k2safe/orbit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: support permanent credentials and overlapping token rotation

Browse Source
This commit is contained in:
k2safe
2026-09-27 11:45:15 +08:00
parent 87aa710013
commit 385a618154
29 changed files with 718 additions and 161 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
scripts/orbit-local.py
View File

@@ -137,7 +137,7 @@ def setup():
print('Docker network: orbit-test-services; API: http://orbit-test:8080')
print('Admin: admin; password file: ' + str(PRIVATE / 'admin.password'))
print('SDK settings: ' + str(PRIVATE / 'host.env') + ' / docker.env')
print('Credential expires_at: ' + credential['expires_at'])
print('Credential expiry: ' + (status.get('expires_at') or 'permanent'))
def main():

26
scripts/test-console-applications.py
View File

@@ -69,13 +69,33 @@ subscription_id = sub['subscription']['id']
task = call('/v1/tasks', {'queue_id': queue, 'handler': 'onboarding.noop', 'handler_version': 'v1', 'payload_version': 'v1', 'payload': {}}, token=op['token'], headers={'Idempotency-Key': 'onboarding-task'}, expected=201, session=False)
task_id = task['task']['id']
call('/v1/tasks/' + task_id + ':cancel', {'expected_revision': task['task']['revision'], 'reason': 'acceptance complete'}, token=op['token'], headers={'Idempotency-Key': 'onboarding-cancel'}, session=False)
rotate = call('/console/applications/prepare', {'kind': 'ROTATE', 'namespace_id': op['namespace_id'], 'credential_id': op['credential_id'], 'expected_revision': '1', 'valid_days': 30, 'reason': 'rotation acceptance'})
expiry = call('/console/applications/prepare', {'kind': 'SET_EXPIRY', 'namespace_id': op['namespace_id'], 'credential_id': op['credential_id'], 'expected_revision': '1', 'valid_days': 0, 'reason': 'long-lived service credential'})
assert 'token' not in expiry and 'expires_at' not in expiry
if private:
Path(private, 'expiry.operation.json').write_text(json.dumps(expiry))
assert call('/console/applications/apply', expiry)['revision'] == '2'
assert call('/console/applications/apply', expiry)['deduplicated']
assert 'expires_at' not in call('/console/applications/' + op['namespace_id'])['credentials'][0]
call('/v1/queues/' + queue, token=op['token'], session=False)
rotate = call('/console/applications/prepare', {'kind': 'ROTATE', 'namespace_id': op['namespace_id'], 'credential_id': op['credential_id'], 'expected_revision': '2', 'valid_days': 0, 'grace_days': 7, 'reason': 'rotation acceptance'})
if private:
Path(private, 'rotate.operation.json').write_text(json.dumps(rotate))
assert call('/console/applications/apply', rotate)['revision'] == '2'
assert call('/console/applications/apply', rotate)['revision'] == '3'
assert call('/console/applications/apply', rotate)['deduplicated']
call('/v1/queues/' + queue, token=op['token'], session=False)
call('/v1/queues/' + queue, token=rotate['token'], session=False)
assert call('/console/applications/' + op['namespace_id'])['credentials'][0]['previous_valid_until']
finalize = call('/console/applications/prepare', {'kind': 'FINALIZE', 'namespace_id': op['namespace_id'], 'credential_id': op['credential_id'], 'expected_revision': '3', 'valid_days': 0, 'reason': 'all services switched'})
if private:
Path(private, 'finalize.operation.json').write_text(json.dumps(finalize))
assert 'token' not in finalize
assert call('/console/applications/apply', finalize)['revision'] == '4'
assert call('/console/applications/apply', finalize)['deduplicated']
call('/v1/queues/' + queue, token=op['token'], expected=401, session=False)
call('/v1/queues/' + queue, token=rotate['token'], session=False)
# 重放旧轮换回执不能重新启用已经结束过渡的秘密。
assert call('/console/applications/apply', rotate)['deduplicated']
call('/v1/queues/' + queue, token=op['token'], expected=401, session=False)
current_task = call('/v1/tasks/' + task_id, token=rotate['token'], session=False)
assert current_task['state'] == 'CANCELLED'
current_sub = call('/v1/subscriptions/' + subscription_id, token=rotate['token'], session=False)
@@ -87,5 +107,5 @@ if private:
Path(private, 'result.json').write_text(json.dumps({'application': name, 'namespace_id': op['namespace_id'], 'queue_id': queue, 'credential_id': op['credential_id'], 'task_id': task_id, 'subscription_id': subscription_id}))
call('/console/auth/logout', {})
call('/console/applications', expected=401)
print('PASS: application create/replay, CSRF/session isolation, token rotation, original task/subscription preserved, logout')
print('PASS: application create/replay, CSRF/session isolation, permanent expiry, overlapping rotation/finalization, original task/subscription preserved, logout')
print('Test application: ' + name)