coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
secrets-engine/tests/fixtures/flex-auth-replay/PROVENANCE.md
tegwick 80eafafe5b fix: send the tenant the policy package scopes us to, and adopt v2 
build_action_request emitted no tenant field at all. The deployed
secrets-engine.catalog-lane.lifecycle v2 package reads

  known_tenant   := "tenant:platform"
  request_tenant := object.get(input, "tenant", "")

so an absent tenant is not an ignored field, it matches the wrong_tenant
first-denial branch. Every gated action this engine sent would have been
denied -- and the omission also produced a request_digest that could match
no correctly issued decision, since tenant is hashed material. That is the
same class of defect as hashing excluded fields, arriving from the other
direction, and again only a real artifact exposed it.

Found by answering the GLAS-WP-0015 tenant-alignment question instead of
assuming the values lined up.

- REQUEST_TENANT is pinned against the vendored allow envelopes, so a
  package retenanting fails a test rather than denying production.
- An empty tenant is refused at build time.
- Accepted policy version moves v1 -> v2. v1 had no tenant rule and failed
  open: a rotate under tenant:coulomb returned allow against the deployed
  package. flex-auth superseded rather than amended it, because a fail-open
  correction has to be visible as a version change. A test pins that a v1
  decision is refused.
- Vendored decision_wrong_tenant_deny.json as the denial evidence glas
  asked for, with tests that we refuse it on effect before anything else
  and that a deny legally carries no lifetime.

docs/tenant-alignment.md states the three tenant values as this repo holds
them. It does not resolve the JWT/store mapping: service_auth.TENANT is
tenant:coulomb, which is exactly the value the package denies. That is
either two layers sharing a namespace format or one wrong constant, and
picking between them without an owner ruling is the fail-open shape
GH-DEC-2026-008 rejected for action vocabularies. Both constants stay as
they are, deliberately not unified.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E4tNMAYcSQmZWUE4wqP4ij

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 715726@bnt-lap001
Assistant-Session: 80a42b32-cba6-4b23-8be0-68819b1a6092
2026-09-06 22:32:54 +02:00

2.6 KiB
Raw Blame History

flex-auth T03 replay fixtures

Copied verbatim from flex-auth/examples/secrets-engine/replay/ (commit 9e10d1c, FLEX-WP-0021-T03). Real DecisionEnvelopes emitted by the published secrets-engine.catalog-lane.lifecycle v1 package via go run ./cmd/flex-auth check, from flex-auth/local in standalone mode.

Vendored so the digest contract test is hermetic. Regenerate upstream and re-copy if the contract version changes.

Re-copied 2026-09-06 (twice, both upstream regenerations):

  1. commit 9f3e7e3 completed the approval-claim on context.approval. Because context is hashed material, completing the claim moved the request digest.

  2. commit dd3ce4c (FLEX-DEC-2026-007) published binding.approval_binding_digest and set the embedded claim's binding.pdp_digest to it with binding.pdp_path true. The request digest moved once more with the claim's contents; the approval-binding digest did not, which is the property the fixture now demonstrates rather than asserts.

  3. commit d98323b published v2, which adds the input.tenant rule v1 never had, and a third fixture: decision_wrong_tenant_deny.json. The request digests did not move — every allow fixture already carried tenant: tenant:platform — but provenance.policy_version is now v2 and policy_package_digest moved to sha256:bd11c5fe….

decision_rotate.json carries no approval_binding_digest — the field is omitted on claim-free decisions rather than duplicated onto them, and a test pins that omission.

decision_wrong_tenant_deny.json is an effect: deny envelope and carries no lifetime, which is legal: the schema requires lifetime only for an allow. It is the wrong-tenant denial evidence GLAS-WP-0015 asked for. Do not lifetime-refresh it in tests.

v1 must not be pinned. It had no tenant rule and failed open; flex-auth superseded rather than amended it so the change is visible in the version string. See docs/tenant-alignment.md.

Pinned here (stable across runs, per the upstream README): binding.request_digest, binding.approval_binding_digest, provenance.policy_package_digest, provenance.registry_snapshot_digest, and the presence/absence of provenance.input_claim_digests.context.

approval_binding_digest is not only pinned but rederived by test_pdp_digest_equals_the_published_approval_binding_digest: our canonical implementation must reproduce it from the fixture's own request. A pin asserts the constant; rederiving it proves we hash the same material flex-auth does.

Never pin: id, provenance.decision_time, lifetime.not_before, lifetime.expires_at — all move with the clock.