mirror of
https://github.com/hanzoai/kms.git
synced 2026-10-17 11:18:16 +00:00
zeekayandGitHub
353e128b3c
* docs: iam-auth verification runbook (Phase 6)
Companion to the iam-side social-login work. Documents how to verify
the end-to-end trust chain user → IAM JWT → KMS RBAC against live
production at kms.hanzo.ai.
Six exercises:
1. Mint a JWT via /v1/iam/oauth/access_token (password grant).
2. Sanity-check claims (iss, aud, owner, exp) without sig verify.
3. Hit /v1/secrets/list with the JWT; expect 200.
4. Negative path: malformed JWT must 401.
5. Org-scope test: token from a different org must 403 on a
workspace it can't see.
6. JWKS rotation smoke test: confirm /v1/iam/.well-known/jwks
returns asymmetric keys only (HS*/none = P0).
Notes:
* Workspaces for live test are pre-existing (project hanzo-iam,
env=prod). No new KMS state is created by running this runbook.
* Recommended cadence: post-deploy smoke job in CI (script at
~/work/hanzo/kms/e2e/iam-auth-smoke.sh, unwritten — placeholder
in the runbook).
* docs: IAM auth contract + Phase 6 verification runbook
- docs/IAM_AUTH.md: canonical RFC 7519 contract — algorithms allowed,
claim shape required, failure classes, no oracle in body
- docs/runbooks/iam-auth-verification.md: end-to-end production
verification path (user → IAM JWT → KMS RBAC)
- go.mod: bump hanzoai/zip → v0.1.0, luxfi/zap → v0.3.1, modernc.org/sqlite → v1.50.0
* fix(ci): drop ../cloud + ../zip replace directives, use pinned versions
- hanzoai/zip v0.1.0 → v0.2.0
- hanzoai/cloud v0.0.0 → v0.1.1-0.20260519183759-098489930d01 (resolvable pseudo from main)
- Drop replace block — CI runners can resolve via proxy.golang.org