Repository navigation
feat!: mint once — a solution authenticates with its pod's projected token - #59
Merged
Merged
Conversation
…token The platform host no longer accepts a solution registration secret or any identity secret (codefly-dev/module-saas-starter#1068): every mint is bound to the calling pod's projected ServiceAccount token (audience accounts, ≤ 600 s), its running build and its one principal. - The runtime reads /var/run/secrets/codefly/token fresh and bounded before every mint and presents it as the bearer; a missing, empty or unreadable token fails closed. The principal is the solution's declared name. - A refusal (401/403) is terminal and retained; only 503 and transient transport failures are retried. - Mint errors carry fixed messages only; credential-source errors drop diagnostic text and underlying causes. - Breaking: WorkContextRefusal.Code and .Message are removed; use .StatusCode. The registration-secret configuration is deleted. Tests: token defaults, rotation and bounds, unreadable projections, error and log redaction, concurrent refusal retention. The full race suite passes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Review of the mint-once change found that the execution mint still spoke the older work-context exchange and never submitted the solution's prefix, that retries covered more than 503 and transient transport failures, and that the legacy-secret test no longer exercised a secret-enabled path. - The execution mint now speaks the host's broker protocol as saas-sdk-go's moduleauthority defines it — the path, the projected bearer, the internal perimeter header and the request fields including the declared prefix — implemented natively (importing the SDK conflicts with this runtime's credential SDK). A conformance test drives a fake broker with the exact request shape. - Only 503 and transient transport failures retry; 400, 404, 429 and other statuses are terminal errors and 401/403 terminal refusals. - The legacy-secret test sets non-empty legacy variables and proves no path reads them. - Tests whose fixtures encoded the old protocol now assert the same behaviour under the broker contract; dead code is deleted. Nine mutations caught; the full suite passes; lint reports no issues. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The host no longer accepts a solution registration secret (codefly-dev/module-saas-starter#1068). This moves the runtime to the projected-token mint.
/var/run/secrets/codefly/tokenfresh and bounded before every mint, and presents it as the bearer. A missing, empty or unreadable token fails closed.WorkContextRefusal.Codeand.Messageare removed; use.StatusCode. The registration-secret configuration is deleted.The runtime implements the token contract natively. It does not use saas-sdk-go's moduleauthority client, which pins a credential API this runtime no longer has.
Classification: fix at the owner.
Verified:
go build,go vetand the full race suite pass.🤖 Generated with Claude Code