Both modules declare go 1.27.1 and the build images follow. go fix applied
the modernizers: promoted-field keys in struct literals, SplitSeq,
strings.Cut, new(expr), slices.Contains and any. The ptr helper had no
callers left once new(expr) could say it. omitzero is not applied; it
changes what the JSON says, so it is a per-field decision.
Co-authored-by: Hanzo Dev <[email protected]>
This package kept its own HTTP secret plane — routes, an audit log, version CAS
and a JWT gate — beside the one cloud already serves at
/v1/kms/orgs/{org}/secrets. Two doors onto the same store means two places
where a tenant boundary can be got wrong, and only one of them was reviewed as
the authorization surface.
What is left is storage and the ZAP transport, whose authorizer is a signed
consensus-authority snapshot and which stays disabled unless that snapshot is
present. This package now makes no authorization decision at all: IAM owns
identity, cloud folds the caller's validated org into the storage key so one
tenant's path cannot name another's record, and secrets are sealed at rest with
the replicator streaming encrypted backups to S3.
go.sum carried a stale pair for luxfi/vm v1.3.1 — the tag was republished, and
the entries here predated it, so nothing in the module could build. The values
now match the public checksum database, which six other repos in the estate
already agreed with.
Co-authored-by: Hanzo Dev <[email protected]>
verifyJWT compared the token iss against the ENTIRE IAM_ISSUER string, so a
comma-list ('https://hanzo.id,https://iam.hanzo.ai,https://hanzo.ai') — the
production config — rejected every real token as wrong_iss. (The 2.x line
carried this split; it was lost in the 0.159.x re-baseline.) Mirror
checkAudience: split IAM_ISSUER on ',' into an allowlist, drop the single-value
jwt.WithIssuer, enforce via checkIssuer post-parse (trailing-slash normalized).
Single-issuer + wrong/attacker/missing-iss rejection unchanged.
Test: TestJWT_MultiIssuer_Accepted (3 listed issuers accepted, evil rejected);
existing F1 issuer-rejection + F4 multi-audience + TestList suites still green.
zeekayandHanzo Dev