Add value-safe verification and audit reporting

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0217e-8c4c-7383-be6b-f50a6e485306

src/secrets_engine/openbao.py

@@ -28,29 +28,34 @@ from secrets_engine.errors import BackendError, ProvisioningError
 from secrets_engine.safe_paths import containing_git_worktree
 
 
-def _check_token_file(path: Path) -> str:
-    """Read a bootstrap token file after enforcing mode-0600 and out-of-repo."""
+def read_strict_token_file(path: Path, *, purpose: str = "token") -> str:
+    """Read token material only from a mode-0600 path outside Git worktrees."""
     if not path.exists():
-        raise ProvisioningError(f"bootstrap token file not found: {path}")
+        raise ProvisioningError(f"{purpose} file not found: {path}")
     st = path.stat()
     if st.st_mode & 0o077:
         raise ProvisioningError(
-            f"bootstrap token file {path} is group/other-accessible "
+            f"{purpose} file {path} is group/other-accessible "
             f"(mode {oct(st.st_mode & 0o777)}); must be 0600"
         )
     # Refuse a token file living inside a Git worktree.
     worktree = containing_git_worktree(path)
     if worktree is not None:
         raise ProvisioningError(
-            f"bootstrap token file {path} is inside a Git worktree ({worktree}); "
+            f"{purpose} file {path} is inside a Git worktree ({worktree}); "
             "store it outside any repo"
         )
     token = path.read_text(encoding="utf-8").strip()
     if not token:
-        raise ProvisioningError(f"bootstrap token file {path} is empty")
+        raise ProvisioningError(f"{purpose} file {path} is empty")
     return token
 
 
+def _check_token_file(path: Path) -> str:
+    """Compatibility wrapper for bootstrap authentication input."""
+    return read_strict_token_file(path, purpose="bootstrap token")
+
+
 @dataclass
 class ScopedTokenSession:
     """One AppRole login token that revokes itself on close."""