fix(mosaic): harden credential lifecycle boundaries

2026-08-05 18:01:41 -05:00
parent 26203bd92c
commit e46e114d3b
13 changed files with 127 additions and 31 deletions
@@ -539,7 +539,7 @@ get_gitea_token() {
        if [[ -n "$_idpfx" ]]; then
            local _idtok="$HOME/.config/mosaic/secrets/gitea-tokens/${_idpfx}-${_ident}.token"
            local _idcred="$HOME/.config/mosaic/secrets/gitea-tokens/${_idpfx}-${_ident}.credential.json"
-            if [[ -r "$_idcred" ]]; then
+            if [[ -e "$_idcred" || -L "$_idcred" ]]; then
                local _resolved_token
                _resolved_token=$(python3 "$script_dir/resolve-credential-envelope.py" \
                    "$_idcred" "$_ident" "${MOSAIC_CREDENTIAL_ESTATE:-}" "$host") || return 1