claude-botandClaude Opus 4.8
808cb5397d
ci/woodpecker/push/build-ci-images Pipeline was successful
Addresses three review findings, all real bugs rather than style: 1. No timeouts anywhere. The Python this replaces passed timeout=30 on every call; ureq 3's default agent has none and tungstenite has no read timeout, so a hung endpoint would stall the Job silently until activeDeadlineSeconds with no useful error — and the cluster demonstrably has hanging paths (the ingress-LB hairpin). Now: a shared ureq::Agent with timeout_global(30s) threaded through every OpenBao call, and a 30s read timeout set on the TcpStream under tungstenite's socket (handling both plain and rustls streams). 2. RANDOM_BYTES=0 would generate a near-empty secret, store it, and report success — the same silent-misconfig class assert_fields_exist guards. Now floored at 16 bytes (128 bits); every real rotator uses 32 or 50. 3. If mint succeeds but the OpenBao store fails, the freshly minted token is valid for its full lifespan, referenced nowhere, and never auto-revoked (revocation only targets the OLD stored id). The store error path now logs the orphan's refresh-token id — recovered from its own JWT — so it can be revoked by hand, and makes clear the consumer is unaffected because the old token is still stored and valid. clippy -D warnings clean; 10 tests pass; scratch image builds (4.92 MB) and all error paths exit non-zero. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
12 lines
348 B
TOML
12 lines
348 B
TOML
[package]
|
|
name = "secret-rotator"
|
|
version = "0.1.0"
|
|
edition = "2024"
|
|
|
|
[dependencies]
|
|
base64 = "0.22.1"
|
|
getrandom = "0.4.3"
|
|
serde_json = "1.0.151"
|
|
tungstenite = { version = "0.30.0", default-features = false, features = ["rustls-tls-webpki-roots", "handshake"] }
|
|
ureq = { version = "3.3.0", default-features = false, features = ["rustls", "json"] }
|