mirror of
https://github.com/hanzoai/kms.git
synced 2026-10-17 11:18:16 +00:00
zeekayandGitHub
353e128b3c
* docs: iam-auth verification runbook (Phase 6)
Companion to the iam-side social-login work. Documents how to verify
the end-to-end trust chain user → IAM JWT → KMS RBAC against live
production at kms.hanzo.ai.
Six exercises:
1. Mint a JWT via /v1/iam/oauth/access_token (password grant).
2. Sanity-check claims (iss, aud, owner, exp) without sig verify.
3. Hit /v1/secrets/list with the JWT; expect 200.
4. Negative path: malformed JWT must 401.
5. Org-scope test: token from a different org must 403 on a
workspace it can't see.
6. JWKS rotation smoke test: confirm /v1/iam/.well-known/jwks
returns asymmetric keys only (HS*/none = P0).
Notes:
* Workspaces for live test are pre-existing (project hanzo-iam,
env=prod). No new KMS state is created by running this runbook.
* Recommended cadence: post-deploy smoke job in CI (script at
~/work/hanzo/kms/e2e/iam-auth-smoke.sh, unwritten — placeholder
in the runbook).
* docs: IAM auth contract + Phase 6 verification runbook
- docs/IAM_AUTH.md: canonical RFC 7519 contract — algorithms allowed,
claim shape required, failure classes, no oracle in body
- docs/runbooks/iam-auth-verification.md: end-to-end production
verification path (user → IAM JWT → KMS RBAC)
- go.mod: bump hanzoai/zip → v0.1.0, luxfi/zap → v0.3.1, modernc.org/sqlite → v1.50.0
* fix(ci): drop ../cloud + ../zip replace directives, use pinned versions
- hanzoai/zip v0.1.0 → v0.2.0
- hanzoai/cloud v0.0.0 → v0.1.1-0.20260519183759-098489930d01 (resolvable pseudo from main)
- Drop replace block — CI runners can resolve via proxy.golang.org
80 lines
3.2 KiB
AMPL
80 lines
3.2 KiB
AMPL
module github.com/hanzoai/kms
|
|
|
|
// Hanzo KMS is a thin wrapper over the canonical luxfi/kms implementation.
|
|
// All server logic lives in github.com/luxfi/kms. This module provides:
|
|
// - cmd/kmsd : daemon with Hanzo defaults (port 8443, /data/hanzo-kms, branding)
|
|
// - cmd/kms : admin CLI (uses pkg/kmsclient)
|
|
// - pkg/kmsclient : Go client library used by other Hanzo services
|
|
//
|
|
// Wire-compatible with luxfi clients on both HTTP (/v1/kms/*) and ZAP
|
|
// (opcodes 0x0040..0x0043).
|
|
|
|
go 1.26.3
|
|
|
|
require (
|
|
github.com/golang-jwt/jwt/v5 v5.3.1
|
|
github.com/hanzoai/cloud v0.1.1-0.20260519183759-098489930d01
|
|
github.com/hanzoai/zip v0.2.0
|
|
github.com/luxfi/kms v1.5.2
|
|
github.com/luxfi/log v1.4.3
|
|
github.com/luxfi/zap v0.3.1
|
|
github.com/luxfi/zapdb v1.9.0
|
|
modernc.org/sqlite v1.50.0
|
|
)
|
|
|
|
require (
|
|
filippo.io/hpke v0.4.0 // indirect
|
|
github.com/andybalholm/brotli v1.2.1 // indirect
|
|
github.com/cenkalti/backoff v2.2.1+incompatible // indirect
|
|
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
|
github.com/dgraph-io/ristretto/v2 v2.4.0 // indirect
|
|
github.com/dustin/go-humanize v1.0.1 // indirect
|
|
github.com/go-ini/ini v1.67.0 // indirect
|
|
github.com/go-logr/logr v1.4.3 // indirect
|
|
github.com/go-logr/stdr v1.2.2 // indirect
|
|
github.com/gofiber/fiber/v3 v3.2.0 // indirect
|
|
github.com/gofiber/schema v1.7.1 // indirect
|
|
github.com/gofiber/utils/v2 v2.0.4 // indirect
|
|
github.com/google/flatbuffers v25.12.19+incompatible // indirect
|
|
github.com/google/uuid v1.6.0 // indirect
|
|
github.com/grandcat/zeroconf v1.0.0 // indirect
|
|
github.com/klauspost/compress v1.18.5 // indirect
|
|
github.com/klauspost/cpuid/v2 v2.3.0 // indirect
|
|
github.com/klauspost/crc32 v1.3.0 // indirect
|
|
github.com/luxfi/age v1.5.0 // indirect
|
|
github.com/luxfi/mdns v0.1.0 // indirect
|
|
github.com/mattn/go-colorable v0.1.14 // indirect
|
|
github.com/mattn/go-isatty v0.0.21 // indirect
|
|
github.com/miekg/dns v1.1.72 // indirect
|
|
github.com/minio/crc64nvme v1.1.1 // indirect
|
|
github.com/minio/md5-simd v1.1.2 // indirect
|
|
github.com/minio/minio-go/v7 v7.0.100 // indirect
|
|
github.com/ncruces/go-strftime v1.0.0 // indirect
|
|
github.com/philhofer/fwd v1.2.0 // indirect
|
|
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
|
|
github.com/rs/xid v1.6.0 // indirect
|
|
github.com/tinylib/msgp v1.6.4 // indirect
|
|
github.com/valyala/bytebufferpool v1.0.0 // indirect
|
|
github.com/valyala/fasthttp v1.70.0 // indirect
|
|
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
|
|
go.opentelemetry.io/otel v1.43.0 // indirect
|
|
go.opentelemetry.io/otel/metric v1.43.0 // indirect
|
|
go.opentelemetry.io/otel/trace v1.43.0 // indirect
|
|
go.yaml.in/yaml/v3 v3.0.4 // indirect
|
|
golang.org/x/crypto v0.50.0 // indirect
|
|
golang.org/x/mod v0.34.0 // indirect
|
|
golang.org/x/net v0.53.0 // indirect
|
|
golang.org/x/sync v0.20.0 // indirect
|
|
golang.org/x/sys v0.43.0 // indirect
|
|
golang.org/x/text v0.36.0 // indirect
|
|
golang.org/x/tools v0.43.0 // indirect
|
|
google.golang.org/protobuf v1.36.11 // indirect
|
|
gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
|
|
modernc.org/libc v1.72.0 // indirect
|
|
modernc.org/mathutil v1.7.1 // indirect
|
|
modernc.org/memory v1.11.0 // indirect
|
|
)
|
|
|
|
// Local development: point at sibling lux/kms checkout. CI overrides with
|
|
// the published version via GOPROXY.
|