karst 0.2.0 → 0.4.0

data/lib/karst/identity.rb

@@ -1,8 +1,11 @@
 # frozen_string_literal: true
 
 require_relative "value"
+require_relative "execution_context"
 require_relative "identity/devise_support"
 require_relative "identity/warden_adapter"
+require_relative "identity/observation"
+require_relative "identity/evidence"
 require_relative "access/selected_principal_sources"
 
 module Karst
@@ -23,12 +26,39 @@ module Karst
     class Unavailable < Error; end
     class ConfigurationError < Error; end
 
+    # Karst's own sign-in raised while being applied inside a probed request
+    # (see WardenAdapter.install_hook!). Raised only there, and caught by
+    # Access::Probe, which reports it as failed identity setup -- never as
+    # the probed route raising, because the route never ran.
+    class EstablishmentError < Error; end
+
+    ESTABLISHING_KEY = :karst_identity_establishing
+    private_constant :ESTABLISHING_KEY
+
     # authentication_* is presentation-only evidence. Machine serializers
     # deliberately ignore it; it exists so local human interfaces can be
     # useful without broadening JSON/MCP disclosure.
     PrincipalDescriptor = Value.define(:model_name, :id, :display_label, :authentication_key,
                                        :authentication_identifier)
 
+    # A deliberate request to execute with no authenticated principal at all,
+    # passed wherever a principal is passed (see Access::Sweep). It is not a
+    # principal and is never described, sampled, resolved, or assumed: it
+    # means "establish no identity, and prove at runtime that the application
+    # saw none", which is a probe in its own right rather than the absence of
+    # one.
+    class AnonymousIdentity
+      def to_s
+        "anonymous"
+      end
+
+      def inspect
+        "Karst::Identity::ANONYMOUS"
+      end
+    end
+
+    ANONYMOUS = AnonymousIdentity.new.freeze
+
     # Compact, inspectable report of why Karst's zero-config Devise/Warden
     # path is or isn't active. `status` is one of:
     #
@@ -58,6 +88,38 @@ module Karst
     # probe/browser identity still couldn't be wired up automatically.
     SetupState = Value.define(:status, :message)
 
+    # One high-level operation's view of the effective identity
+    # configuration -- a `bin/rails karst:verify` run, one MCP verify_access
+    # call, one /karst request -- taken once, when the operation starts, from
+    # exactly one Configuration#principal_sources resolution (approval file
+    # read, model-source parse, principal source callables evaluated once
+    # each). Everything the operation asks about identity setup reads this
+    # value instead of re-resolving configuration: readiness, browser Test As
+    # support, and which principal sources to sample or resolve from.
+    #
+    # Deliberately operation-scoped, never cached beyond that: the next
+    # operation takes a fresh snapshot, so a revoked approval, a deleted
+    # scope, or a changed initializer takes effect without a restart. A
+    # caller that changes local state (saving a selection, approving a
+    # population) takes its snapshot after that write, not before.
+    #
+    # `principal_sources` is nil when no principal source is configured.
+    Snapshot = Value.define(:principal_sources, :setup_state, :browser_supported) do
+      # Identity.principal_sources' contract, over this snapshot.
+      def principal_sources!
+        principal_sources || raise(Unavailable, "no principal source is configured")
+      end
+
+      def browser_supported?
+        browser_supported
+      end
+    end
+
+    # Marks "the caller did not resolve principal sources; resolve them
+    # here" -- distinct from a caller-resolved nil, which means none exist.
+    UNRESOLVED = Object.new.freeze
+    private_constant :UNRESOLVED
+
     # Delegates identity operations to the application's configured hooks.
     class ConfiguredAdapter
       def initialize(assume_hook, clear_hook)
@@ -95,13 +157,27 @@ module Karst
       # Every multi-source-aware caller (Identity.resolve,
       # Access::PrincipalSelection, the panel) reads this instead of
       # config.principals directly.
-      def principal_sources
-        sources = Karst.config.principal_sources
+      #
+      # `record:`/`discovery:`, when given, are threaded straight to
+      # Configuration#principal_sources -- a caller's already-loaded
+      # approval record and population discovery instance, reused instead of
+      # loaded and parsed again (see Snapshot).
+      def principal_sources(record: nil, discovery: nil)
+        sources = Karst.config.principal_sources(record: record, discovery: discovery)
         raise Unavailable, "no principal source is configured" unless sources
 
         sources
       end
 
+      # See Snapshot. Resolves principal sources exactly once and derives
+      # every other answer from that one resolution. `record:`/`discovery:`
+      # as for #principal_sources.
+      def snapshot(record: nil, discovery: nil)
+        sources = safe_principal_sources(record: record, discovery: discovery)
+        Snapshot.new(principal_sources: sources, setup_state: setup_state(sources: sources),
+                     browser_supported: browser_supported?(sources: sources))
+      end
+
       def with(session, principal)
         active_adapter = adapter(principal)
         # The hook may establish identity and then raise, so cleanup becomes
@@ -113,8 +189,44 @@ module Karst
         active_adapter.clear(session) if active_adapter && assumed
       end
 
-      def clear(session)
-        adapter.clear(session)
+      # The establishment half of #with on its own, for callers that must
+      # keep running -- and observing -- a request whose identity setup
+      # failed (see Access::IdentityProbe). Every such caller owes #clear in
+      # its own ensure.
+      def assume(session, principal)
+        adapter(principal).assume(session, principal)
+      end
+
+      # `principal:` is the identity being cleared, when the caller still has
+      # it: the automatic Devise/Warden path resolves a scope straight from
+      # the principal's own class, and only has to fall back to guessing one
+      # from the effective principal source (which several selected Devise
+      # models make impossible) when nothing is passed. Callers that assumed
+      # an identity should always pass the same principal back here.
+      def clear(session, principal: nil)
+        adapter(principal).clear(session)
+      end
+
+      def anonymous?(principal)
+        principal.equal?(ANONYMOUS)
+      end
+
+      # Marks identity setup Karst has to perform *inside* a probed request:
+      # the automatic Warden path can only sign a probe in once that request
+      # reaches Warden (see WardenAdapter), so the sign-in -- and anything the
+      # application's own after_set_user hooks do in response, such as a
+      # Devise :trackable UPDATE -- happens mid-request. Access::Probe records
+      # nothing as target evidence while this is in progress on the current
+      # thread: it is Karst's setup, not the route's behavior.
+      def establishing
+        ExecutionContext[ESTABLISHING_KEY] = true
+        yield
+      ensure
+        ExecutionContext.delete(ESTABLISHING_KEY)
+      end
+
+      def establishing?
+        ExecutionContext[ESTABLISHING_KEY] ? true : false
       end
 
       def describe(principal)
@@ -146,16 +258,20 @@ module Karst
       # principal outside a configured relation is never resolved. A generic
       # Enumerable source (no scoped-query capability) keeps the original
       # enumerate-and-compare behavior, bounded to that one source.
-      def resolve(model_name:, id:)
-        principal_sources.each_value do |source|
+      #
+      # `sources:` is an already-resolved principal source Hash (see
+      # Snapshot); omitted, the effective configuration is resolved here.
+      def resolve(model_name:, id:, sources: nil)
+        (sources || principal_sources).each_value do |source|
           resolved = resolve_within_source(source, model_name: model_name, id: id)
           return resolved if resolved
         end
         nil
       end
 
-      def browser_supported?
-        explicit_browser_hooks? || automatic_browser_identity_available?
+      # `sources:` as for #setup_state.
+      def browser_supported?(sources: UNRESOLVED)
+        explicit_browser_hooks? || automatic_browser_identity_available?(lazy_sources(sources))
       end
 
       # Returns the Devise/Warden scope this browser identity was actually
@@ -199,10 +315,16 @@ module Karst
       # panel already does on every render to type-check its result (see
       # Access::PrincipalSampler.representative_capable?) -- never to
       # enumerate or query it.
-      def setup_state
+      #
+      # `sources:` is an already-resolved principal source Hash (possibly
+      # nil -- none configured), as a Snapshot holds; omitted, principal
+      # sources are resolved here, at most once per call.
+      def setup_state(sources: UNRESOLVED)
         return SetupState.new(status: :ambiguous, message: ambiguous_message) if ambiguous_principal_source?
         return SetupState.new(status: :unavailable, message: nil) unless principal_source_ready?
-        return SetupState.new(status: :unavailable, message: unavailable_message) unless identity_channels_ready?
+        unless identity_channels_ready?(lazy_sources(sources))
+          return SetupState.new(status: :unavailable, message: unavailable_message)
+        end
 
         SetupState.new(status: ready_status, message: nil)
       end
@@ -267,9 +389,23 @@ module Karst
         nil
       end
 
-      def identity_channels_ready?
-        (explicit_probe_hooks? || automatic_identity_available?) &&
-          (explicit_browser_hooks? || automatic_browser_identity_available?)
+      def identity_channels_ready?(sources)
+        (explicit_probe_hooks? || automatic_identity_available?(sources)) &&
+          (explicit_browser_hooks? || automatic_browser_identity_available?(sources))
+      end
+
+      # Resolves principal sources only if a check actually needs them, and
+      # then only once, however many checks ask. `sources` is either a
+      # caller's resolution (used as-is) or UNRESOLVED.
+      def lazy_sources(sources)
+        resolved = false
+        lambda do
+          unless resolved
+            sources = safe_principal_sources if sources.equal?(UNRESOLVED)
+            resolved = true
+          end
+          sources
+        end
       end
 
       # Only called once every channel is already known to be ready (see
@@ -335,11 +471,11 @@ module Karst
       # Probe-identity eligibility. Preserves the pre-existing bare-Warden
       # fallback (no Devise, no scope) for a non-Devise application already
       # relying on Karst's isolated integration session -- see WardenAdapter.
-      def automatic_identity_available?
+      def automatic_identity_available?(sources)
         return false unless warden_available?
         return true unless DeviseSupport.available?
 
-        every_effective_source_scoped?
+        every_effective_source_scoped?(sources.call)
       end
 
       # Browser-identity eligibility. Deliberately stricter than probe
@@ -347,10 +483,10 @@ module Karst
       # browser session is only safe once Karst can prove the Devise
       # scope -- a bare bootstrapped Warden proxy with no scope is never
       # enough here, unlike the isolated probe session.
-      def automatic_browser_identity_available?
+      def automatic_browser_identity_available?(sources)
         return false unless warden_available? && DeviseSupport.available?
 
-        every_effective_source_scoped?
+        every_effective_source_scoped?(sources.call)
       end
 
       # True once every currently effective principal source resolves to its
@@ -363,8 +499,7 @@ module Karst
       # sources; this governs only "no principal yet" eligibility and the
       # bare-clear fallback, so it still refuses to guess when a source is
       # not provably Devise-scoped.
-      def every_effective_source_scoped?
-        sources = safe_principal_sources
+      def every_effective_source_scoped?(sources)
         return false unless sources&.any?
 
         sources.values.all? { |source| devise_scope_for_source(source) }
@@ -416,8 +551,8 @@ module Karst
         nil
       end
 
-      def safe_principal_sources
-        principal_sources
+      def safe_principal_sources(record: nil, discovery: nil)
+        principal_sources(record: record, discovery: discovery)
       rescue Error
         nil
       end
@@ -464,7 +599,7 @@ module Karst
       end
 
       def model_name_for_klass(klass)
-        klass.respond_to?(:model_name) ? klass.model_name.name.to_s : klass.name.to_s
+        Naming.model_name_for(klass)
       end
 
       def id_for(principal)

data/lib/karst/mcp/compatibility.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+module Karst
+  module Mcp
+    # Karst's MCP adapter is optional, but when requested it uses the MCP
+    # server, tool, schema, response, and stdio transport APIs, which are
+    # unchanged across the 1.5 and 1.6 release series. Keep the development
+    # dependency and the command's runtime activation guard on the same
+    # bounded, tested range: CI exercises its oldest release and the newest
+    # 1.6.x, and a later minor series is admitted only after it has been
+    # tested the same way.
+    module Compatibility
+      REQUIREMENTS = [">= 1.5.0", "< 1.7"].freeze
+
+      class << self
+        # The requirement as it is written in a Gemfile, e.g.
+        # `">= 1.5.0", "< 1.7"`.
+        def gemfile_requirement
+          REQUIREMENTS.map(&:inspect).join(", ")
+        end
+      end
+    end
+  end
+end

data/lib/karst/mcp/reproduce_request_tool.rb

@@ -0,0 +1,137 @@
+# frozen_string_literal: true
+
+require "json"
+require "mcp"
+require_relative "reproduction"
+
+module Karst
+  module Mcp
+    # Karst's second, and deliberately last, MCP tool: a thin transport
+    # adapter over Karst::CLI::Reproduction#evidence.
+    #
+    # It exists separately from verify_access rather than as a mode of it
+    # because the two answer different questions with different blast
+    # radii. verify_access answers "which existing user can reach this
+    # page", by issuing up to access_sweep_limit bounded GET requests
+    # automatically; it is documented as GET-only and must stay that way,
+    # since running a mutating method as 25 users would mean 25 real
+    # creates, 25 enqueued jobs, and 25 delivered mails. reproduce_request
+    # answers "what request exercises this behavior", by issuing exactly
+    # one request the caller fully specified. Folding a mutating,
+    # caller-supplied-body mode into a tool whose contract promises bounded
+    # read-only verification would make that contract false.
+    class ReproduceRequestTool < MCP::Tool
+      tool_name "reproduce_request"
+      description <<~DESCRIPTION.strip
+        Issue exactly one request against the running local Rails application and
+        return a redacted, reproducible recipe for it.
+
+        Use this to answer "something calls this Rails endpoint -- what request
+        do I send to exercise the same behavior?". Karst executes the real
+        application inside a rolled-back database transaction and reports what
+        actually happened: the controller and action that dispatched, whether
+        the controller lifecycle completed ("execution.controller_completed" --
+        distinct from dispatch: a controller can dispatch and still raise), any
+        halted callback (this is the observed authentication or authorization
+        gate -- Karst never infers one from code), any raised exception together
+        with the most specific phase instrumentation actually proves it happened
+        in ("execution.exception_phase": "controller", "render", or "unknown"),
+        which templates/partials/layouts were observed rendering or raising
+        ("execution.rendered", by structural virtual_path only -- never
+        content), observed database writes, response status and content type,
+        plus a cURL command for the exact request Karst sent.
+
+        Response facts (status/content_type/redirect) are strictly scoped to
+        this one request: if the target raised before producing a response,
+        they are null and named in "unobserved" rather than reflecting an
+        earlier request Karst ran on the same session (identity establishment,
+        most often).
+
+        This is observed runtime evidence. A field Karst could not observe is
+        null and named in "unobserved"; nothing is inferred from routes,
+        controller source, exception class/message, or strong parameters.
+
+        Identity in the result follows the same requested/observed/confirmation
+        contract as verify_access: "identity.confirmation" says whether the
+        application actually ran as the identity Karst assumed (or ran with no
+        principal, for an anonymous probe) -- "confirmed" or
+        "confirmed_anonymous" only. Never report this request as having run as
+        a user on the strength of "identity.requested" alone.
+
+        Secrets are never returned. Request parameters pass through the
+        application's own Rails config.filter_parameters plus a conservative
+        credential-name filter, and credential-bearing headers are replaced by
+        placeholders such as <API_KEY> or <AUTH_TOKEN> without their values ever
+        being read. Referer and Origin -- headers whose *value* is a URL rather
+        than a credential -- have their query string, fragment, and userinfo
+        stripped structurally instead, so a token or access_token riding in
+        either one never comes back either. A redirect Karst observes is
+        stripped the same way. A returned command that needs a credential
+        filled in is working as intended.
+
+        Side effects: GET and HEAD are enabled by default. POST, PUT, PATCH, and
+        DELETE are refused unless the host application explicitly opts in with
+        config.mcp_mutating_requests = true. When opted in, exactly one request
+        is issued. Database rollback is attempted on the request's own
+        connection; that does not make the request side-effect-free. Background
+        jobs, mail, outbound HTTP, files, Redis/external stores, and other
+        database connections are not isolated.
+      DESCRIPTION
+
+      input_schema(
+        properties: {
+          path: {
+            type: "string",
+            description: "Local application path, e.g. \"/api/v1/inspections\". Must be local " \
+                         "(no scheme/host). May include a query string."
+          },
+          method: {
+            type: "string",
+            description: "HTTP method to issue. GET and HEAD are enabled by default; mutating methods require " \
+                         "the host's config.mcp_mutating_requests opt-in.",
+            enum: %w[GET HEAD POST PUT PATCH DELETE],
+            default: "GET"
+          },
+          body: { type: "string", description: "Raw request body. Requires content_type." },
+          content_type: {
+            type: "string",
+            description: "Content type of body, e.g. \"application/json\". Required whenever body is given."
+          },
+          headers: {
+            type: "object",
+            description: "Request headers to send, as name => value. Credential-bearing headers are " \
+                         "sent as given but never echoed back.",
+            additionalProperties: { type: "string" }
+          },
+          anonymous: {
+            type: "boolean",
+            description: "Send without assuming any application identity. Defaults to false, in which " \
+                         "case Karst assumes one existing identity from the application's own " \
+                         "configured principal source.",
+            default: false
+          },
+          base_url: {
+            type: "string",
+            description: "Base URL for the generated cURL command. Defaults to http://localhost:3000."
+          }
+        },
+        required: ["path"]
+      )
+
+      class << self
+        # server_context is part of MCP::Tool's call signature; this tool
+        # needs no per-request context beyond its own arguments.
+        # rubocop:disable Lint/UnusedMethodArgument, Metrics/ParameterLists
+        def call(path:, method: "GET", body: nil, content_type: nil, headers: nil,
+                 anonymous: false, base_url: nil, server_context: nil)
+          document = ::Karst::Mcp::Reproduction.new(
+            path: path, method: method, body: body, content_type: content_type,
+            headers: headers || {}, anonymous: anonymous, base_url: base_url
+          ).evidence
+          MCP::Tool::Response.new([{ type: "text", text: JSON.generate(document) }], error: document.key?(:error))
+        end
+        # rubocop:enable Lint/UnusedMethodArgument, Metrics/ParameterLists
+      end
+    end
+  end
+end

data/lib/karst/mcp/reproduction.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+require_relative "../cli/reproduction"
+
+module Karst
+  module Mcp
+    # MCP-specific boundary in front of the human-capable reproduction
+    # adapter. CLI and /karst callers intentionally use CLI::Reproduction
+    # directly and retain its full method support; an MCP caller reaches it
+    # only after this allowlist has accepted the method.
+    class Reproduction
+      SAFE_METHODS = %w[GET HEAD].freeze
+
+      # rubocop:disable Metrics/ParameterLists
+      def initialize(path:, method: "GET", body: nil, content_type: nil, headers: nil,
+                     anonymous: false, base_url: nil)
+        @path = path
+        @method = method.to_s.strip.upcase
+        @body = body
+        @content_type = content_type
+        @headers = headers
+        @anonymous = anonymous
+        @base_url = base_url
+      end
+      # rubocop:enable Metrics/ParameterLists
+
+      def evidence
+        return disabled_document unless permitted?
+
+        CLI::Reproduction.new(
+          path: @path, http_method: @method, body: @body, content_type: @content_type,
+          headers: @headers || {}, anonymous: @anonymous, base_url: @base_url
+        ).evidence
+      end
+
+      private
+
+      def permitted?
+        SAFE_METHODS.include?(@method) || Karst.config.mcp_mutating_requests == true
+      end
+
+      def disabled_document
+        {
+          schema_version: CLI::Reproduction::SCHEMA_VERSION,
+          error: {
+            type: "method_disabled",
+            message: "#{displayed_method} is disabled for MCP reproduction; the host application must " \
+                     "explicitly enable mutating MCP requests with config.mcp_mutating_requests = true"
+          }
+        }
+      end
+
+      def displayed_method
+        @method.empty? ? "the requested method" : @method
+      end
+    end
+  end
+end

data/lib/karst/mcp/server.rb

@@ -2,12 +2,14 @@
 
 require "mcp"
 require_relative "verify_access_tool"
+require_relative "reproduce_request_tool"
 require_relative "../version"
 
 module Karst
   module Mcp
-    # Builds and runs Karst's stdio MCP server: one tool (VerifyAccessTool),
-    # no prompts, no resources, no other transport. The host Rails
+    # Builds and runs Karst's stdio MCP server: two tools
+    # (VerifyAccessTool, ReproduceRequestTool), no prompts, no resources, no
+    # other transport. The host Rails
     # application must already be booted (see
     # Rails::Command::Karst::Boot#boot_karst_application!, used by
     # `bin/rails karst:mcp`) before this is built -- the server itself never
@@ -22,11 +24,28 @@ module Karst
         identities, and reports observed evidence -- HTTP status, redirect,
         halted callback, exception, and whether a usable outcome was found.
 
-        Call verify_access(path:, method:) to check one path. Karst does not
-        infer authorization rules, explain application code, or choose which
-        principal to try on your behalf -- it only reports what actually
-        happened when a real request was made under the application's own
-        configured identities.
+        Call verify_access(path:, method:) to check one path, or
+        verify_access(path:, identity: "anonymous") to check it with no
+        principal established at all. Karst does not infer authorization
+        rules, explain application code, or choose which principal to try on
+        your behalf -- it only reports what actually happened when a real
+        request was made under the application's own configured identities.
+
+        Identity is evidence, not intent. Each outcome separates the identity
+        Karst was asked to run as from the one the application itself
+        resolved while running the request; only identity.confirmation of
+        "confirmed" or "confirmed_anonymous" means the request provably ran
+        that way. Never report a principal as having reached a route on the
+        strength of the requested identity alone.
+
+        Call reproduce_request(path:, method:, body:, content_type:) to answer a
+        different question: "something calls this endpoint -- what request do I
+        send to exercise the same behavior?". It issues exactly one request and
+        returns the observed controller/action, halted callback, response, and a
+        redacted cURL command for what Karst actually sent. Secrets are replaced
+        by placeholders; a command that needs a credential filled in is working
+        as intended. Identity in its evidence document follows the same
+        requested/observed/confirmation contract as verify_access.
       TEXT
 
       class << self
@@ -36,7 +55,7 @@ module Karst
             title: "Karst",
             version: Karst::VERSION,
             instructions: INSTRUCTIONS,
-            tools: [VerifyAccessTool],
+            tools: [VerifyAccessTool, ReproduceRequestTool],
             configuration: MCP::Configuration.new(exception_reporter: method(:report_exception))
           )
         end

data/lib/karst/mcp/verify_access_tool.rb

@@ -34,6 +34,19 @@ module Karst
         runtime evidence, not an inference about authorization rules -- Karst
         never explains *why* an outcome occurred, and this tool never
         impersonates the developer's browser or exposes Test As.
+
+        Identity is reported as evidence, not intent. Every outcome carries an
+        `identity` document separating the identity Karst was asked to run as
+        (`requested`) from the one the application itself resolved while
+        running the request (`observed`). Only `identity.confirmation` of
+        "confirmed" or "confirmed_anonymous" means the request provably ran as
+        that principal; "absent", "mismatch", "contaminated" and
+        "unobservable" all mean it did not, and must never be reported as a
+        principal having reached the route.
+
+        Pass identity: "anonymous" to probe the route with no principal at
+        all -- a request Karst also verifies the application actually saw as
+        anonymous.
       DESCRIPTION
 
       input_schema(
@@ -47,6 +60,15 @@ module Karst
             type: "string",
             description: "HTTP method to verify. Only GET is currently supported.",
             default: "GET"
+          },
+          identity: {
+            type: "string",
+            enum: %w[application_identities anonymous],
+            description: "Which identity to probe as. \"application_identities\" (the default) runs the " \
+                         "route as real existing identities from the application's own principal " \
+                         "source(s); \"anonymous\" runs it with no principal established at all and " \
+                         "verifies the application observed none.",
+            default: "application_identities"
           }
         },
         required: ["path"]
@@ -57,11 +79,23 @@ module Karst
         # passes it by keyword whenever a tool's #call accepts it) but this
         # tool needs no per-request context beyond its own arguments.
         # rubocop:disable Lint/UnusedMethodArgument
-        def call(path:, method: "GET", server_context: nil)
-          document = ::Karst::CLI::Verification.new(path: path, http_method: method).evidence
+        def call(path:, method: "GET", identity: nil, server_context: nil)
+          document = ::Karst::CLI::Verification.new(path: path, http_method: method,
+                                                    identity: probe_identity(identity)).evidence
           MCP::Tool::Response.new([{ type: "text", text: JSON.generate(document) }], error: document.key?(:error))
         end
         # rubocop:enable Lint/UnusedMethodArgument
+
+        private
+
+        # "application_identities" is the documented default rather than a
+        # second spelling of nil, so an agent that passes it explicitly gets
+        # the ordinary search instead of an argument error.
+        def probe_identity(value)
+          return nil if value.nil? || value.to_s == "application_identities"
+
+          value
+        end
       end
     end
   end