83 lines
3.3 KiB
Markdown
83 lines
3.3 KiB
Markdown
---
|
|
id: USER-WP-0023
|
|
type: workplan
|
|
title: "Bind user-engine to flex-auth with rotating workload identity"
|
|
domain: communication
|
|
repo: user-engine
|
|
status: active
|
|
owner: codex
|
|
topic_slug: netkingdom
|
|
created: "2026-08-18"
|
|
updated: "2026-08-18"
|
|
state_hub_workstream_id: "014d0886-b690-4860-8337-c718e440f678"
|
|
---
|
|
|
|
# USER-WP-0023 — flex-auth caller identity
|
|
|
|
Close the caller side of FLEX-WP-0015 without changing user-facing identity or
|
|
authorization semantics.
|
|
|
|
```task
|
|
id: USER-WP-0023-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "8dae0fe1-f8a0-4276-8ae3-fe1f5b410669"
|
|
```
|
|
|
|
Read the audience-scoped caller token from a file per authorization decision,
|
|
fail closed on rotation/read errors, and cover token rotation. Completed
|
|
2026-08-18; the full suite passes 143 tests with three provider-gated skips.
|
|
|
|
2026-08-18 fail-closed coverage: the contract promised denial on a missing,
|
|
empty, or unreadable token file, but only rotation was proven. Conformance now
|
|
covers all three unusable-token cases and asserts the adapter never reaches
|
|
flex-auth without a usable credential, so an unauthenticated call cannot be
|
|
mistaken for an authorized one. A further test proves the token value appears
|
|
in neither the deny reason nor the decision repr. Suite: 148 tests, three
|
|
provider-gated skips.
|
|
|
|
```task
|
|
id: USER-WP-0023-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "4a6c85e8-1ada-4147-b6b7-d340b7e5192c"
|
|
```
|
|
|
|
Align tenant-authority reads with the protected `tenant.read` action and actor
|
|
`user-engine`, preserving opaque URL encoding. Completed 2026-08-18 with
|
|
adapter request coverage.
|
|
|
|
```task
|
|
id: USER-WP-0023-T03
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "0499c65b-491d-4ed1-8549-f58dba48f612"
|
|
```
|
|
|
|
Promote together with the flex-auth A2 digest and the NetKingdom projected
|
|
ServiceAccount token manifest. Prove a valid caller succeeds, no token returns
|
|
401, and user-engine cannot represent another protected system. This is a live
|
|
operator rollout and was not performed by the source change.
|
|
|
|
2026-08-18 readiness review: our half is done. The `rapp-user-engine` managed
|
|
package is now the apply home, and image `sha256:c501aeb2…` from `7604d31` —
|
|
which contains the caller-token change — is live and passed `make verify-live`.
|
|
The projected ServiceAccount token manifest is in place: audience `flex-auth`,
|
|
mounted at `/var/run/secrets/flex-auth-caller/token`, with
|
|
`USER_ENGINE_FLEX_AUTH_TOKEN_FILE` pointing at it. flex-auth's deploy carries
|
|
the binding `user-engine=system:serviceaccount:user-engine:user-engine`.
|
|
|
|
The blocker is now precisely one upstream item. FLEX-WP-0015-T02 is `wait`:
|
|
ADR 0004's TokenReview choke point exists in flex-auth source, but the running
|
|
digest is unchanged, so production still accepts unauthenticated callers and
|
|
our Authorization header is sent and ignored. Running the probe today would
|
|
pass steps 1 and 3 and silently fail step 2 — a false pass on the only
|
|
assertion that proves enforcement. The probe is therefore written down rather
|
|
than run: see `docs/flex-auth-caller-identity.md`, which carries all three
|
|
checks as commands plus the digests to record.
|
|
|
|
This task stays `wait` on FLEX-WP-0015-T02 promotion through FLEX-WP-0011,
|
|
and on an operator shell with cluster credentials, which agent sessions in
|
|
this repo do not hold.
|
|
|
|
Contract: `docs/flex-auth-caller-identity.md`.
|