rotate: Vercel token + SendGrid API-key drivers (create→verify→revoke)

Two more provider-API rotation drivers for the vibe-coder credential surface, both following the create-new → verify → revoke-old pattern with the self-contained blob form <provider>://<host>/?id=&secret=. - vercel: POST /v3/user/tokens mints a new bearer; Verify lists tokens and asserts the new id is present; RevokeOld DELETEs the old token by id. - sendgrid: clones the old key's scopes (GET /v3/api_keys/<id>) onto the new key so rotation is a faithful replacement, not a privilege downgrade; Verify is a GET /v3/scopes auth proof; RevokeOld DELETEs the old key by id. Both ship Bearer-enforcing httptest emulators that prove a real cutover (old credential dead, new alive after RevokeOld) plus a leak check. Recorded as MOCK-ONLY in proofs.go + docs/ROTATION-PROOFS.md (no self-host). go build/vet clean; 77 rotate tests pass, -race clean. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-06-20 12:12:20 -07:00
parent 80916c817a
commit 88e603f3c0
6 changed files with 936 additions and 5 deletions
@@ -0,0 +1,199 @@
+package rotate
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+
+	"incredigo/internal/discover"
+	"incredigo/internal/vault"
+)
+
+// vercelEmu emulates the Vercel /v3/user/tokens resource and ENFORCES token validity
+// via the Bearer header: a token authenticates only while it exists, POST mints a new
+// one, DELETE makes a token stop working — so a test can prove a real cutover.
+type vercelEmu struct {
+	mu      sync.Mutex
+	secrets map[string]string // id -> bearer
+	srv     *httptest.Server
+}
+
+func newVercelEmu(t *testing.T, seedID, seedToken string) *vercelEmu {
+	e := &vercelEmu{secrets: map[string]string{seedID: seedToken}}
+	mux := http.NewServeMux()
+	mux.HandleFunc("/v3/user/tokens", e.handleCollection)
+	mux.HandleFunc("/v3/user/tokens/", e.handleItem)
+	e.srv = httptest.NewTLSServer(mux)
+	t.Cleanup(e.srv.Close)
+	return e
+}
+
+func (e *vercelEmu) authed(r *http.Request) bool {
+	tok := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	for _, t := range e.secrets {
+		if t == tok && tok != "" {
+			return true
+		}
+	}
+	return false
+}
+
+func (e *vercelEmu) handleCollection(w http.ResponseWriter, r *http.Request) {
+	if !e.authed(r) {
+		w.WriteHeader(http.StatusUnauthorized)
+		return
+	}
+	switch r.Method {
+	case http.MethodPost:
+		raw := make([]byte, 8)
+		rand.Read(raw)
+		id := "tok_" + hex.EncodeToString(raw)
+		bRaw := make([]byte, 16)
+		rand.Read(bRaw)
+		bearer := hex.EncodeToString(bRaw)
+		e.mu.Lock()
+		e.secrets[id] = bearer
+		e.mu.Unlock()
+		w.WriteHeader(http.StatusOK)
+		json.NewEncoder(w).Encode(map[string]any{"token": map[string]any{"id": id, "name": "incredigo-rotated"}, "bearerToken": bearer})
+	case http.MethodGet:
+		e.mu.Lock()
+		var toks []map[string]any
+		for id := range e.secrets {
+			toks = append(toks, map[string]any{"id": id, "name": "t"})
+		}
+		e.mu.Unlock()
+		json.NewEncoder(w).Encode(map[string]any{"tokens": toks})
+	default:
+		w.WriteHeader(http.StatusMethodNotAllowed)
+	}
+}
+
+func (e *vercelEmu) handleItem(w http.ResponseWriter, r *http.Request) {
+	if !e.authed(r) {
+		w.WriteHeader(http.StatusUnauthorized)
+		return
+	}
+	id := strings.TrimPrefix(r.URL.Path, "/v3/user/tokens/")
+	switch r.Method {
+	case http.MethodDelete:
+		e.mu.Lock()
+		delete(e.secrets, id)
+		e.mu.Unlock()
+		w.WriteHeader(http.StatusOK)
+		json.NewEncoder(w).Encode(map[string]any{"tokenId": id})
+	default:
+		w.WriteHeader(http.StatusMethodNotAllowed)
+	}
+}
+
+func (e *vercelEmu) valid(token string) bool {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	for _, t := range e.secrets {
+		if t == token {
+			return true
+		}
+	}
+	return false
+}
+
+func TestVercelDetect(t *testing.T) {
+	ve := &Vercel{}
+	if !ve.Detect(discover.Credential{Source: "vercel"}) {
+		t.Error("should detect Source=vercel")
+	}
+	if ve.Detect(discover.Credential{Source: "resend"}) {
+		t.Error("should not detect Source=resend")
+	}
+}
+
+func TestVercelRotateRealCutover(t *testing.T) {
+	v := vault.New()
+	defer v.Purge()
+	ctx := context.Background()
+
+	const seedID, oldToken = "tok_seed01234567", "oldbearer0123456789abcdef"
+	emu := newVercelEmu(t, seedID, oldToken)
+
+	host := strings.TrimPrefix(emu.srv.URL, "https://")
+	oldBlob := "vercel://" + host + "/?id=" + seedID + "&secret=" + oldToken
+	cred := discover.Credential{
+		Source:   "vercel",
+		Kind:     discover.KindToken,
+		Identity: "vercel access token",
+		Location: "imported/vercel/labtoken",
+		Secret:   v.Store([]byte(oldBlob)),
+	}
+	ve := &Vercel{HTTPClient: emu.srv.Client()}
+
+	if !emu.valid(oldToken) {
+		t.Fatal("seed token should be valid at start")
+	}
+
+	newH, err := ve.Rotate(ctx, cred, v)
+	if err != nil {
+		t.Fatalf("Rotate: %v", err)
+	}
+	ns, err := parseVercelSecret(v, newH)
+	if err != nil {
+		t.Fatalf("parse new secret: %v", err)
+	}
+	if ns.id == seedID || ns.secret == oldToken {
+		t.Fatal("new token equals old — rotation minted nothing")
+	}
+	if !emu.valid(oldToken) {
+		t.Fatal("old token must remain valid before revoke")
+	}
+	if !emu.valid(ns.secret) {
+		t.Fatal("new token must be valid after create")
+	}
+
+	if err := ve.Verify(ctx, newH, v); err != nil {
+		t.Fatalf("Verify(new): %v", err)
+	}
+
+	if err := ve.RevokeOld(ctx, cred, v); err != nil {
+		t.Fatalf("RevokeOld: %v", err)
+	}
+	if emu.valid(oldToken) {
+		t.Fatal("old token must be invalid after revoke")
+	}
+	if err := ve.Verify(ctx, newH, v); err != nil {
+		t.Fatalf("new token must still authenticate after revoke: %v", err)
+	}
+
+	for _, f := range []string{cred.Identity, cred.Source, cred.Location, string(cred.Kind)} {
+		if strings.Contains(f, oldToken) || strings.Contains(f, ns.secret) {
+			t.Errorf("secret leaked into non-secret field %q", f)
+		}
+	}
+}
+
+func TestVercelRejectsBadSecret(t *testing.T) {
+	v := vault.New()
+	defer v.Purge()
+	ve := &Vercel{}
+	cred := discover.Credential{Source: "vercel", Secret: v.Store([]byte("vercel://api.vercel.com/?id=tok_x"))}
+	if _, err := ve.Rotate(context.Background(), cred, v); err == nil {
+		t.Error("Rotate should reject a secret with no bearer token")
+	}
+}
+
+func TestVercelRevokeNeedsID(t *testing.T) {
+	v := vault.New()
+	defer v.Purge()
+	ve := &Vercel{}
+	cred := discover.Credential{Source: "vercel", Secret: v.Store([]byte("vercel://api.vercel.com/?secret=abc"))}
+	if err := ve.RevokeOld(context.Background(), cred, v); err == nil {
+		t.Error("RevokeOld should fail when the credential carries no token id")
+	}
+}