fix(mosaic): make credential lifecycle transactional

2026-08-05 18:01:41 -05:00
parent fa301afb8c
commit 791c57157a
13 changed files with 389 additions and 43 deletions
@@ -516,6 +516,11 @@ get_gitea_token() {
        _ident="$(git config --get mosaic.gitIdentity 2>/dev/null || true)"
        _ident_src="git config mosaic.gitIdentity"
    fi
+    if [[ -n "${MOSAIC_AGENT_NAME:-}" && -n "$_ident" && "$_ident" != "$MOSAIC_AGENT_NAME" ]]; then
+        printf 'MOSAIC_CREDENTIAL_REFUSAL outcome=refused reason=provider-identity-mismatch identity=%s fleet_identity=%s host=%s shared_path_entered=false source=%s\n' \
+            "$_ident" "$MOSAIC_AGENT_NAME" "$host" "$_ident_src" >&2
+        return 1
+    fi
    if [[ -n "$_ident" ]]; then
        local _idpfx=""
        case "$host" in