tmp_path), args)
+    assert rc == 0
+    assert seen["lease"] == lease
+    records = [
+        json.loads(line)
+        for line in next((tmp_path / "evidence").glob("evidence-*.jsonl")).read_text().splitlines()
+    ]
+    dumped = json.dumps(records)
+    assert lease not in dumped
+    assert records[-1]["detail"]["handle_kind"] == "lease"
+    assert records[-1]["detail"]["session_handle"] == accessor_fingerprint(lease)
+
+
+def test_session_revoke_requires_exactly_one_handle(tmp_path):
+    args = SimpleNamespace(
+        accessor_file=None,
+        lease_id_file=None,
+        stage="test",
+        bootstrap_token_file=None,
+        auth="auto",
+    )
+    with pytest.raises(ProvisioningError, match="exactly one"):
+        cli.cmd_session_revoke(_config(tmp_path), args)
+
+
 def test_revoke_accessor_rejects_blank(monkeypatch):
     client = OpenBaoClient(addr="http://example.invalid", token="t", bao_bin="bao")
     monkeypatch.setattr(
@@ -102,3 +150,5 @@ def test_revoke_accessor_rejects_blank(monkeypatch):
     )
     with pytest.raises(BackendError, match="missing or invalid"):
         client.revoke_accessor(" ")
+    with pytest.raises(BackendError, match="missing or invalid"):
+        client.revoke_lease("")