cli: row 199 mosaic credentials status, issue, rotate, revoke and delete; issue and rotate read the token on stdin, never argv; --tester takes status and revoke; scripts/mosaic routes credentials to packages/cli (#1697)
This commit is contained in:
@@ -238,6 +238,12 @@ Exit codes: `0` ok · `2` invalid file or credential reference · `3` system
|
||||
config problem · `4` usage or a required file missing. Details:
|
||||
`packages/business/README.md`.
|
||||
|
||||
`mosaic credentials status|issue|rotate|revoke|delete` (row 199) goes to
|
||||
`packages/cli` and the bus's human-only credential verbs: an agent's own
|
||||
token in `<configDir>/secrets/agents/<business>/<agent>/<kind>`, read on
|
||||
stdin, never printed. The tester may run `status` and `revoke`. Details:
|
||||
`packages/cli/README.md`.
|
||||
|
||||
`instances` and `instance add|set` (row 165) go to `packages/cli` and the
|
||||
bus's human-only `instances` and `instances.set` verbs, so they need a live
|
||||
bus host and refuse inside an agent session. `instances` prints the revision,
|
||||
|
||||
@@ -215,6 +215,13 @@ an operator inspect content and delivery evidence after an uncertain result.
|
||||
| `trail` | `{subject}`: task ref, decision UUID or message UUID. Linked records in broker write order. |
|
||||
| `decisions` | `{list}`: `roles` or `recent`; human and reader sessions only. Open decisions routed to a role, or the last 50 closed. |
|
||||
| `credentials` | No args; human and reader sessions only. `[{service,account,role,dateKind,date,state}]` for the capability's business, never a token, file path or variable name. |
|
||||
| `credentials.issue` | `{agent,service,token,date}`; human only (row 199, #1697). Writes the token to `<configDir>/secrets/agents/<business>/<agent>/<service>` (0600, dirs 0700: tmp, fsync, rename), rewrites the agent's reference in the business file to `{"store":true,<rotateBy or expires>:date}`, then holds the token in memory, with no restart. Over an issued entry it is a rotate: the old value is gone from disk and memory when it returns. `service` is `gitea` or `vikunja` and the business file must already name it for the agent (`credential-unknown`). A token the bus already holds is `credential-leak`; a bad token `credential-format`; a bad date `credential-date`. Returns `{agent,verb,service,date,state}`, `verb` `issue` or `rotate`. The tester gets `tester-refused`. |
|
||||
| `credentials.revoke` | `{agent,service?,reason}`; human, or the tester (Q173). Drops the entry from memory, then unlinks a store file; a `file` or `env` reference keeps its file and becomes `store`, so a restart loads nothing. Without `service`, every kind the agent has. Returns `{agent,verb,services:[{service,state}]}`. |
|
||||
| `credentials.delete` | `{agent,reason}`; human only. `credentials.revoke` for every kind, then removes the agent's store dir; a file there other than a token is `credential-file`. While the agent or one of its threads holds a claim, `agent-running`. |
|
||||
|
||||
Each of the three leaves one receipt in the organization's `changes.jsonl`: the actor and a
|
||||
`detail` of `{verb,agent,kind,date or reason}`, never a value. A change to the store alone writes
|
||||
a receipt with empty `changes`. A refusal is `action.refused` with its code alone.
|
||||
| `requirements` | No args; role sessions only, as `task.create` is (row 90, #1584). The approved PRD's requirement ids, `{prd,version,requirements:[{id,title}]}`, from `packages/tasks/requirements.json`, loaded when the broker starts; a bad file refuses the start. A human session refuses `agent-required`, a reader `read-only`. |
|
||||
| `state` | No args; role, human and reader sessions (row 109, #1603). `{launch:{state,at,event},tasks:{open:[{task_ref,title}],total,cap}}` for the capability's business. `launch` is the latest `launch.revoked` or `launch.restored` event: `allowed` with `at` and `event` null when none exists. `open` is the tracker snapshot's open tasks in `task_ref` order, at most `cap` (the `tasks` page size, 50); `total` counts every open task. The harness runner reads it before each turn. Writes nothing. |
|
||||
| `replies` | `{id}`: a message UUID; human and reader sessions only. The messages whose `in_reply_to` is that id, oldest first, at most 50. Writes nothing. |
|
||||
|
||||
@@ -1009,6 +1009,19 @@ names no one; the restart itself needs Mos's go or Jason's hand. A vars or launc
|
||||
prints `no restart`, because the launcher reads it at its next launch check.
|
||||
The Console Settings page has the same read and write (`packages/webui`).
|
||||
|
||||
## credentials (row 199)
|
||||
|
||||
`mosaic credentials [status [AGENT]] [--json] [--tester]` lists each agent's
|
||||
credential kinds with date and state, never a value. `issue AGENT gitea
|
||||
--rotate-by DATE` and `issue AGENT vikunja --expires DATE` read the token on
|
||||
stdin (pipe it, or paste it and end input) and send it once to the bus's
|
||||
`credentials.issue`; it is never an argument. `rotate` is the same over an
|
||||
entry the bus holds now, and refuses before reading stdin when there is none.
|
||||
`revoke AGENT [KIND] --reason TEXT` and `delete AGENT --reason TEXT` drop the
|
||||
entries; `delete` refuses `agent-running` while the agent holds a claim. With
|
||||
`--tester` only `status` and `revoke` run. After a rotate or revoke, delete
|
||||
the old token in Gitea or Vikunja yourself; the bus only forgets it.
|
||||
|
||||
## Token usage
|
||||
|
||||
`mosaic usage [--business ID] [--json] [--tester]` reads the bus's accounting, without
|
||||
|
||||
@@ -17,6 +17,7 @@ import { projectBusCommand, projectCommand, PROJECT_BUS_USAGE, PROJECT_USAGE } f
|
||||
import { resolveThread, threadCommand, threadMembers, threadsCommand, THREAD_TALK_USAGE, THREAD_USAGE, THREADS_USAGE } from "./thread.mjs";
|
||||
import { limitsCommand, LIMITS_USAGE } from "./limits.mjs";
|
||||
import { pluginsCommand, PLUGINS_USAGE } from "./plugins.mjs";
|
||||
import { credentialsCommand, CREDENTIALS_USAGE } from "./credentials.mjs";
|
||||
import { instancesCommand, INSTANCES_USAGE } from "./instances.mjs";
|
||||
import { createChannelCaller } from "../../plugins/src/channel.mjs";
|
||||
import { PluginError } from "../../plugins/src/kinds.mjs";
|
||||
@@ -38,6 +39,7 @@ export const USAGE = `usage:
|
||||
${USAGE_USAGE}
|
||||
${LIMITS_USAGE}
|
||||
${PLUGINS_USAGE}
|
||||
${CREDENTIALS_USAGE}
|
||||
${INSTANCES_USAGE}
|
||||
${PROJECT_USAGE}
|
||||
${PROJECT_BUS_USAGE}
|
||||
@@ -576,6 +578,8 @@ export async function main(argv, io = { env: process.env, stdin: process.stdin,
|
||||
if (verb === "limits") return limitsCommand(rest,io,p=>callFor(p,io,deps));
|
||||
if (verb === "usage") return usageCommand(rest, io, p => callFor(p, io, deps));
|
||||
if (verb === "plugins") return pluginsCommand(rest, io, (p) => callFor(p, io, deps));
|
||||
// Row 199 (#1697): issue and rotate read the token on stdin.
|
||||
if (verb === "credentials") return credentialsCommand(rest, io, (p) => callFor(p, io, deps));
|
||||
// Row 165 (#1662): scripts/mosaic sends only `business instances` and `business instance` here.
|
||||
if (verb === "business") return instancesCommand(rest, io, (p) => callFor(p, io, deps));
|
||||
if (verb === "talk") return talk(rest, io, deps);
|
||||
|
||||
@@ -0,0 +1,81 @@
|
||||
// `mosaic credentials` (row 199, #1697, design section 6): an agent's per-agent credentials through
|
||||
// the broker's credentials, credentials.issue, credentials.revoke and credentials.delete. Every verb
|
||||
// is the human's; with --tester (Q173) only status and revoke. issue and rotate read the token on
|
||||
// stdin, never argv, and nothing here prints it: the broker's answer carries the kind, date and state.
|
||||
import { CliError } from "./errors.mjs";
|
||||
|
||||
export const CREDENTIALS_USAGE = "mosaic credentials [status [AGENT]] [--json] [--tester] | issue|rotate AGENT gitea --rotate-by DATE | " +
|
||||
"issue|rotate AGENT vikunja --expires DATE | revoke AGENT [KIND] --reason TEXT [--tester] | delete AGENT --reason TEXT [--business ID]";
|
||||
const DATE_FLAG = Object.freeze({ gitea: "--rotate-by", vikunja: "--expires" });
|
||||
const MAX_TOKEN = 16384;
|
||||
|
||||
function parse(args) {
|
||||
const out = { positional: [], flags: new Set(), values: {} };
|
||||
for (let i = 0; i < args.length; i++) {
|
||||
const arg = args[i];
|
||||
if (arg === "--json" || arg === "--tester") out.flags.add(arg);
|
||||
else if (["--business", "--rotate-by", "--expires", "--reason"].includes(arg)) {
|
||||
if (!args[i + 1] || Object.hasOwn(out.values, arg)) throw new CliError(CREDENTIALS_USAGE, 4);
|
||||
out.values[arg] = args[++i];
|
||||
} else if (arg.startsWith("--")) throw new CliError(CREDENTIALS_USAGE, 4);
|
||||
else out.positional.push(arg);
|
||||
}
|
||||
return out;
|
||||
}
|
||||
|
||||
// The whole of stdin, one token; a terminal shows what is typed, so a pipe or a paste then EOF.
|
||||
async function readToken(stdin) {
|
||||
let text = "";
|
||||
for await (const chunk of stdin) {
|
||||
text += chunk;
|
||||
if (text.length > MAX_TOKEN + 2) throw new CliError("refused: the token on stdin is too long", 2);
|
||||
}
|
||||
if (!text.trim()) throw new CliError("refused: no token on stdin; pipe or paste it, then end input", 4);
|
||||
return text;
|
||||
}
|
||||
|
||||
const ISSUED = new Set(["valid", "expiring", "expired"]);
|
||||
|
||||
export async function credentialsCommand(args, io, callFor) {
|
||||
const parsed = parse(args);
|
||||
const [verb = "status", agent, kind, ...extra] = parsed.positional;
|
||||
const v = parsed.values;
|
||||
const shape = {
|
||||
status: () => kind === undefined && !v["--rotate-by"] && !v["--expires"] && !v["--reason"],
|
||||
issue: () => agent && DATE_FLAG[kind] && v[DATE_FLAG[kind]] && !v[kind === "gitea" ? "--expires" : "--rotate-by"] && !v["--reason"],
|
||||
revoke: () => agent && (kind === undefined || DATE_FLAG[kind]) && v["--reason"] && !v["--rotate-by"] && !v["--expires"],
|
||||
delete: () => agent && kind === undefined && v["--reason"] && !v["--rotate-by"] && !v["--expires"],
|
||||
};
|
||||
shape.rotate = shape.issue;
|
||||
if (extra.length || !shape[verb]?.()) throw new CliError(CREDENTIALS_USAGE, 4);
|
||||
// Q173 (duckworth N1): a token the tester issued would pass through its session.
|
||||
if (parsed.flags.has("--tester") && !["status", "revoke"].includes(verb)) {
|
||||
throw new CliError(`--tester takes only status and revoke\n${CREDENTIALS_USAGE}`, 4);
|
||||
}
|
||||
try {
|
||||
const call = callFor(parsed);
|
||||
let result;
|
||||
if (verb === "status") {
|
||||
const rows = await call("credentials", {});
|
||||
result = agent ? rows.filter((r) => r.role === agent) : rows;
|
||||
if (!parsed.flags.has("--json")) {
|
||||
io.stdout.write(result.map((r) => `${r.role}\t${r.service}\t${r.state}\t${r.dateKind} ${r.date}`).join("\n") + (result.length ? "\n" : ""));
|
||||
return;
|
||||
}
|
||||
} else if (verb === "issue" || verb === "rotate") {
|
||||
// rotate names an entry the bus holds now; checked before stdin is read.
|
||||
if (verb === "rotate") {
|
||||
const held = (await call("credentials", {})).find((r) => r.role === agent && r.service === kind);
|
||||
if (!ISSUED.has(held?.state)) throw new CliError(`refused: ${agent} has no issued ${kind} credential to rotate; use issue`, 2);
|
||||
}
|
||||
const token = await readToken(io.stdin);
|
||||
result = await call("credentials.issue", { agent, service: kind, token, date: v[DATE_FLAG[kind]] });
|
||||
} else if (verb === "revoke") {
|
||||
result = await call("credentials.revoke", { agent, ...(kind ? { service: kind } : {}), reason: v["--reason"] });
|
||||
} else result = await call("credentials.delete", { agent, reason: v["--reason"] });
|
||||
io.stdout.write(JSON.stringify(result, null, 2) + "\n");
|
||||
} catch (error) {
|
||||
if (error instanceof CliError) throw error;
|
||||
throw new CliError(error.message, 2);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,97 @@
|
||||
// Row 199 (#1697, design section 6, T4, T5): `mosaic credentials`. issue and rotate read the token on
|
||||
// stdin and pass it once to credentials.issue; nothing printed carries it. --tester takes status and
|
||||
// revoke only. A fake transport records the calls; no bus runs here.
|
||||
import test from "node:test";
|
||||
import assert from "node:assert/strict";
|
||||
import { spawnSync } from "node:child_process";
|
||||
import { join } from "node:path";
|
||||
import { fileURLToPath } from "node:url";
|
||||
import { main } from "../src/cli.mjs";
|
||||
import { io, tmp } from "./helpers.mjs";
|
||||
|
||||
const TOKEN = "fake_cli_token_0123456789";
|
||||
const MOSAIC = fileURLToPath(new URL("../../../scripts/mosaic", import.meta.url));
|
||||
const ROWS = [
|
||||
{ service: "gitea", account: null, role: "coder", dateKind: "rotateBy", date: "2099-01-01", state: "valid" },
|
||||
{ service: "vikunja", account: "bot", role: "coder", dateKind: "expires", date: "2099-01-01", state: "not-issued" },
|
||||
{ service: "gitea", account: null, role: "reviewer", dateKind: "rotateBy", date: "2099-01-01", state: "revoked" },
|
||||
];
|
||||
|
||||
function deps(calls) {
|
||||
const answer = (who) => (business) => async (verb, args) => {
|
||||
calls.push({ who, business, verb, args });
|
||||
if (verb === "credentials") return ROWS;
|
||||
if (verb === "credentials.issue") return { agent: args.agent, verb: "issue", service: args.service, date: args.date, state: "valid" };
|
||||
return { agent: args.agent, verb: verb.slice(12), services: [] };
|
||||
};
|
||||
return { system: { dataRoot: "/nonexistent" }, transport: answer("human"), testerTransport: answer("tester") };
|
||||
}
|
||||
const withStdin = (x, text) => {
|
||||
x.stdin.end(text);
|
||||
return x;
|
||||
};
|
||||
|
||||
test("row 199: issue and rotate send the stdin token once to credentials.issue and print no value", async () => {
|
||||
const calls = [];
|
||||
const d = deps(calls);
|
||||
const x = withStdin(io(), TOKEN + "\n");
|
||||
await main(["credentials", "issue", "coder", "gitea", "--rotate-by", "2099-01-01", "--business", "acme"], x, d);
|
||||
assert.deepEqual(calls, [{ who: "human", business: "acme", verb: "credentials.issue", args: { agent: "coder", service: "gitea", token: TOKEN + "\n", date: "2099-01-01" } }]);
|
||||
assert.equal(x.out.text.includes(TOKEN), false);
|
||||
assert.equal(JSON.parse(x.out.text).state, "valid");
|
||||
// rotate checks the entry is issued before it reads stdin.
|
||||
calls.length = 0;
|
||||
await main(["credentials", "rotate", "coder", "gitea", "--rotate-by", "2099-06-01", "--business", "acme"], withStdin(io(), TOKEN), d);
|
||||
assert.deepEqual(calls.map((c) => c.verb), ["credentials", "credentials.issue"]);
|
||||
calls.length = 0;
|
||||
await assert.rejects(main(["credentials", "rotate", "coder", "vikunja", "--expires", "2099-06-01", "--business", "acme"], withStdin(io(), TOKEN), d), /no issued vikunja credential to rotate; use issue/);
|
||||
assert.deepEqual(calls.map((c) => c.verb), ["credentials"]);
|
||||
// No token on stdin, the date flag of the other kind, a token in argv: refused before any write.
|
||||
calls.length = 0;
|
||||
await assert.rejects(main(["credentials", "issue", "coder", "gitea", "--rotate-by", "2099-01-01", "--business", "acme"], withStdin(io(), "\n"), d), /no token on stdin/);
|
||||
await assert.rejects(main(["credentials", "issue", "coder", "gitea", "--expires", "2099-01-01", "--business", "acme"], withStdin(io(), TOKEN), d), /mosaic credentials/);
|
||||
await assert.rejects(main(["credentials", "issue", "coder", "gitea", TOKEN, "--rotate-by", "2099-01-01", "--business", "acme"], withStdin(io(), TOKEN), d), /mosaic credentials/);
|
||||
await assert.rejects(main(["credentials", "issue", "coder", "gitea", "--rotate-by", "2099-01-01", "--business", "acme"], withStdin(io(), "x".repeat(17000)), d), /too long/);
|
||||
assert.equal(calls.filter((c) => c.verb === "credentials.issue").length, 0);
|
||||
// From inside an agent run, the human's verbs refuse before any call.
|
||||
await assert.rejects(main(["credentials", "issue", "coder", "gitea", "--rotate-by", "2099-01-01", "--business", "acme"], withStdin(io({ CLAUDECODE: "1" }), TOKEN), d), /outside any agent run/);
|
||||
});
|
||||
|
||||
test("row 199: status, revoke and delete; the tester runs status and revoke only", async () => {
|
||||
const calls = [];
|
||||
const d = deps(calls);
|
||||
const x = io();
|
||||
await main(["credentials", "status", "coder", "--business", "acme"], x, d);
|
||||
assert.equal(x.out.text, "coder\tgitea\tvalid\trotateBy 2099-01-01\ncoder\tvikunja\tnot-issued\texpires 2099-01-01\n");
|
||||
const j = io();
|
||||
await main(["credentials", "--json", "--business", "acme", "--tester"], j, d);
|
||||
assert.equal(JSON.parse(j.out.text).length, 3);
|
||||
await main(["credentials", "revoke", "coder", "gitea", "--reason", "fired", "--business", "acme", "--tester"], io(), d);
|
||||
await main(["credentials", "revoke", "coder", "--reason", "fired", "--business", "acme"], io(), d);
|
||||
await main(["credentials", "delete", "coder", "--reason", "fired", "--business", "acme"], io(), d);
|
||||
assert.deepEqual(calls.map((c) => [c.who, c.verb, c.args]), [
|
||||
["human", "credentials", {}],
|
||||
["tester", "credentials", {}],
|
||||
["tester", "credentials.revoke", { agent: "coder", service: "gitea", reason: "fired" }],
|
||||
["human", "credentials.revoke", { agent: "coder", reason: "fired" }],
|
||||
["human", "credentials.delete", { agent: "coder", reason: "fired" }],
|
||||
]);
|
||||
calls.length = 0;
|
||||
for (const args of [
|
||||
["issue", "coder", "gitea", "--rotate-by", "2099-01-01", "--tester"],
|
||||
["rotate", "coder", "gitea", "--rotate-by", "2099-01-01", "--tester"],
|
||||
["delete", "coder", "--reason", "x", "--tester"],
|
||||
]) await assert.rejects(main(["credentials", ...args, "--business", "acme"], withStdin(io(), TOKEN), d), /--tester takes only status and revoke/);
|
||||
for (const args of [["revoke", "coder"], ["delete", "coder"], ["delete", "coder", "gitea", "--reason", "x"], ["revoke", "coder", "model", "--reason", "x"], ["purge", "coder"]])
|
||||
await assert.rejects(main(["credentials", ...args, "--business", "acme"], io(), d), /mosaic credentials/, args.join(" "));
|
||||
assert.equal(calls.length, 0);
|
||||
});
|
||||
|
||||
test("row 199: scripts/mosaic sends credentials to packages/cli, not the seat CLI", (t) => {
|
||||
const root = tmp(t, "mosaic-cli-cred-route-");
|
||||
const env = { PATH: process.env.PATH, HOME: join(root, "home"), MOSAIC_CONFIG: join(root, "none.json") };
|
||||
const r = spawnSync(MOSAIC, ["credentials", "purge"], { env, encoding: "utf8" });
|
||||
assert.equal(r.status, 4);
|
||||
assert.match(r.stderr, /^mosaic: mosaic credentials \[status \[AGENT\]\]/);
|
||||
assert.doesNotMatch(r.stderr, /mosaic launch </);
|
||||
});
|
||||
+1
-1
@@ -35,6 +35,6 @@ if [ "${1:-}" = business ]; then
|
||||
exec node "$REPO/packages/business/src/cli.mjs" "$@"
|
||||
fi
|
||||
case "${1:-}" in
|
||||
usage|project|limits|inbox|decide|tasks|agents|trail|talk|stop|launches|bus|plugins|name|names|follow|threads|thread) exec node "$REPO/packages/cli/src/cli.mjs" "$@" ;;
|
||||
usage|project|limits|inbox|decide|tasks|agents|trail|talk|stop|launches|bus|plugins|credentials|name|names|follow|threads|thread) exec node "$REPO/packages/cli/src/cli.mjs" "$@" ;;
|
||||
esac
|
||||
exec node "$REPO/packages/seat/src/cli.mjs" "$@"
|
||||
|
||||
Reference in New Issue
Block a user