OpenAgents

Commit

Open retained Sarah GitHub tokens

5722913cb1b9 · AtlantisPleb · · parent a28428145a10 

Open retained Sarah GitHub tokens

Deploy story

What this commit did to the running system — joined from the forge receipt chain, the part a commit page elsewhere cannot show.

Not deployed through the forge lane

No push, promotion, build, or deploy receipt references this commit (receipts are scanned over a bounded recent window). Changes shipped by full node replacement carry their proof in the release gate receipt instead.

Changed files

  • modified lib/openagents/accounts/token_vault.ex
  • modified test/openagents/accounts/token_vault_test.exs

Diff

2 files changed, +28 -5

lib/openagents/accounts/token_vault.ex modified +7 -5

@@ -4,7 +4,7 @@ defmodule OpenAgents.Accounts.TokenVault do

4 4 
  @version 2
5 5 
  @legacy_version 1
6 6 
  @aad_prefix "openagents.github_access_token.v2:"
7 
  @legacy_aad "openagents.github_access_token.v1"
7 
  @legacy_aads ["sarah.github_access_token.v1", "openagents.github_access_token.v1"]
8 8 
  @nonce_bytes 12
9 9 
  @tag_bytes 16
10 10 
  @maximum_token_bytes 512

@@ -59,10 +59,12 @@ defmodule OpenAgents.Accounts.TokenVault do

59 59
60 60 
      keys ->
61 61 
        case Enum.find_value(keys, fn key ->
62 
               case decrypt(key, nonce, ciphertext, @legacy_aad, tag) do
63 
                 {:ok, token} -> {:ok, token}
64 
                 {:error, :token_unsealable} -> nil
65 
               end
62 
               Enum.find_value(@legacy_aads, fn aad ->
63 
                 case decrypt(key, nonce, ciphertext, aad, tag) do
64 
                   {:ok, token} -> {:ok, token}
65 
                   {:error, :token_unsealable} -> nil
66 
                 end
67 
               end)
66 68 
             end) do
67 69 
          {:ok, token} -> {:ok, token}
68 70 
          nil -> {:error, :token_unsealable}
test/openagents/accounts/token_vault_test.exs modified +21

@@ -69,4 +69,25 @@ defmodule OpenAgents.Accounts.TokenVaultTest do

69 69 
    assert {:ok, new_envelope} = TokenVault.seal("gho_new")
70 70 
    assert {:ok, "staging-current"} = TokenVault.key_id(new_envelope)
71 71 
  end
72
73 
  test "opens retained Sarah version 1 tokens" do
74 
    encoded_key = Application.fetch_env!(:openagents, :github_token_encryption_key)
75 
    {:ok, key} = Base.decode64(encoded_key)
76 
    token = "gho_retained_legacy_token"
77 
    nonce = :crypto.strong_rand_bytes(12)
78
79 
    {ciphertext, tag} =
80 
      :crypto.crypto_one_time_aead(
81 
        :aes_256_gcm,
82 
        key,
83 
        nonce,
84 
        token,
85 
        "sarah.github_access_token.v1",
86 
        true
87 
      )
88
89 
    envelope = <<1, nonce::binary, tag::binary, ciphertext::binary>>
90
91 
    assert {:ok, ^token} = TokenVault.open(envelope)
92 
  end
72 93 
end

This page updates live while a promote is in flight · changelog