rotate: Vercel token + SendGrid API-key drivers (create→verify→revoke)

Two more provider-API rotation drivers for the vibe-coder credential surface, both following the create-new → verify → revoke-old pattern with the self-contained blob form <provider>://<host>/?id=&secret=. - vercel: POST /v3/user/tokens mints a new bearer; Verify lists tokens and asserts the new id is present; RevokeOld DELETEs the old token by id. - sendgrid: clones the old key's scopes (GET /v3/api_keys/<id>) onto the new key so rotation is a faithful replacement, not a privilege downgrade; Verify is a GET /v3/scopes auth proof; RevokeOld DELETEs the old key by id. Both ship Bearer-enforcing httptest emulators that prove a real cutover (old credential dead, new alive after RevokeOld) plus a leak check. Recorded as MOCK-ONLY in proofs.go + docs/ROTATION-PROOFS.md (no self-host). go build/vet clean; 77 rotate tests pass, -race clean. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-06-20 12:12:20 -07:00
parent 80916c817a
commit 88e603f3c0
6 changed files with 936 additions and 5 deletions
@@ -0,0 +1,249 @@
+package rotate
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+
+	"incredigo/internal/discover"
+	"incredigo/internal/vault"
+)
+
+// sendgridEmu emulates the SendGrid /v3/api_keys resource and ENFORCES key validity
+// via the Bearer token: a key authenticates only while it exists, POST mints a new key
+// (cloning whatever scopes were requested), GET /v3/api_keys/<id> returns a key's
+// scopes, GET /v3/scopes proves auth, and DELETE makes a key stop working — so a test
+// can prove a real cutover.
+type sendgridEmu struct {
+	mu      sync.Mutex
+	secrets map[string]string   // id -> token
+	scopes  map[string][]string // id -> scopes
+	srv     *httptest.Server
+}
+
+func newSendGridEmu(t *testing.T, seedID, seedToken string, seedScopes []string) *sendgridEmu {
+	e := &sendgridEmu{
+		secrets: map[string]string{seedID: seedToken},
+		scopes:  map[string][]string{seedID: seedScopes},
+	}
+	mux := http.NewServeMux()
+	mux.HandleFunc("/v3/api_keys", e.handleCollection)
+	mux.HandleFunc("/v3/api_keys/", e.handleItem)
+	mux.HandleFunc("/v3/scopes", e.handleScopes)
+	e.srv = httptest.NewTLSServer(mux)
+	t.Cleanup(e.srv.Close)
+	return e
+}
+
+// bearer returns the id whose token matches the request's Bearer header, or "".
+func (e *sendgridEmu) bearer(r *http.Request) string {
+	tok := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	for id, t := range e.secrets {
+		if t == tok && tok != "" {
+			return id
+		}
+	}
+	return ""
+}
+
+func (e *sendgridEmu) handleCollection(w http.ResponseWriter, r *http.Request) {
+	if e.bearer(r) == "" {
+		w.WriteHeader(http.StatusUnauthorized)
+		return
+	}
+	switch r.Method {
+	case http.MethodPost:
+		var in struct {
+			Name   string   `json:"name"`
+			Scopes []string `json:"scopes"`
+		}
+		json.NewDecoder(r.Body).Decode(&in)
+		raw := make([]byte, 8)
+		rand.Read(raw)
+		id := "sgid_" + hex.EncodeToString(raw)
+		tokRaw := make([]byte, 16)
+		rand.Read(tokRaw)
+		token := "SG." + hex.EncodeToString(tokRaw)
+		e.mu.Lock()
+		e.secrets[id] = token
+		e.scopes[id] = in.Scopes
+		e.mu.Unlock()
+		w.WriteHeader(http.StatusCreated)
+		json.NewEncoder(w).Encode(map[string]any{"api_key": token, "api_key_id": id, "name": in.Name, "scopes": in.Scopes})
+	default:
+		w.WriteHeader(http.StatusMethodNotAllowed)
+	}
+}
+
+func (e *sendgridEmu) handleItem(w http.ResponseWriter, r *http.Request) {
+	if e.bearer(r) == "" {
+		w.WriteHeader(http.StatusUnauthorized)
+		return
+	}
+	id := strings.TrimPrefix(r.URL.Path, "/v3/api_keys/")
+	switch r.Method {
+	case http.MethodGet:
+		e.mu.Lock()
+		sc, ok := e.scopes[id]
+		e.mu.Unlock()
+		if !ok {
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+		json.NewEncoder(w).Encode(map[string]any{"api_key_id": id, "scopes": sc})
+	case http.MethodDelete:
+		e.mu.Lock()
+		delete(e.secrets, id)
+		delete(e.scopes, id)
+		e.mu.Unlock()
+		w.WriteHeader(http.StatusNoContent)
+	default:
+		w.WriteHeader(http.StatusMethodNotAllowed)
+	}
+}
+
+// handleScopes is the auth proof endpoint: any valid key gets 200 + its scope list.
+func (e *sendgridEmu) handleScopes(w http.ResponseWriter, r *http.Request) {
+	id := e.bearer(r)
+	if id == "" {
+		w.WriteHeader(http.StatusUnauthorized)
+		return
+	}
+	e.mu.Lock()
+	sc := e.scopes[id]
+	e.mu.Unlock()
+	json.NewEncoder(w).Encode(map[string]any{"scopes": sc})
+}
+
+func (e *sendgridEmu) valid(token string) bool {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	for _, t := range e.secrets {
+		if t == token {
+			return true
+		}
+	}
+	return false
+}
+
+func (e *sendgridEmu) scopesOf(token string) []string {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	for id, t := range e.secrets {
+		if t == token {
+			return e.scopes[id]
+		}
+	}
+	return nil
+}
+
+func TestSendGridDetect(t *testing.T) {
+	sg := &SendGrid{}
+	if !sg.Detect(discover.Credential{Source: "sendgrid"}) {
+		t.Error("should detect Source=sendgrid")
+	}
+	if sg.Detect(discover.Credential{Source: "resend"}) {
+		t.Error("should not detect Source=resend")
+	}
+}
+
+func TestSendGridRotateRealCutover(t *testing.T) {
+	v := vault.New()
+	defer v.Purge()
+	ctx := context.Background()
+
+	const seedID, oldToken = "sgid_seed01234567", "SG.old0123456789abcdef"
+	wantScopes := []string{"mail.send", "templates.read"}
+	emu := newSendGridEmu(t, seedID, oldToken, wantScopes)
+
+	host := strings.TrimPrefix(emu.srv.URL, "https://")
+	oldBlob := "sendgrid://" + host + "/?id=" + seedID + "&secret=" + oldToken
+	cred := discover.Credential{
+		Source:   "sendgrid",
+		Kind:     discover.KindToken,
+		Identity: "sendgrid api key",
+		Location: "imported/sendgrid/labkey",
+		Secret:   v.Store([]byte(oldBlob)),
+	}
+	sg := &SendGrid{HTTPClient: emu.srv.Client()}
+
+	if !emu.valid(oldToken) {
+		t.Fatal("seed key should be valid at start")
+	}
+
+	// 1. Rotate.
+	newH, err := sg.Rotate(ctx, cred, v)
+	if err != nil {
+		t.Fatalf("Rotate: %v", err)
+	}
+	ns, err := parseSendGridSecret(v, newH)
+	if err != nil {
+		t.Fatalf("parse new secret: %v", err)
+	}
+	if ns.id == seedID || ns.secret == oldToken {
+		t.Fatal("new key equals old — rotation minted nothing")
+	}
+	if !emu.valid(oldToken) {
+		t.Fatal("old key must remain valid before revoke")
+	}
+	if !emu.valid(ns.secret) {
+		t.Fatal("new key must be valid after create")
+	}
+	// The new key must clone the old key's scopes (faithful replacement, not a downgrade).
+	gotScopes := emu.scopesOf(ns.secret)
+	if strings.Join(gotScopes, ",") != strings.Join(wantScopes, ",") {
+		t.Errorf("new key scopes = %v, want cloned %v", gotScopes, wantScopes)
+	}
+
+	// 2. Verify(new).
+	if err := sg.Verify(ctx, newH, v); err != nil {
+		t.Fatalf("Verify(new): %v", err)
+	}
+
+	// 3. RevokeOld.
+	if err := sg.RevokeOld(ctx, cred, v); err != nil {
+		t.Fatalf("RevokeOld: %v", err)
+	}
+	if emu.valid(oldToken) {
+		t.Fatal("old key must be invalid after revoke")
+	}
+	if err := sg.Verify(ctx, newH, v); err != nil {
+		t.Fatalf("new key must still authenticate after revoke: %v", err)
+	}
+
+	// Leak check.
+	for _, f := range []string{cred.Identity, cred.Source, cred.Location, string(cred.Kind)} {
+		if strings.Contains(f, oldToken) || strings.Contains(f, ns.secret) {
+			t.Errorf("secret leaked into non-secret field %q", f)
+		}
+	}
+}
+
+func TestSendGridRejectsBadSecret(t *testing.T) {
+	v := vault.New()
+	defer v.Purge()
+	sg := &SendGrid{}
+	// missing token
+	cred := discover.Credential{Source: "sendgrid", Secret: v.Store([]byte("sendgrid://api.sendgrid.com/?id=sgid_x"))}
+	if _, err := sg.Rotate(context.Background(), cred, v); err == nil {
+		t.Error("Rotate should reject a secret with no token")
+	}
+}
+
+func TestSendGridRevokeNeedsID(t *testing.T) {
+	v := vault.New()
+	defer v.Purge()
+	sg := &SendGrid{}
+	cred := discover.Credential{Source: "sendgrid", Secret: v.Store([]byte("sendgrid://api.sendgrid.com/?secret=SG.x"))}
+	if err := sg.RevokeOld(context.Background(), cred, v); err == nil {
+		t.Error("RevokeOld should fail when the credential carries no api_key_id")
+	}
+}