coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Read the secrets-engine-openbao client secret in memory from OpenBao
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Founder direction 2026-10-06 and ops-mason plan
keycape-secrets-engine-openbao-client-custody (658cdbc): no workstation copy.
service-jwt now gets CLIENT_SECRET from platform/workloads/keycape/
secrets-engine-openbao through one attended OIDC login on
keycape-secrets-engine-openbao-operator-workload-kv-read (-no-store, token from
a pipe, header-only GET, unconditional revoke-self). The consumer file is
refused for this profile and kept for the approval client.
service-auth probe-openbao prints value-free first-use evidence.

SECRETS-WP-0012: T02 cancelled (D1-D4 superseded), T04 done, T03 is the
founder-run first live use. Synthetic tests only; 524 passed, 1 skipped.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
This commit is contained in:
tegwick 2026-10-06 14:13:41 +02:00
parent 6941610b8d
commit b8094f701b
12 changed files with 688 additions and 185 deletions
Download patch file Download diff file Expand all files Collapse all files

27
tests/test_service_auth.py
View file

@ -45,11 +45,10 @@ def _jwt(**overrides):
return f"{_segment({'alg': 'RS256', 'typ': 'JWT'})}.{_segment(claims)}.signature"
def _config(secret_file=Path("/tmp/keycape-client-secret")):
def _config(_unused=None):
return KeyCapeServiceAuthConfig(
token_url="https://keycape.example.test/token",
issuer="https://keycape.example.test",
client_secret_file=secret_file,
)
@ -114,7 +113,9 @@ def test_exchange_uses_basic_auth_and_never_places_secret_in_body(tmp_path):
}
)
provider = KeyCapeServiceAuthProvider(_config(secret_file), transport=transport)
provider = KeyCapeServiceAuthProvider(
_config(), transport=transport, secret_source=lambda: "client-secret-value"
)
result = provider.exchange(now=NOW)
assert result.expires_at == int(NOW.timestamp()) + 900
assert captured["authorization"].startswith("Basic ")
@ -138,7 +139,9 @@ def test_exchange_rejects_refresh_or_id_tokens_without_exposing_secret(tmp_path)
}
)
provider = KeyCapeServiceAuthProvider(_config(secret_file), transport=transport)
provider = KeyCapeServiceAuthProvider(
_config(), transport=transport, secret_source=lambda: secret
)
with pytest.raises(BackendError, match="forbidden extra token") as error:
provider.exchange(now=NOW)
assert secret not in str(error.value)
@ -149,12 +152,24 @@ def test_provider_config_is_exact_and_has_no_bootstrap_fallback():
KeyCapeServiceAuthConfig(
token_url="http://keycape.example.test/token",
issuer="https://keycape.example.test",
client_secret_file=Path("/tmp/unused"),
)
with pytest.raises(BackendError, match="accepted contract"):
KeyCapeServiceAuthConfig(
token_url="https://keycape.example.test/token",
issuer="https://keycape.example.test",
client_secret_file=Path("/tmp/unused"),
client_id="operator",
)
def test_openbao_profile_refuses_file_source(tmp_path):
with pytest.raises(BackendError, match="file source is refused"):
KeyCapeServiceAuthConfig(
token_url="https://keycape.example.test/token",
issuer="https://keycape.example.test",
client_secret_file=tmp_path / "client.secret",
)
provider = KeyCapeServiceAuthProvider(
_config(), transport=lambda *_a, **_k: pytest.fail("no exchange")
)
with pytest.raises(BackendError, match="no file fallback"):
provider.exchange(now=NOW)