refresh-local-auth: accept only a template as the local auth refresh source #56

New issue

Closed

opened 2026-09-13 03:34:07 +01:00 by allod-agent · 0 comments

allod-agent commented

2026-09-13 03:34:07 +01:00

Member

Bring refresh-local-auth's source-credential predicate up to the same template-only standard as the archetypes check and allod secret rotate, now that no registry can hold a format entry.

Primary goals:

One shape — is_credential_store_url_source accepts only a value.template that renders one credential-store line; the branch that accepts format = "credential-store-url" with no value goes.
Fail closed on format — an entry carrying format at all is refused as "not a credential-store URL source", matching what archetypes and allod secret now do, and the sabotage.both-shapes case pins it under a name that no longer implies two shapes exist.
Fixtures follow — the legacy.git fixture group, legacy_source_installs_bundle_and_is_idempotent, and the legacy half of new_shape_source_installs_the_same_bundle go; the idempotence and bundle-contents assertions they carried are kept on the new.git group.
Comment tells the truth — the block explaining that the predicate mirrors the archetypes and tools predicates "character for character" is correct again once the legacy branch is gone, and the "wholly legacy or wholly new" paragraph is retired.

Current state and specifics

scripts/refresh-local-auth:136-138 still accepts format == "credential-store-url" with no value as a valid local_auth_refresh source, beside the template shape at lines 139-147. The comment at scripts/refresh-local-auth:110-115 says this mirrors isCredentialStoreUrlSource in allod/archetypes and isCredentialStoreURLSource in allod/tools character for character; since allod/archetypes PR 77 and allod/tools PR 213 landed, both of those accept only the template shape and refuse any entry carrying format, so the claim is false and the script is the one consumer that still admits the retired shape.

The shape is unreachable from a registry that passes its checks: the secrets flake's credential-registry check refuses any credential carrying format (allod/secrets PR 28), the archetypes credential-profiles check refuses it as a refresh source, and allod secret refuses it at registry decode time. The private registry migrated its last credential-store-url entry through the now-deleted allod secret migrate, so no deployment holds one either.

tests/refresh-local-auth.sh:145-175 builds a legacy.git group in the old shape (format, target kind, structured verify, the retired group fields) beside new.git in the current one. tests/refresh-local-auth.sh:385 runs the refresh from legacy.git and checks the bundle installs and is idempotent; tests/refresh-local-auth.sh:439 runs both groups with the same plaintext and asserts byte-identical bundles and modes, which was the migration-safety witness and has no remaining subject. tests/refresh-local-auth.sh:251 (sabotage.both-shapes) adds format to a new-shape entry and expects the refusal; that is the one legacy-related case to keep.

Default: narrow the jq predicate to has("format") | not and the template branch, keep the refusal message text, and move the idempotence assertions onto new.git. Validation: tests/refresh-local-auth.sh green, and nix flake check in allod/nexus.

Scope

In: the predicate, its comment, and the test script's fixtures and cases in allod/nexus. Out: the netrc bundle format and destinations, which are unchanged; the deployment's private validator, which has its own handoff issue under allod/secrets#27.

Refs allod/secrets#27, allod/nexus#52.

Bring `refresh-local-auth`'s source-credential predicate up to the same template-only standard as the archetypes check and `allod secret rotate`, now that no registry can hold a `format` entry. Primary goals: - **One shape** — `is_credential_store_url_source` accepts only a `value.template` that renders one credential-store line; the branch that accepts `format = "credential-store-url"` with no `value` goes. - **Fail closed on `format`** — an entry carrying `format` at all is refused as "not a credential-store URL source", matching what archetypes and `allod secret` now do, and the `sabotage.both-shapes` case pins it under a name that no longer implies two shapes exist. - **Fixtures follow** — the `legacy.git` fixture group, `legacy_source_installs_bundle_and_is_idempotent`, and the legacy half of `new_shape_source_installs_the_same_bundle` go; the idempotence and bundle-contents assertions they carried are kept on the `new.git` group. - **Comment tells the truth** — the block explaining that the predicate mirrors the archetypes and tools predicates "character for character" is correct again once the legacy branch is gone, and the "wholly legacy or wholly new" paragraph is retired. ### Current state and specifics `scripts/refresh-local-auth:136-138` still accepts `format == "credential-store-url"` with no `value` as a valid `local_auth_refresh` source, beside the template shape at lines 139-147. The comment at `scripts/refresh-local-auth:110-115` says this mirrors `isCredentialStoreUrlSource` in allod/archetypes and `isCredentialStoreURLSource` in allod/tools character for character; since allod/archetypes PR 77 and allod/tools PR 213 landed, both of those accept only the template shape and refuse any entry carrying `format`, so the claim is false and the script is the one consumer that still admits the retired shape. The shape is unreachable from a registry that passes its checks: the secrets flake's `credential-registry` check refuses any credential carrying `format` (allod/secrets PR 28), the archetypes `credential-profiles` check refuses it as a refresh source, and `allod secret` refuses it at registry decode time. The private registry migrated its last `credential-store-url` entry through the now-deleted `allod secret migrate`, so no deployment holds one either. `tests/refresh-local-auth.sh:145-175` builds a `legacy.git` group in the old shape (`format`, target `kind`, structured `verify`, the retired group fields) beside `new.git` in the current one. `tests/refresh-local-auth.sh:385` runs the refresh from `legacy.git` and checks the bundle installs and is idempotent; `tests/refresh-local-auth.sh:439` runs both groups with the same plaintext and asserts byte-identical bundles and modes, which was the migration-safety witness and has no remaining subject. `tests/refresh-local-auth.sh:251` (`sabotage.both-shapes`) adds `format` to a new-shape entry and expects the refusal; that is the one legacy-related case to keep. Default: narrow the jq predicate to `has("format") | not` and the template branch, keep the refusal message text, and move the idempotence assertions onto `new.git`. Validation: `tests/refresh-local-auth.sh` green, and `nix flake check` in allod/nexus. ### Scope In: the predicate, its comment, and the test script's fixtures and cases in allod/nexus. Out: the netrc bundle format and destinations, which are unchanged; the deployment's private validator, which has its own handoff issue under allod/secrets#27. Refs allod/secrets#27, allod/nexus#52.

allod-agent referenced this issue from allod/tools

2026-09-13 03:58:22 +01:00

secret rotate: match the other credential-store URL predicates on which lines count as blank #214

allod-agent referenced this issue from a commit

2026-09-13 04:01:16 +01:00

refresh-local-auth: accept only a template as the local auth refresh source

allod-agent referenced this issue from a pull request that will close it,

2026-09-13 04:01:43 +01:00

refresh-local-auth: accept only a template as the local auth refresh source #57