zeekayandGitHub 353e128b3c feat(iam): social login config + IAM auth contract docs (#12) ...

* docs: iam-auth verification runbook (Phase 6)

Companion to the iam-side social-login work. Documents how to verify
the end-to-end trust chain user → IAM JWT → KMS RBAC against live
production at kms.hanzo.ai.

Six exercises:
  1. Mint a JWT via /v1/iam/oauth/access_token (password grant).
  2. Sanity-check claims (iss, aud, owner, exp) without sig verify.
  3. Hit /v1/secrets/list with the JWT; expect 200.
  4. Negative path: malformed JWT must 401.
  5. Org-scope test: token from a different org must 403 on a
     workspace it can't see.
  6. JWKS rotation smoke test: confirm /v1/iam/.well-known/jwks
     returns asymmetric keys only (HS*/none = P0).

Notes:
  * Workspaces for live test are pre-existing (project hanzo-iam,
    env=prod). No new KMS state is created by running this runbook.
  * Recommended cadence: post-deploy smoke job in CI (script at
    ~/work/hanzo/kms/e2e/iam-auth-smoke.sh, unwritten — placeholder
    in the runbook).

* docs: IAM auth contract + Phase 6 verification runbook

- docs/IAM_AUTH.md: canonical RFC 7519 contract — algorithms allowed,
  claim shape required, failure classes, no oracle in body
- docs/runbooks/iam-auth-verification.md: end-to-end production
  verification path (user → IAM JWT → KMS RBAC)
- go.mod: bump hanzoai/zip → v0.1.0, luxfi/zap → v0.3.1, modernc.org/sqlite → v1.50.0

* fix(ci): drop ../cloud + ../zip replace directives, use pinned versions

- hanzoai/zip v0.1.0 → v0.2.0
- hanzoai/cloud v0.0.0 → v0.1.1-0.20260519183759-098489930d01 (resolvable pseudo from main)
- Drop replace block — CI runners can resolve via proxy.golang.org

2026-05-19 11:51:13 -07:00

..

iam-auth-verification.md

feat(iam): social login config + IAM auth contract docs (#12)

2026-05-19 11:51:13 -07:00