licences: submit-refresh, the module-produced refresh entry point
Phase C of model-access (ADR 0050). Refresh above calls an in-process VendorRefresher, which would open the at-rest envelope inside the control plane's own process. Anthropic must not: its refresh runs on the manager node. So add SubmitRefresh, the companion that publishes a refresh a manager node already performed -- it is given only the new access token in the clear (sealed per holder, as any accepted key) and an opaque re-sealed refresh envelope (stored unopened). The refresh token in the clear never crosses this boundary. The reseal-and-publish half is extracted and shared with Refresh, so the sealing logic is one implementation. CLI: licence grant (print the opaque envelope), set-grant (store a module-produced envelope -- adoption), submit-refresh (access token + optional rotated envelope). Tests defend that the manager alone opens the refresh token and the control plane never holds it in the clear. Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF
This commit is contained in:
+223
-2
@@ -7,8 +7,11 @@ import (
|
||||
"errors"
|
||||
"flag"
|
||||
"fmt"
|
||||
"io"
|
||||
"os"
|
||||
"strings"
|
||||
|
||||
"github.com/novox/mesh-control/internal/secrets"
|
||||
)
|
||||
|
||||
// licenceCommand is everything about model access the mesh holds.
|
||||
@@ -18,7 +21,8 @@ import (
|
||||
// them too, because the whole point is saying which one a given consumer uses.
|
||||
func licenceCommand(ctx context.Context, args []string) error {
|
||||
if len(args) == 0 {
|
||||
return errors.New("licence add|list|use|release|key|manager|refresh|forget")
|
||||
return errors.New(
|
||||
"licence add|list|use|release|key|manager|grant|set-grant|refresh|submit-refresh|forget")
|
||||
}
|
||||
switch args[0] {
|
||||
case "add":
|
||||
@@ -33,13 +37,20 @@ func licenceCommand(ctx context.Context, args []string) error {
|
||||
return licenceKey(ctx, args[1:])
|
||||
case "manager":
|
||||
return licenceManager(ctx, args[1:])
|
||||
case "grant":
|
||||
return licenceGrant(ctx, args[1:])
|
||||
case "set-grant":
|
||||
return licenceSetGrant(ctx, args[1:])
|
||||
case "refresh":
|
||||
return licenceRefresh(ctx, args[1:])
|
||||
case "submit-refresh":
|
||||
return licenceSubmitRefresh(ctx, args[1:])
|
||||
case "forget":
|
||||
return licenceForget(ctx, args[1:])
|
||||
}
|
||||
return fmt.Errorf(
|
||||
"licence %q; it is add, list, use, release, key, manager, refresh or forget", args[0])
|
||||
"licence %q; it is add, list, use, release, key, manager, grant, set-grant, refresh, "+
|
||||
"submit-refresh or forget", args[0])
|
||||
}
|
||||
|
||||
func licenceAdd(ctx context.Context, args []string) error {
|
||||
@@ -256,6 +267,216 @@ func licenceManager(ctx context.Context, args []string) error {
|
||||
return nil
|
||||
}
|
||||
|
||||
// envelopeJSON is the wire shape of a refresh-token at-rest envelope on this command surface: the
|
||||
// three opaque parts of secrets.AtRest and nothing else.
|
||||
//
|
||||
// **Every field of it is ciphertext or a public key.** `token` is the refresh token under a data
|
||||
// key, `wrapped_key` is that data key sealed to the manager node, `manager_key` is the manager's
|
||||
// public sealing key. None of them is the refresh token in the clear — which is why this surface may
|
||||
// print one out (`grant`) and read one in (`set-grant`, `submit-refresh`) without the control plane
|
||||
// ever holding a refresh token it could read. The manager runtime, on the manager node, is the only
|
||||
// place these open (novox/hq ADR 0050, Phase C).
|
||||
type envelopeJSON struct {
|
||||
Token string `json:"token"`
|
||||
WrappedKey string `json:"wrapped_key"`
|
||||
ManagerKey string `json:"manager_key"`
|
||||
}
|
||||
|
||||
func (e envelopeJSON) atRest() secrets.AtRest {
|
||||
return secrets.AtRest{Token: e.Token, WrappedKey: e.WrappedKey, ManagerKey: e.ManagerKey}
|
||||
}
|
||||
|
||||
func envelopeOf(a secrets.AtRest) envelopeJSON {
|
||||
return envelopeJSON{Token: a.Token, WrappedKey: a.WrappedKey, ManagerKey: a.ManagerKey}
|
||||
}
|
||||
|
||||
// readEnvelope reads an at-rest envelope from a file or standard input as JSON.
|
||||
func readEnvelope(from string) (envelopeJSON, error) {
|
||||
var raw []byte
|
||||
var err error
|
||||
if from != "" {
|
||||
raw, err = os.ReadFile(from)
|
||||
} else {
|
||||
raw, err = readAllStdin()
|
||||
}
|
||||
if err != nil {
|
||||
return envelopeJSON{}, err
|
||||
}
|
||||
var env envelopeJSON
|
||||
if err := json.Unmarshal(raw, &env); err != nil {
|
||||
return envelopeJSON{}, fmt.Errorf("the refresh-token envelope is not JSON: %w", err)
|
||||
}
|
||||
if env.Token == "" || env.WrappedKey == "" || env.ManagerKey == "" {
|
||||
return envelopeJSON{}, errors.New(
|
||||
"an at-rest envelope is {token, wrapped_key, manager_key}, and one part is missing")
|
||||
}
|
||||
return env, nil
|
||||
}
|
||||
|
||||
func readAllStdin() ([]byte, error) {
|
||||
reader := bufio.NewReader(os.Stdin)
|
||||
return io.ReadAll(reader)
|
||||
}
|
||||
|
||||
// licenceGrant prints a licence's refresh-token envelope, so the manager runtime can fetch the
|
||||
// opaque thing it will open on the manager node (novox/hq ADR 0050, Phase C).
|
||||
//
|
||||
// **What is printed is ciphertext.** The envelope is the refresh token sealed at rest to the manager
|
||||
// node's key; it opens nowhere but that node. Printing it here is how the manager runtime — which
|
||||
// does not read this database directly — is handed the envelope to open, and it discloses nothing a
|
||||
// copy of the store did not already hold.
|
||||
func licenceGrant(ctx context.Context, args []string) error {
|
||||
if len(args) != 1 {
|
||||
return errors.New("licence grant <name>")
|
||||
}
|
||||
name := args[0]
|
||||
|
||||
held, err := openLicences(ctx)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer held.Close()
|
||||
|
||||
at, ok, err := held.RefreshGrant(ctx, name)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if !ok {
|
||||
// Said, not printed as an empty object: a licence with no grant and a failed read must not
|
||||
// look the same to whatever parses this.
|
||||
return fmt.Errorf(
|
||||
"%q has no refresh token stored; its manager adopts one first with `licence set-grant %s`",
|
||||
name, name)
|
||||
}
|
||||
out, err := json.Marshal(envelopeOf(at))
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
fmt.Println(string(out))
|
||||
return nil
|
||||
}
|
||||
|
||||
// licenceSetGrant stores a refresh-token envelope the manager runtime produced — adoption, and the
|
||||
// re-seal after a rotation done outside this process (novox/hq ADR 0050, Phase C).
|
||||
//
|
||||
// **It takes an envelope, never a refresh token.** The manager node reads the operator's refresh
|
||||
// token, seals it at rest to its own key, and hands the sealed envelope here. So the one moment a
|
||||
// refresh token is in the clear is on the manager node, never in the control plane — the same bound
|
||||
// the whole carve-out keeps. This surface refuses anything that is not a complete envelope rather
|
||||
// than storing half of one.
|
||||
func licenceSetGrant(ctx context.Context, args []string) error {
|
||||
set := flag.NewFlagSet("licence set-grant", flag.ContinueOnError)
|
||||
from := set.String("file", "", "read the envelope from a file instead of standard input")
|
||||
positionals, err := parseAround(set, args)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if len(positionals) != 1 {
|
||||
return errors.New("licence set-grant <name> [--file <path>]")
|
||||
}
|
||||
name := positionals[0]
|
||||
|
||||
env, err := readEnvelope(*from)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
held, err := openLicences(ctx)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer held.Close()
|
||||
if err := held.SetRefreshGrant(ctx, name, env.atRest()); err != nil {
|
||||
return err
|
||||
}
|
||||
fmt.Printf("%s now holds a refresh token for %s, encrypted at rest and readable by that node "+
|
||||
"alone.\n the control plane stored the envelope without opening it\n",
|
||||
"the manager", name)
|
||||
return nil
|
||||
}
|
||||
|
||||
// licenceSubmitRefresh publishes a refresh a MANAGER NODE already performed: the new access token is
|
||||
// sealed to every holder, and a rotated refresh token replaces the stored envelope (novox/hq ADR
|
||||
// 0050, Phase C).
|
||||
//
|
||||
// **This is the boundary the invariant rests on.** The manager runtime, on the manager node, opened
|
||||
// the at-rest envelope with that node's key, called the vendor's OAuth endpoint, and produced this:
|
||||
// the new access token in the clear, and — only if the vendor rotated it — the refresh token already
|
||||
// re-sealed at rest. This reads exactly those two things and no refresh token in the clear ever
|
||||
// reaches it, because it is never given one. The access token is sealed per holder and discarded,
|
||||
// as any accepted key is; the rotated envelope is stored opaque.
|
||||
func licenceSubmitRefresh(ctx context.Context, args []string) error {
|
||||
set := flag.NewFlagSet("licence submit-refresh", flag.ContinueOnError)
|
||||
accessFrom := set.String("access-file", "",
|
||||
"read the new access token from a file instead of standard input")
|
||||
grantFrom := set.String("grant-file", "",
|
||||
"the rotated refresh-token envelope, if the vendor rotated it; omit if it did not")
|
||||
positionals, err := parseAround(set, args)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if len(positionals) != 1 {
|
||||
return errors.New(
|
||||
"licence submit-refresh <name> [--access-file <path>] [--grant-file <path>]")
|
||||
}
|
||||
name := positionals[0]
|
||||
|
||||
var accessToken string
|
||||
if *accessFrom != "" {
|
||||
raw, err := os.ReadFile(*accessFrom)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
accessToken = strings.TrimSpace(string(raw))
|
||||
} else {
|
||||
raw, err := readAllStdin()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
accessToken = strings.TrimSpace(string(raw))
|
||||
}
|
||||
if accessToken == "" {
|
||||
return errors.New("no access token was given, so there is nothing to seal")
|
||||
}
|
||||
|
||||
// The rotated envelope is optional: absent, the stored refresh token is left exactly as it was.
|
||||
var rotated *secrets.AtRest
|
||||
if *grantFrom != "" {
|
||||
env, err := readEnvelope(*grantFrom)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
at := env.atRest()
|
||||
rotated = &at
|
||||
}
|
||||
|
||||
open, err := openStores(ctx)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer open.Close()
|
||||
held, err := open.Licences(ctx)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
inv := open.inventory
|
||||
|
||||
sealed, err := held.SubmitRefresh(ctx, name, accessToken, rotated, func(node string) (string, error) {
|
||||
return inv.SealingKeyOf(ctx, node)
|
||||
})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
rotatedNote := "the refresh token was left with its manager unchanged"
|
||||
if rotated != nil {
|
||||
rotatedNote = "the rotated refresh token replaced the stored envelope, still readable by the " +
|
||||
"manager node alone"
|
||||
}
|
||||
fmt.Printf("submitted a refresh for %s: a new access token sealed to %d holder(s), and %s.\n"+
|
||||
" run `push` to deliver it\n", name, sealed, rotatedNote)
|
||||
return nil
|
||||
}
|
||||
|
||||
// licenceRefresh mints a new access token for a refreshable-grant licence and seals it to every
|
||||
// holder (novox/hq ADR 0050). The refresh token stays with the manager and is never delivered.
|
||||
//
|
||||
|
||||
Reference in New Issue
Block a user