senkensha/infra-plugins
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(openbao-session): always pass -ttl so session tokens stay short-lived

Browse Source 
Without an explicit -ttl the role path could mint ~32-day session tokens.
Pass SESSION_TTL in both role and policy modes. Bump 0.1.3.

Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
Adnan Zahir
2026-09-01 11:37:00 +07:00
parent ddbdf468e3
commit ed7c1b0a0f
3 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
plugins/openbao-session/.claude-plugin/plugin.json
View File

@@ -1,6 +1,6 @@
{ {
"name": "openbao-session", "name": "openbao-session",
"version": "0.1.2", "version": "0.1.3",
"description": "Provisions a short-lived OpenBao session token for interactive agent sessions.", "description": "Provisions a short-lived OpenBao session token for interactive agent sessions.",
"author": { "name": "Senkensha" }, "author": { "name": "Senkensha" },
"hooks": "./hooks/claude-codex-hooks.json" "hooks": "./hooks/claude-codex-hooks.json"

2
plugins/openbao-session/.codex-plugin/plugin.json
View File

@@ -1,6 +1,6 @@
{ {
"name": "openbao-session", "name": "openbao-session",
"version": "0.1.2+codex.20260901112838", "version": "0.1.3+codex.20260901113700",
"description": "Provisions a short-lived OpenBao session token for interactive agent sessions.", "description": "Provisions a short-lived OpenBao session token for interactive agent sessions.",
"author": { "author": {
"name": "Local developer" "name": "Local developer"

4
plugins/openbao-session/hooks/bao-session.sh
View File

@@ -110,10 +110,10 @@ mint_session_token() {
create_args+=(-role="$SESSION_ROLE") create_args+=(-role="$SESSION_ROLE")
[ -n "$SESSION_ENTITY" ] && create_args+=(-entity-alias="$SESSION_ENTITY") [ -n "$SESSION_ENTITY" ] && create_args+=(-entity-alias="$SESSION_ENTITY")
else else
create_args+=(-policy="$SESSION_POLICY" -ttl="$SESSION_TTL") create_args+=(-policy="$SESSION_POLICY")
fi fi
json="$(BAO_ADDR="$BAO_ADDR_URL" BAO_CACERT="$CACERT" BAO_TLS_SERVER_NAME="$TLS_NAME" BAO_TOKEN="$bootstrap" \ json="$(BAO_ADDR="$BAO_ADDR_URL" BAO_CACERT="$CACERT" BAO_TLS_SERVER_NAME="$TLS_NAME" BAO_TOKEN="$bootstrap" \
"$BAO_BIN" token create "${create_args[@]}" -renewable \ "$BAO_BIN" token create "${create_args[@]}" -ttl="$SESSION_TTL" -renewable \
-display-name="openbao-session-$(hostname)" -format=json)" || { log "token create failed"; return 1; } -display-name="openbao-session-$(hostname)" -format=json)" || { log "token create failed"; return 1; }
SESSION_TOKEN="$(printf '%s' "$json" | jq -r '.auth.client_token // empty')" SESSION_TOKEN="$(printf '%s' "$json" | jq -r '.auth.client_token // empty')"
[ -n "$SESSION_TOKEN" ] || { log "no client_token in token create response"; return 1; } [ -n "$SESSION_TOKEN" ] || { log "no client_token in token create response"; return 1; }