IGA-4417: support JWE-encrypted credential issuance

[santhosh-c1]

Summary

• Bumps baton-sdk to v0.33.0, which ships baton-sdk #1152 (generic JWE provider baton/jwe/v1).
• The SDK now advertises CAPABILITY_CREDENTIAL_ENCRYPTION_JWE_XWING_V1 for any credential issuer. The connector needs no advertisement of its own, so the earlier vault-inbox profile is gone.
• The recipient key uses the existing JWKPublicKeyConfig plus additional_authenticated_data. The SDK validates it before issuing and requires exactly one plaintext.
• Both issuance kinds (service-account application key, org API key) already return exactly one plaintext. No connector code change.
• Regenerated baton_capabilities.json and added one line to docs/connector.mdx.

Testing

• go build ./...
• go test ./...

verify-versions-match passes once baton-admin bumps .versions.yaml on main to v0.33.0.

🤖 Generated with Claude Code

[linear-code]

IGA-4417

[github-actions]

Connector PR Review: IGA-4417: advertise vault-inbox delivery for issued credentials

Blocking Issues: 1 | Suggestions: 1 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base c2a39ea16dad.
Review mode: full
View review run

Review Summary

I scanned the full PR diff for security and correctness, including go.mod/go.sum and the vendored baton-sdk changes. The connector change itself is small and correct: both issuance descriptors advertise the X-Wing vault-inbox suite, and both issuance paths return exactly one plaintext, which the SDK's new cardinality check requires. The blocking issue is the SDK pin. It is a pseudo-version built on v0.32.0, so it silently removes features that shipped in v0.32.1.

Security Issues

None found.

Correctness Issues

• go.mod:7: baton-sdk v0.32.1-0.20260923055408-2e3ecc75cdfa sorts lower than v0.32.1 and is not built on it. The vendored diff removes v0.32.1 features: the --print-credentials field, WithOnDemandInvokeActionWithCredentialPrinting, and age decryption in tasks/local/action_invoker.go. This is an SDK downgrade (confidence: high).

Suggestions

• pkg/connector/users.go:60-65: The vaultInboxProfiles var is placed between IssueCapabilityDetails's doc comment and the method, so the doc now attaches to the var and the method is undocumented (confidence: high).

Prompt for AI agents

Verify each finding against the current code and only fix it if needed.

## Correctness Issues

In `go.mod`:
- Around line 7: The baton-sdk pseudo-version v0.32.1-0.20260923055408-2e3ecc75cdfa is built on v0.32.0. It sorts lower than v0.32.1 and drops v0.32.1 features (print-credentials field, WithOnDemandInvokeActionWithCredentialPrinting, local action-result age decryption), as the vendor/ diff shows. Repin to a baton-sdk commit that includes v0.32.1 (rebase the #1145 branch on v0.32.1+) or to the tagged release. Then run go mod tidy and go mod vendor so go.sum and vendor/modules.txt match.

## Suggestions

In `pkg/connector/users.go`:
- Around line 60-65: The new vaultInboxProfiles var declaration and its comment were inserted between the existing doc comment for IssueCapabilityDetails and the method. Go now attaches that doc block to the var. Move the var and its two-line comment above the IssueCapabilityDetails doc comment (or below the method), so the doc sits directly above the method.

[github-actions]

Blocking issues found — see review comments.

[github-actions]

Superseded — see the current review report for commit 4a007eae6a48

Connector PR Review: IGA-4417: support JWE-encrypted credential issuance

Blocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base 8db60734d56f.
Review mode: full
View review run

Review Summary

This PR changes no connector code. It bumps baton-sdk from v0.32.2 to v0.32.3-0.20260925004646-a0e2dec1816c, a pseudo-version built on v0.32.2 (the vendored sdk.Version is v0.32.2), plus a regenerated baton_capabilities.json and one doc line. The new SDK:

• adds the baton/jwe/v1 provider, based on HPKE X-Wing;
• adds an optional additional_authenticated_data field to JWKPublicKeyConfig, capped at 16 KiB;
• checks encryption configs before CreateAccount/Rotate mutate anything;
• requires exactly one plaintext output for JWE issuance;
• automatically advertises CAPABILITY_CREDENTIAL_ENCRYPTION_JWE for any registered credential issuer.

I scanned the full diff, including the vendored SDK, for security and correctness. The one new module import, filippo.io/hpke v0.4.0, is already in go.mod and vendored.

Both Datadog issuers return exactly one plaintext (pkg/connector/users.go:208-209 and :286-287), so they meet the new JWE cardinality check.

Repo-local criteria: the dependency-check and D1–D4 doc-staleness rules applied. The capability change is reflected in the docs and the regenerated capabilities file. The logging, span, JSON-typing, provisioning and breaking-change criteria were not relevant: no connector code, resource types, entitlements or IDs changed. Adding a capability counts as a safe additive change under B9.

The draft pseudo-version pin, and the verify-versions-match failure it causes until baton-sdk #1152 ships, are already explained in the PR body, so they are not a finding.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

None.

Resolved prior findings

• go.mod SDK downgrade (pseudo-version sorting below v0.32.1): fixed. go.mod:7 now pins v0.32.3-0.20260925004646-a0e2dec1816c, which sorts above the base v0.32.2. The vendored pkg/sdk/version.go moves from v0.32.1 to v0.32.2, and no v0.32.x features are removed in the vendored diff.
• vaultInboxProfiles var detaching the IssueCapabilityDetails doc comment: obsolete. The var has been removed (no vaultInbox references remain in pkg/), so the doc block at pkg/connector/users.go:49-62 attaches directly to the method at :63.

[github-actions]

Superseded — see the current review report for commit f50132dd74b0

Connector PR Review: IGA-4417: support JWE-encrypted credential issuance

Blocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base 8db60734d56f.
Review mode: full
View review run

Review Summary

This PR changes no connector code. It bumps baton-sdk from v0.32.2 to v0.32.3-0.20260925004646-a0e2dec1816c, a pseudo-version built on v0.32.2 (the vendored sdk.Version is v0.32.2), plus a regenerated baton_capabilities.json and one doc line. The new SDK:

• adds the baton/jwe/v1 provider, based on HPKE X-Wing;
• adds an optional additional_authenticated_data field to JWKPublicKeyConfig, capped at 16 KiB;
• checks encryption configs before CreateAccount/Rotate mutate anything;
• requires exactly one plaintext output for JWE issuance;
• automatically advertises CAPABILITY_CREDENTIAL_ENCRYPTION_JWE for any registered credential issuer.

I scanned the full diff, including the vendored SDK, for security and correctness. The one new module import, filippo.io/hpke v0.4.0, is already in go.mod and vendored.

Both Datadog issuers return exactly one plaintext (pkg/connector/users.go:208-209 and :286-287), so they meet the new JWE cardinality check.

Repo-local criteria: the dependency-check and D1–D4 doc-staleness rules applied. The capability change is reflected in the docs and the regenerated capabilities file. The logging, span, JSON-typing, provisioning and breaking-change criteria were not relevant: no connector code, resource types, entitlements or IDs changed. Adding a capability counts as a safe additive change under B9.

The draft pseudo-version pin, and the verify-versions-match failure it causes until baton-sdk #1152 ships, are already explained in the PR body, so they are not a finding.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

None.

Resolved prior findings

• go.mod SDK downgrade (pseudo-version sorting below v0.32.1): fixed. go.mod:7 now pins v0.32.3-0.20260925004646-a0e2dec1816c, which sorts above the base v0.32.2. The vendored pkg/sdk/version.go moves from v0.32.1 to v0.32.2, and no v0.32.x features are removed in the vendored diff.
• vaultInboxProfiles var detaching the IssueCapabilityDetails doc comment: obsolete. The var has been removed (no vaultInbox references remain in pkg/), so the doc block at pkg/connector/users.go:49-62 attaches directly to the method at :63.

---

Reviewed commit: 4a007eae6a48

[github-actions]

No blocking issues found — see the full review report

[github-actions]

Superseded — see the current review report for commit f50132dd74b0

Connector PR Review: IGA-4417: support JWE-encrypted credential issuance

Blocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base 8db60734d56f.
Review mode: incremental since 4a007ea
View review run

Review Summary

The new commit only repins baton-sdk from a0e2dec1816c to be4b4b7a1fff (go.mod, go.sum, vendor/modules.txt). That pulls in three vendored SDK changes:

• Validation timing. CreateAccount and RotateCredential now validate encryption configs only after the connector returns plaintexts, not before it mutates anything. IssueCredential still validates before minting (vendor/.../connectorbuilder/credentials.go:201).
• JWK bounds. The JWE provider's pub_key and AAD limits now come from the generated proto validator (16384 bytes for each, resource.pb.validate.go:8315,8326), replacing the exported MaxJWKBytes and MaxAdditionalAuthenticatedDataBytes constants. This repo doesn't reference those constants.
• Exported type. The SDK now exports a FlattenedJWE struct.

Impact on this connector:

• userBuilder.CreateAccount (pkg/connector/users.go:431-478) is NO_PASSWORD-only and returns nil plaintexts. The later validation therefore can't leave a minted credential stranded; it only stops an unused bad config from failing a successful provisioning.
• The connector doesn't implement Rotate.
• Issuance of both key kinds still validates before minting.

I scanned the full PR diff for security and correctness, including the 5 vendored paths dropped from the incremental artifact (accounts.go, credentials.go, crypto.go, jwe.go, modules.txt). The go.mod/go.sum bump matches the PR description, and I found no replace or exclude directives and no checksum changes for unrelated modules. I applied the trusted repo-local criteria. Most of them (A–G: logging, error wrapping, spans, JSON types, breaking-change gate, provisioning, ID stability) cover connector code this commit doesn't change. The vendored l.Error calls on validation failure are upstream SDK code, not the connector's own logging. The PR is still a draft pinned to an untagged SDK pseudo-version until baton-sdk #1152 is released, as the description says.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

None.

Resolved prior findings

• go.mod SDK downgrade (pseudo-version sorting below v0.32.1): fixed. go.mod:7 pins v0.32.3-0.20260925200843-be4b4b7a1fff, which is built on v0.32.2 and sorts above the base.
• vaultInboxProfiles var detaching the IssueCapabilityDetails doc comment: obsolete. The var was removed; pkg/ has no vaultInbox references, so the doc comment attaches directly to the method again.

[github-actions]

Superseded — see the current review report for commit fcaca782269f

Connector PR Review: IGA-4417: support JWE-encrypted credential issuance

Blocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base 8db60734d56f.
Review mode: incremental since 4a007ea
View review run

Review Summary

The new commit only repins baton-sdk from a0e2dec1816c to be4b4b7a1fff (go.mod, go.sum, vendor/modules.txt). That pulls in three vendored SDK changes:

• Validation timing. CreateAccount and RotateCredential now validate encryption configs only after the connector returns plaintexts, not before it mutates anything. IssueCredential still validates before minting (vendor/.../connectorbuilder/credentials.go:201).
• JWK bounds. The JWE provider's pub_key and AAD limits now come from the generated proto validator (16384 bytes for each, resource.pb.validate.go:8315,8326), replacing the exported MaxJWKBytes and MaxAdditionalAuthenticatedDataBytes constants. This repo doesn't reference those constants.
• Exported type. The SDK now exports a FlattenedJWE struct.

Impact on this connector:

• userBuilder.CreateAccount (pkg/connector/users.go:431-478) is NO_PASSWORD-only and returns nil plaintexts. The later validation therefore can't leave a minted credential stranded; it only stops an unused bad config from failing a successful provisioning.
• The connector doesn't implement Rotate.
• Issuance of both key kinds still validates before minting.

I scanned the full PR diff for security and correctness, including the 5 vendored paths dropped from the incremental artifact (accounts.go, credentials.go, crypto.go, jwe.go, modules.txt). The go.mod/go.sum bump matches the PR description, and I found no replace or exclude directives and no checksum changes for unrelated modules. I applied the trusted repo-local criteria. Most of them (A–G: logging, error wrapping, spans, JSON types, breaking-change gate, provisioning, ID stability) cover connector code this commit doesn't change. The vendored l.Error calls on validation failure are upstream SDK code, not the connector's own logging. The PR is still a draft pinned to an untagged SDK pseudo-version until baton-sdk #1152 is released, as the description says.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

None.

Resolved prior findings

• go.mod SDK downgrade (pseudo-version sorting below v0.32.1): fixed. go.mod:7 pins v0.32.3-0.20260925200843-be4b4b7a1fff, which is built on v0.32.2 and sorts above the base.
• vaultInboxProfiles var detaching the IssueCapabilityDetails doc comment: obsolete. The var was removed; pkg/ has no vaultInbox references, so the doc comment attaches directly to the method again.

---

Reviewed commit: f50132dd74b0

[github-actions]

No blocking issues found — see the full review report

[github-actions]

Superseded — see the current review report for commit fcaca782269f

Connector PR Review: IGA-4417: support JWE-encrypted credential issuance

Blocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base 8db60734d56f.
Review mode: incremental since f50132dd
View review run

Review Summary

The new commit moves baton-sdk from the v0.32.3-0.20260925200843-be4b4b7a1fff pseudo-version to the tagged v0.33.0 release. go.mod, go.sum, and vendor/modules.txt:281 all agree on the version. With the bump, the SDK's advertised capability changes from CAPABILITY_CREDENTIAL_ENCRYPTION_JWE to CAPABILITY_CREDENTIAL_ENCRYPTION_JWE_XWING_V1 (enum 16, vendor/.../connectorbuilder/connectorbuilder.go:422), and baton_capabilities.json was regenerated to match. Main never had the old capability, so nothing breaks for existing installs.

I scanned the full PR diff for security and correctness, including the four vendored paths left out of the incremental artifact (connector.pb.go, connector_protoopaque.pb.go, connectorbuilder.go, modules.txt). Their changes are consistent with the enum rename and the version pin. No connector code under pkg/ changed.

I applied the repo-local criteria: dependency checks, breaking-change gate BP1–BP5, and doc staleness D1–D4. The docs line added in docs/connector.mdx:28 covers the new behavior. The logging, span, JSON-type, and provisioning sections don't apply because no connector code changed.

Coverage note: the vendored SDK's pkg/sdk/version.go still reports v0.32.2 inside the v0.33.0 tag. That's an upstream release-process artifact, not something this repo can fix, so it isn't counted as a finding.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

None.

Resolved prior findings

• go.mod SDK downgrade (pseudo-version sorting below v0.32.1): fixed. go.mod:7 now pins the tagged v0.33.0 release.
• vaultInboxProfiles var detaching the IssueCapabilityDetails doc comment: obsolete. The var was removed, and pkg/ no longer references vaultInbox.

[github-actions]

Connector PR Review: IGA-4417: support JWE-encrypted credential issuance

Blocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base 8db60734d56f.
Review mode: incremental since f50132dd
View review run

Review Summary

The new commit moves baton-sdk from the v0.32.3-0.20260925200843-be4b4b7a1fff pseudo-version to the tagged v0.33.0 release. go.mod, go.sum, and vendor/modules.txt:281 all agree on the version. With the bump, the SDK's advertised capability changes from CAPABILITY_CREDENTIAL_ENCRYPTION_JWE to CAPABILITY_CREDENTIAL_ENCRYPTION_JWE_XWING_V1 (enum 16, vendor/.../connectorbuilder/connectorbuilder.go:422), and baton_capabilities.json was regenerated to match. Main never had the old capability, so nothing breaks for existing installs.

I scanned the full PR diff for security and correctness, including the four vendored paths left out of the incremental artifact (connector.pb.go, connector_protoopaque.pb.go, connectorbuilder.go, modules.txt). Their changes are consistent with the enum rename and the version pin. No connector code under pkg/ changed.

I applied the repo-local criteria: dependency checks, breaking-change gate BP1–BP5, and doc staleness D1–D4. The docs line added in docs/connector.mdx:28 covers the new behavior. The logging, span, JSON-type, and provisioning sections don't apply because no connector code changed.

Coverage note: the vendored SDK's pkg/sdk/version.go still reports v0.32.2 inside the v0.33.0 tag. That's an upstream release-process artifact, not something this repo can fix, so it isn't counted as a finding.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

None.

Resolved prior findings

• go.mod SDK downgrade (pseudo-version sorting below v0.32.1): fixed. go.mod:7 now pins the tagged v0.33.0 release.
• vaultInboxProfiles var detaching the IssueCapabilityDetails doc comment: obsolete. The var was removed, and pkg/ no longer references vaultInbox.

---

Reviewed commit: fcaca782269f

[github-actions]

No blocking issues found — see the full review report