From ed7c1b0a0f80bb2d338acc52676b58ab02ffadb8 Mon Sep 17 00:00:00 2001 From: Adnan Zahir Date: Tue, 1 Sep 2026 11:37:00 +0700 Subject: [PATCH] fix(openbao-session): always pass -ttl so session tokens stay short-lived Without an explicit -ttl the role path could mint ~32-day session tokens. Pass SESSION_TTL in both role and policy modes. Bump 0.1.3. Co-Authored-By: Claude --- plugins/openbao-session/.claude-plugin/plugin.json | 2 +- plugins/openbao-session/.codex-plugin/plugin.json | 2 +- plugins/openbao-session/hooks/bao-session.sh | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/plugins/openbao-session/.claude-plugin/plugin.json b/plugins/openbao-session/.claude-plugin/plugin.json index 5ced82f..3d92ca1 100644 --- a/plugins/openbao-session/.claude-plugin/plugin.json +++ b/plugins/openbao-session/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "openbao-session", - "version": "0.1.2", + "version": "0.1.3", "description": "Provisions a short-lived OpenBao session token for interactive agent sessions.", "author": { "name": "Senkensha" }, "hooks": "./hooks/claude-codex-hooks.json" diff --git a/plugins/openbao-session/.codex-plugin/plugin.json b/plugins/openbao-session/.codex-plugin/plugin.json index f1be640..7220d24 100644 --- a/plugins/openbao-session/.codex-plugin/plugin.json +++ b/plugins/openbao-session/.codex-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "openbao-session", - "version": "0.1.2+codex.20260901112838", + "version": "0.1.3+codex.20260901113700", "description": "Provisions a short-lived OpenBao session token for interactive agent sessions.", "author": { "name": "Local developer" diff --git a/plugins/openbao-session/hooks/bao-session.sh b/plugins/openbao-session/hooks/bao-session.sh index 4427c0b..fc87f44 100755 --- a/plugins/openbao-session/hooks/bao-session.sh +++ b/plugins/openbao-session/hooks/bao-session.sh @@ -110,10 +110,10 @@ mint_session_token() { create_args+=(-role="$SESSION_ROLE") [ -n "$SESSION_ENTITY" ] && create_args+=(-entity-alias="$SESSION_ENTITY") else - create_args+=(-policy="$SESSION_POLICY" -ttl="$SESSION_TTL") + create_args+=(-policy="$SESSION_POLICY") fi json="$(BAO_ADDR="$BAO_ADDR_URL" BAO_CACERT="$CACERT" BAO_TLS_SERVER_NAME="$TLS_NAME" BAO_TOKEN="$bootstrap" \ - "$BAO_BIN" token create "${create_args[@]}" -renewable \ + "$BAO_BIN" token create "${create_args[@]}" -ttl="$SESSION_TTL" -renewable \ -display-name="openbao-session-$(hostname)" -format=json)" || { log "token create failed"; return 1; } SESSION_TOKEN="$(printf '%s' "$json" | jq -r '.auth.client_token // empty')" [ -n "$SESSION_TOKEN" ] || { log "no client_token in token create response"; return 1; }