tegwick
c44306b1b2
The vocabulary mapping this path was waiting on is not coming: gate-house rejected it in GH-DEC-2026-008, because a translation can be confidently wrong and fails open by accepting a claim approved for a different action. The stronger option arrived instead, and both halves are enforced here. flex-auth published binding.approval_binding_digest (FLEX-DEC-2026-007) to fix the circularity this repo reported: a pdp_digest recorded at issue time can never equal the request_digest of the request that carries the claim in its hashed context, so with GH-DEC-2026-008 requiring that equality, destroy would have failed closed forever on a check no correct record could pass. - authorization.approval_binding_digest implements the published exclusion rule, including Go's context,omitempty behaviour when stripping empties the context; digest_material drops an empty context for the same reason. - validate_decision_envelope recomputes the field rather than trusting it, refuses a claim-bearing request whose decision records none, and compares the claim's digest from step 1 against it -- never against request_digest, which still covers the claim so it stays a sound replay identity. - validate_approval_claim requires binding.pdp_path true before using pdp_digest at all. Path intent is never inferred from a digest that happens to be present; pre-schema-v3 approvals carry pdp_path false regardless of any digest they hold. Replay fixtures re-vendored from dd3ce4c. The destroy pins moved a second and final time; approval_binding_digest did not, which is the point. The fixture now demonstrates the property instead of asserting it: we rederive fa07becf... from its own request through our canonical implementation, proving we hash the same material flex-auth does rather than pinning a constant we cannot reproduce. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01E4tNMAYcSQmZWUE4wqP4ij Assistant: claude-code Assistant-Model: opus Assistant-Process: 715726@bnt-lap001 Assistant-Session: 80a42b32-cba6-4b23-8be0-68819b1a6092
144 lines
4.8 KiB
JSON
144 lines
4.8 KiB
JSON
{
|
|
"id": "decision:44a40c339a020772",
|
|
"contract_version": "flex-auth.decision-record.v1",
|
|
"request_id": "check:secrets-engine-destroy",
|
|
"effect": "allow",
|
|
"reason": "catalog_lane_policy_matched",
|
|
"matched_policy_version": "v1",
|
|
"matched_rule": "catalog_lane_policy_matched",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"tenant": "tenant:platform",
|
|
"attributes": {
|
|
"auth_targets": [],
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"stage": "prod"
|
|
}
|
|
},
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service",
|
|
"tenant": "tenant:platform",
|
|
"attributes": {
|
|
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
|
|
"display_name": "secrets-engine service principal",
|
|
"groups": [
|
|
"group:secrets-engine-lane-operators"
|
|
],
|
|
"organization_relation": "ServiceProvider",
|
|
"roles": [
|
|
"Operator"
|
|
]
|
|
}
|
|
},
|
|
"binding": {
|
|
"tenant": "tenant:platform",
|
|
"subject": {
|
|
"id": "secrets-engine",
|
|
"type": "service",
|
|
"tenant": "tenant:platform",
|
|
"attributes": {
|
|
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
|
|
"display_name": "secrets-engine service principal",
|
|
"groups": [
|
|
"group:secrets-engine-lane-operators"
|
|
],
|
|
"organization_relation": "ServiceProvider",
|
|
"roles": [
|
|
"Operator"
|
|
]
|
|
}
|
|
},
|
|
"action": "destroy",
|
|
"resource": {
|
|
"id": "lane:glas-primary",
|
|
"type": "secret-catalog-lane",
|
|
"system": "secrets-engine",
|
|
"tenant": "tenant:platform",
|
|
"attributes": {
|
|
"auth_targets": [],
|
|
"fields": [],
|
|
"policy_targets": [],
|
|
"stage": "prod"
|
|
}
|
|
},
|
|
"context": {
|
|
"approval": {
|
|
"approval_id": "3d1c0a8e-6b7f-4c21-9a0e-1f2b3c4d5e6f",
|
|
"binding": {
|
|
"action": "secrets.kv.destroy",
|
|
"actor": "agt-secrets-engine",
|
|
"digest": "sha256:3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f",
|
|
"pdp_digest": "sha256:fa07becfaa471394d06aee5fa3cd66352bf0cc69ef24900240489684cda8cd56",
|
|
"pdp_path": true,
|
|
"principal": "bernd",
|
|
"purpose": "rotate-exposed-key",
|
|
"target": {
|
|
"id": "lane-openbao-root",
|
|
"stage": "prod"
|
|
}
|
|
},
|
|
"consumed": false,
|
|
"freshness": {
|
|
"not_after": "2026-09-06T12:00:30+00:00",
|
|
"observed_at": "2026-09-06T12:00:00+00:00",
|
|
"ttl_seconds": 30
|
|
},
|
|
"issuer": "approval-engine",
|
|
"kind": "approval-claim",
|
|
"reason_code": "ok",
|
|
"schema_version": "0.1",
|
|
"state": "valid",
|
|
"valid_now": true,
|
|
"validity": {
|
|
"expires_at": "2026-09-06T15:00:00+00:00",
|
|
"not_before": "2026-09-06T11:00:00+00:00"
|
|
}
|
|
}
|
|
},
|
|
"request_digest": "sha256:c749ee2dc3cdf927a70a3e5b27cff4d97a438d3264153b4b2e3bcacbaf82091a",
|
|
"approval_binding_digest": "sha256:fa07becfaa471394d06aee5fa3cd66352bf0cc69ef24900240489684cda8cd56"
|
|
},
|
|
"lifetime": {
|
|
"kind": "ttl",
|
|
"ttl": "15m",
|
|
"not_before": "2026-09-06T12:51:16Z",
|
|
"expires_at": "2026-09-06T13:06:16Z"
|
|
},
|
|
"diagnostics": {
|
|
"action": "destroy",
|
|
"matched_relationship": "",
|
|
"policy_package": "secrets-engine.catalog-lane.lifecycle",
|
|
"policy_status": "ready",
|
|
"registry_resource": false,
|
|
"registry_subject": true
|
|
},
|
|
"provenance": {
|
|
"evaluator": "flex-auth/local",
|
|
"mode": "standalone",
|
|
"policy_package": "secrets-engine.catalog-lane.lifecycle",
|
|
"policy_version": "v1",
|
|
"policy_package_digest": "sha256:fe0070b79f66442ae6c218697a49c470c6c8f670aa57a30c078a5284d097bd8c",
|
|
"registry_snapshot_digest": "sha256:f5a309bc0b36721fd6d9ad7f53eb21222162bc2eac62a0ab0802a9a1d51340bb",
|
|
"input_claim_digests": {
|
|
"context": "sha256:8b73d29ecef286d42e03d2420531d6c45219f325a7ae004c1ecfc781203a2800"
|
|
},
|
|
"decision_time": "2026-09-06T12:51:16Z"
|
|
},
|
|
"caring": {
|
|
"profile": "caring-0.4.0-rc2",
|
|
"conformance_findings": [
|
|
{
|
|
"code": "CARING-DESCRIPTOR-MISSING",
|
|
"severity": "warning",
|
|
"message": "no CARING descriptor matched the request",
|
|
"fields": [
|
|
"caring_context"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
}
|