@homeflare/alchemy 0.7.0 → 0.8.0

package/src/openbao/auth-role.ts

@@ -5,8 +5,9 @@
  *   are credential issuance, not configuration, and are OUT OF SCOPE. This declares the
  *   role shape an approle login inherits — policy names and TTL strings only.
  *
- * ★ `defaultRemovalPolicy: 'retain'` — deleting a role revokes every token bound to it.
- *   Opt in with `.pipe(RemovalPolicy.destroy())`; see resource.ts in house/proxmox.
+ * ★ `defaultRemovalPolicy: 'retain'` — deleting a role locks out every host that logs in with it:
+ *   its secret_ids go with it (the ⚠️ on `delete` below). Opt in with
+ *   `.pipe(RemovalPolicy.destroy())`; see resource.ts in house/proxmox.
  */
 import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';
@@ -17,12 +18,12 @@ import {
   type BaoAuthRoleAttributes,
   type BaoAuthRoleProps,
   attributesOf,
-  isRename,
   matches,
   readPath,
   writeBody,
 } from './auth-role-form.ts';
 import { baoDelete, baoRead, baoWrite } from './bao-http.ts';
+import { foldName, guardRename, judgeRename, nameIdentity } from './rename-identity.ts';
 
 export type { BaoAuthRoleAttributes, BaoAuthRoleProps };
 
@@ -38,6 +39,14 @@ export const BaoAuthRole = Resource<BaoAuthRole>('Bao.AuthRole', {
   defaultRemovalPolicy: 'retain',
 });
 
+/**
+ * ⚠️ CASE-INSENSITIVELY, BECAUSE THE SERVER IS. AppRole stores `role/<lowercased name>` (openbao
+ *   v2.6.2 builtin/credential/approle/path_role.go:1485, and roleEntry reads the same key,
+ *   :1537), so `Host` → `host` is the SAME role: a `replace` there would write it, then — under
+ *   `destroy` — delete the old generation, which is that same role.
+ */
+const IDENTITY = nameIdentity<BaoAuthRoleAttributes>('Bao.AuthRole', readPath, foldName);
+
 const readRole = (props: BaoAuthRoleProps) =>
   Effect.gen(function* () {
     const live = yield* baoRead(readPath(props.name));
@@ -65,26 +74,31 @@ export const BaoAuthRoleProvider = () =>
          * ⛔ IT COMPARES THE LIVE ROLE, NOT THE STORED DIGEST. A role edited in the OpenBao
          *   UI is exactly the drift the check-* gates exist to catch.
          */
-        diff: Effect.fn(function* ({ news, output }) {
-          if (output === undefined || !isResolved(news)) return undefined;
+        diff: Effect.fn(function* ({ news, olds, output }) {
           /**
-           * ⛔ A RENAMED ROLE IS A NEW ROLE — NEW role_id, NEW secret_ids — SO IT IS A `replace`.
-           *   Until 2026-09-21 a new `name` read nothing, planned `update` and wrote the new role,
-           *   leaving the old one live under no state record: its secret_ids kept logging in for
-           *   their whole TTL, and no plan would ever mention it again (REPLACE.md).
+           * ⛔ A RENAMED ROLE IS A NEW ROLE — NEW role_id, NEW secret_ids — SO IT IS A `replace`,
+           *   judged before `isResolved(news)` (rename-identity.ts). Until 2026-09-21 a new `name`
+           *   read nothing, planned `update` and wrote the new role, leaving the old one live
+           *   under no state record: its secret_ids kept logging in for their whole TTL, and no
+           *   plan would ever mention it again (REPLACE.md). ⛔ A rename onto a role that exists
+           *   fails the plan.
            * ⚠️ UNDER THE DEFAULT `retain` THE OLD ROLE STILL STAYS LIVE — retain keeps the old
            *   generation of a replace (Apply.ts:2164-2173). For per-host roles (host-approles.ts),
            *   opt into `RemovalPolicy.destroy()` or destroy the old role's accessors by hand.
            */
-          // ⚠️ Case-insensitively, because the server is — the ⚠️ on isRename in auth-role-form.ts.
-          if (isRename(output.name, news.name)) return { action: 'replace' } as const;
+          const move = yield* judgeRename(IDENTITY, olds, news, output);
+          if (output === undefined) return undefined;
+          if (move !== undefined) return { action: 'replace' } as const;
+          if (!isResolved(news)) return undefined;
           const live = yield* readRole(news);
           if (live === undefined) return { action: 'update' } as const;
           if (matches(live, news)) return { action: 'noop' } as const;
           return { action: 'update' } as const;
         }),
 
-        reconcile: Effect.fn(function* ({ news }) {
+        reconcile: Effect.fn(function* ({ news, output }) {
+          // ⛔ An `update` across a rename the diff could not see — refused before any write.
+          yield* guardRename(IDENTITY, news, output);
           const live = yield* readRole(news);
           if (live === undefined || !matches(live, news)) {
             yield* baoWrite('PUT', readPath(news.name), writeBody(news));
@@ -101,8 +115,15 @@ export const BaoAuthRoleProvider = () =>
         }),
 
         /**
-         * ⛔ DELETING A ROLE REVOKES EVERY TOKEN BOUND TO IT. Idempotent as Alchemy requires
-         *   — already gone is success — but retain is the default for a reason.
+         * ⚠️ DELETING A ROLE DOES NOT REVOKE THE TOKENS IT ISSUED. openbao v2.6.2 pathRoleDelete
+         *   (builtin/credential/approle/path_role.go:1858-1902) deletes every secret_id
+         *   (flushRoleSecrets, validation.go:420-446), the role_id mapping and the role, so no new
+         *   login succeeds, and it revokes nothing. A token already issued lives to its TTL; only
+         *   its renewal fails, because pathLoginRenew (path_login.go:414-438) refuses once the role
+         *   is gone. So this is not a containment action: to contain a leaked token, revoke it or
+         *   its accessor. (Corrected 2026-09-21: this said the delete revoked every token.)
+         * Idempotent as Alchemy requires — already gone is success — but retain is the default,
+         *   because every host logging in with the role is locked out at the delete.
          */
         delete: Effect.fn(function* ({ output }) {
           yield* baoDelete(readPath(output.name));

package/src/openbao/cloudflare-role.ts

@@ -38,13 +38,7 @@ import {
   readCloudflareRole,
   writeCloudflareRole,
 } from './cloudflare-role-wire.ts';
-import {
-  declaredRolePath,
-  isMoved,
-  judgeMove,
-  refuseMovedUpdate,
-  triedRolePath,
-} from './rename.ts';
+import { guardRename, judgeRename, roleIdentity } from './rename-identity.ts';
 
 export type { BaoCloudflareRoleAttributes, BaoCloudflareRoleProps };
 
@@ -66,6 +60,9 @@ export const BaoCloudflareRole = Resource<BaoCloudflareRole>('Bao.CloudflareRole
   defaultRemovalPolicy: 'retain',
 });
 
+/** Exact: a trailing `/` on the mount is the same path (`rolePath` trims it). */
+const IDENTITY = roleIdentity<BaoCloudflareRoleAttributes>('Bao.CloudflareRole', rolePath);
+
 export const BaoCloudflareRoleProvider = () =>
   Provider.effect(
     BaoCloudflareRole,
@@ -131,9 +128,7 @@ export const BaoCloudflareRoleProvider = () =>
          *   and the old id leaves the stack as an orphan delete, which `retain` keeps live.
          */
         diff: Effect.fn(function* ({ news, olds, output }) {
-          const tried = triedRolePath(output, olds, rolePath);
-          const declared = declaredRolePath(news, rolePath);
-          const move = yield* judgeMove('Bao.CloudflareRole', tried, declared, (path) => path);
+          const move = yield* judgeRename(IDENTITY, olds, news, output);
           if (output === undefined) return undefined;
           if (move !== undefined) return { action: 'replace' } as const;
           if (!isResolved(news)) return undefined;
@@ -153,10 +148,7 @@ export const BaoCloudflareRoleProvider = () =>
         reconcile: Effect.fn(function* ({ news, output }) {
           const path = rolePath(news.mount, news.name);
           // ⛔ An `update` across a move the diff could not see — refused before any write.
-          const before = output === undefined ? path : rolePath(output.mount, output.name);
-          if (isMoved(before, path) === true) {
-            return yield* refuseMovedUpdate('Bao.CloudflareRole', before, path);
-          }
+          yield* guardRename(IDENTITY, news, output);
           const refusal = refusalOf(news);
           if (refusal !== undefined) {
             return yield* Effect.die(new Error(`Bao.CloudflareRole ${path}: ${refusal}.`));

package/src/openbao/fake-engines-roles.ts

@@ -0,0 +1,114 @@
+/**
+ * Fakes of the stores behind the batch-2 families, for fake-bao: every role engine, JWT auth config
+ * and login-MFA enforcements (`wireRoles`), the TOTP method table (`totpMethods`) and the plugin
+ * catalog (`pluginCatalog`), behind one answer (`fakeEstate`). As in fake-engines.ts, each keys its
+ * objects the way the real server does, because a rename test is only as good as the fake's idea of
+ * "the same object".
+ *
+ * ⛔ TEST-ONLY — see fake-bao.ts. No provider imports this file.
+ */
+import type { Reply, Seen } from './fake-bao.ts';
+import { ABSENT, type Store, type Stored, lastSegment, store } from './fake-engines.ts';
+
+/**
+ * The role stores whose server lowercases the name: AppRole (openbao v2.6.2
+ * builtin/credential/approle/path_role.go:1485 and :1893), Kubernetes
+ * (builtin/credential/kubernetes backend.go:362, path_role.go:250 and :396) and JWT, whose `name`
+ * field is a TypeLowerCaseString (builtin/credential/jwt/path_role.go:77; sdk v2.6.2
+ * framework/field_data.go:250-255 lowercases it on read). PKI and SSH store the name verbatim. The
+ * tests mount all three at their default paths.
+ */
+const FOLDED = /^auth\/(approle|jwt|kubernetes)\/role\/[^/]+$/;
+
+const keyOf = (path: string): string =>
+  FOLDED.test(path) ? path.replace(/[^/]+$/, (name) => name.toLowerCase()) : path;
+
+/** Fields a write sends comma-joined that the server reads back as a list. */
+const LISTS = new Set([
+  'allowed_domains',
+  'cn_validations',
+  'ext_key_usage',
+  'key_usage',
+  'token_policies',
+]);
+
+/**
+ * The server's typed view of a `k=v` body: `true`, `false` and digit strings become values, and the
+ * LISTS split. Arrays, objects and duration strings pass through, and every reader here takes a
+ * duration string as well as seconds (`ttlSeconds`).
+ */
+const typed = (body: Stored): Stored => {
+  const out: Stored = {};
+  for (const [field, value] of Object.entries(body)) {
+    if (typeof value !== 'string') out[field] = value;
+    else if (LISTS.has(field)) out[field] = value.split(',').filter((part) => part !== '');
+    else if (value === 'true' || value === 'false') out[field] = value === 'true';
+    else out[field] = /^\d+$/.test(value) ? Number(value) : value;
+  }
+  return out;
+};
+
+/** Every role engine, JWT auth config and MFA login enforcement. A write replaces the object. */
+export const wireRoles = (): Store =>
+  store<Stored>(
+    (_path, body) => typed(body),
+    (path) => keyOf(path),
+  );
+
+/**
+ * `sys/plugins/catalog/<type>/<name>`. A register names its version in the body; a read or a delete
+ * names it in `?version=` (plugin-form.ts versionedPath).
+ */
+export const pluginCatalog = (): Store =>
+  store<Stored>(
+    (path, body) => ({ ...body, builtin: false, name: lastSegment(path.split('?')[0] ?? '') }),
+    (path, body) => {
+      const version = body?.['version'];
+      return typeof version === 'string' && version !== '' ? `${path}?version=${version}` : path;
+    },
+  );
+
+/**
+ * `identity/mfa/method/totp`: an upsert by `method_name` (identity/mfa.go:159-230), listed with
+ * every other type under `identity/mfa/method?list=true` (mfa-wire.ts). Keyed by the server-made
+ * id.
+ */
+export const totpMethods = (): Store => {
+  const live = new Map<string, Stored>();
+  let made = 0;
+  const answer = (seen: Seen): Reply => {
+    const path = seen.path.replace(/^\/v1\//, '');
+    if (seen.method === 'POST') {
+      const body = JSON.parse(seen.body) as Stored;
+      const name = body['method_name'];
+      const found = [...live].find(([, method]) => method['name'] === name)?.[0];
+      made += found === undefined ? 1 : 0;
+      const id = found ?? `method-${String(made)}`;
+      live.set(id, { ...body, id, name, namespace_path: '', type: 'totp' });
+      return { json: { data: { method_id: id } }, status: 200 };
+    }
+    if (seen.method === 'DELETE') {
+      live.delete(lastSegment(path));
+      return { status: 204 };
+    }
+    if (path !== 'identity/mfa/method?list=true' || live.size === 0) return ABSENT;
+    const info = Object.fromEntries(live);
+    return { json: { data: { key_info: info, keys: [...live.keys()] } }, status: 200 };
+  };
+  return Object.assign(answer, { live });
+};
+
+/** All three behind one answer, routed by path, for a stack that mixes the families. */
+export const fakeEstate = () => {
+  const roles = wireRoles();
+  const plugins = pluginCatalog();
+  const totp = totpMethods();
+  const answer = (seen: Seen): Reply => {
+    if (seen.path.startsWith('/v1/identity/mfa/method')) return totp(seen);
+    if (seen.path.startsWith('/v1/sys/plugins/catalog/')) return plugins(seen);
+    return roles(seen);
+  };
+  return Object.assign(answer, { plugins, roles, totp });
+};
+
+export type Estate = ReturnType<typeof fakeEstate>;

package/src/openbao/fake-engines.ts

@@ -2,7 +2,7 @@
  * Fakes of the three stores behind Bao.Policy, Bao.CloudflareRole and Bao.ProxmoxRole, for fake-bao,
  * plus Bao.Policy's provider over fake fragment directories. Each store keys its objects the way the
  * real server does. That is the point: a rename test is only as good as the fake's idea of "the
- * same object".
+ * same object". `store` is shared with fake-engines-roles.ts, which fakes the batch-2 families.
  *
  * ⛔ TEST-ONLY — see fake-bao.ts. No provider imports this file.
  */
@@ -17,26 +17,33 @@ import { trimTrailing } from './mount-path.ts';
 import { BaoPolicyProvider } from './policy.ts';
 import { policyKey } from './rename.ts';
 
-type Stored = Record<string, unknown>;
+export type Stored = Record<string, unknown>;
 
 /** An answer for fake-bao that also exposes what it holds, keyed by API path (no `/v1/`). */
 export type Store = ((seen: Seen) => Reply) & { readonly live: Map<string, Stored> };
 
-const ABSENT: Reply = { json: { errors: [] }, status: 404 };
+export const ABSENT: Reply = { json: { errors: [] }, status: 404 };
 
-const store = (
-  write: (path: string, body: Record<string, string>, before: Stored | undefined) => Stored,
-  key: (path: string) => string = (path) => path,
+/**
+ * A store of objects by API path. `key` turns a request path (and a write's body) into the key the
+ * server would store it under.
+ */
+export const store = <B extends Stored = Record<string, string>>(
+  write: (path: string, body: B, before: Stored | undefined) => Stored,
+  key: (path: string, body?: B) => string = (path) => path,
 ): Store => {
   const live = new Map<string, Stored>();
   const answer = (seen: Seen): Reply => {
-    const path = key(seen.path.replace(/^\/v1\//, ''));
-    if (seen.method === 'PUT') {
-      const body = JSON.parse(seen.body) as Record<string, string>;
+    const raw = seen.path.replace(/^\/v1\//, '');
+    // ★ `bao write` sends PUT, and the identity endpoints are called with POST. Both write.
+    if (seen.method === 'PUT' || seen.method === 'POST') {
+      const body = JSON.parse(seen.body) as B;
+      const path = key(raw, body);
       live.set(path, write(path, body, live.get(path)));
       return { status: 204 };
     }
-    // ★ A delete answers 204 whether or not the object existed, as all three do.
+    const path = key(raw);
+    // ★ A delete answers 204 whether or not the object existed, as every engine here does.
     if (seen.method === 'DELETE') {
       live.delete(path);
       return { status: 204 };
@@ -47,7 +54,7 @@ const store = (
   return Object.assign(answer, { live });
 };
 
-const lastSegment = (path: string) => path.split('/').at(-1) ?? '';
+export const lastSegment = (path: string): string => path.split('/').at(-1) ?? '';
 
 /**
  * `sys/policies/acl/<name>`. It strips the policy's trailing newline on write (measured on the live

package/src/openbao/fake-families.ts

@@ -0,0 +1,182 @@
+/**
+ * The nine batch-2 families as rows of one table, so a rename test can run each of them through
+ * Alchemy's own plan and apply (fake-stack.ts) against one fake (fake-engines-roles.ts). Every row
+ * declares a resource whose identity is `name` (for Bao.JwtAuthConfig, the mount), with `knob`, a
+ * duration, in a prop that is NOT its identity: the pending Output in "a rename lands with another
+ * pending prop".
+ *
+ * ⛔ TEST-ONLY. Every value is a placeholder, not the estate's.
+ */
+import * as RemovalPolicy from 'alchemy/RemovalPolicy';
+import type * as Output from 'alchemy/Output';
+import * as Effect from 'effect/Effect';
+import * as Layer from 'effect/Layer';
+import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
+import { BaoAuthRole, BaoAuthRoleProvider } from './auth-role.ts';
+import type { Seen } from './fake-bao.ts';
+import { type Estate, fakeEstate } from './fake-engines-roles.ts';
+import { type FakeStack, type StackBody, withFakeStack } from './fake-stack.ts';
+import { BaoJwtAuthConfig, BaoJwtAuthConfigProvider } from './jwt-config.ts';
+import { BaoJwtRole, BaoJwtRoleProvider } from './jwt-role.ts';
+import { BaoKubernetesRole, BaoKubernetesRoleProvider } from './kubernetes-role.ts';
+import { BaoMfaLoginEnforcement, BaoMfaLoginEnforcementProvider } from './mfa-enforcement.ts';
+import { BaoMfaTotpMethod, BaoMfaTotpMethodProvider } from './mfa-totp.ts';
+import { BaoPkiRole, BaoPkiRoleProvider } from './pki-role.ts';
+import { BaoPlugin, BaoPluginProvider } from './plugin.ts';
+import { BaoSshRole, BaoSshRoleProvider } from './ssh-role.ts';
+
+export const familyProviders = Layer.mergeAll(
+  BaoAuthRoleProvider(),
+  BaoJwtAuthConfigProvider(),
+  BaoJwtRoleProvider(),
+  BaoKubernetesRoleProvider(),
+  BaoMfaLoginEnforcementProvider(),
+  BaoMfaTotpMethodProvider(),
+  BaoPkiRoleProvider(),
+  BaoPluginProvider(),
+  BaoSshRoleProvider(),
+  FetchHttpClient.layer,
+);
+
+/** One stack over a fresh estate: every family's provider, and every call the fake saw. */
+export const withEstate = (
+  body: (stack: FakeStack, estate: Estate, seen: Seen[]) => Promise<void>,
+): Promise<void> => {
+  const estate = fakeEstate();
+  return withFakeStack(familyProviders, estate, (stack, bao) => body(stack, estate, bao.seen));
+};
+
+/** The row for one family, by name. */
+export const rowOf = (family: string): Family => {
+  const row = FAMILIES.find((each) => each.family === family);
+  if (row === undefined) throw new Error(`no fake-families row for ${family}`);
+  return row;
+};
+
+type Text = string | Output.Output<string>;
+type Removal = typeof RemovalPolicy.destroy;
+
+export interface Family {
+  readonly family: string;
+  /** One resource, logical id `id`, whose identity is `name`. */
+  readonly declare: (id: string, name: Text, knob: Text, removal?: Removal) => StackBody;
+  /** Whether the fake holds the object `name` names. */
+  readonly has: (estate: Estate, name: string) => boolean;
+}
+
+const role = (path: (name: string) => string) => (estate: Estate, name: string) =>
+  estate.roles.live.has(path(name));
+
+const APPROLE = { secretIdTtl: '24h', tokenMaxTtl: '1h', tokenPolicies: ['default'] } as const;
+const SHA = 'a'.repeat(64);
+
+export const FAMILIES: readonly Family[] = [
+  {
+    declare: (id, name, knob, removal = RemovalPolicy.retain) =>
+      BaoAuthRole(id, { ...APPROLE, name, tokenTtl: knob }).pipe(removal()),
+    family: 'Bao.AuthRole',
+    has: role((name) => `auth/approle/role/${name}`),
+  },
+  {
+    declare: (id, name, knob, removal = RemovalPolicy.retain) =>
+      BaoPkiRole(id, { allowedDomains: ['example.com'], maxTtl: '8760h', name, ttl: knob }).pipe(
+        removal(),
+      ),
+    family: 'Bao.PkiRole',
+    has: role((name) => `pki/roles/${name}`),
+  },
+  {
+    declare: (id, name, knob, removal = RemovalPolicy.retain) =>
+      BaoJwtRole(id, {
+        boundAudiences: ['https://example.com'],
+        name,
+        roleType: 'jwt',
+        tokenPolicies: ['ci'],
+        tokenTtl: knob,
+        userClaim: 'sub',
+      }).pipe(removal()),
+    family: 'Bao.JwtRole',
+    has: role((name) => `auth/jwt/role/${name}`),
+  },
+  {
+    declare: (id, name, knob, removal = RemovalPolicy.retain) =>
+      BaoKubernetesRole(id, {
+        aliasNameSource: 'serviceaccount_uid',
+        boundServiceAccountNames: ['app'],
+        boundServiceAccountNamespaces: ['apps'],
+        name,
+        tokenPolicies: ['app'],
+        tokenTtl: knob,
+      }).pipe(removal()),
+    family: 'Bao.KubernetesRole',
+    has: role((name) => `auth/kubernetes/role/${name}`),
+  },
+  {
+    declare: (id, mount, knob, removal = RemovalPolicy.retain) =>
+      BaoJwtAuthConfig(id, {
+        boundIssuer: knob,
+        jwksUrl: 'https://issuer.example.com/keys',
+        mount,
+      }).pipe(removal()),
+    family: 'Bao.JwtAuthConfig',
+    has: role((mount) => `auth/${mount}/config`),
+  },
+  {
+    declare: (id, name, knob, removal = RemovalPolicy.retain) =>
+      BaoMfaTotpMethod(id, { issuer: knob, name }).pipe(removal()),
+    family: 'Bao.MfaTotpMethod',
+    has: (estate, name) => [...estate.totp.live.values()].some((each) => each['name'] === name),
+  },
+  {
+    declare: (id, name, knob, removal = RemovalPolicy.retain) =>
+      BaoMfaLoginEnforcement(id, {
+        authMethodTypes: ['jwt'],
+        mfaMethodIds: [knob],
+        name,
+      }).pipe(removal()),
+    family: 'Bao.MfaLoginEnforcement',
+    has: role((name) => `identity/mfa/login-enforcement/${name}`),
+  },
+  {
+    declare: (id, name, knob, removal = RemovalPolicy.retain) =>
+      BaoSshRole(id, {
+        allowUserCertificates: true,
+        allowedUsers: ['ops'],
+        maxTtl: '8h',
+        name,
+        ttl: knob,
+      }).pipe(removal()),
+    family: 'Bao.SshRole',
+    has: role((name) => `ssh/roles/${name}`),
+  },
+  {
+    declare: (id, name, knob, removal = RemovalPolicy.retain) =>
+      BaoPlugin(id, {
+        args: [knob],
+        command: 'plugin-example',
+        name,
+        sha256: SHA,
+        type: 'secret',
+        version: 'v1.0.0',
+      }).pipe(removal()),
+    family: 'Bao.Plugin',
+    has: (estate, name) =>
+      estate.plugins.live.has(`sys/plugins/catalog/secret/${name}?version=v1.0.0`),
+  },
+];
+
+/**
+ * Two of one family, `X` and `Y`, under destroy: the shape a swap or a shift needs. Their knobs
+ * differ, so a generation that lands on the other's name has to write over it.
+ */
+export const pairOf =
+  (row: Family) =>
+  (x: string, y: string): StackBody =>
+    Effect.gen(function* () {
+      yield* row.declare('X', x, '15m', RemovalPolicy.destroy);
+      yield* row.declare('Y', y, '30m', RemovalPolicy.destroy);
+    });
+
+/** An AppRole whose `tokenTtl` attribute is the Output the other rows are fed. */
+export const upstream = (ttl: string) =>
+  BaoAuthRole('Upstream', { ...APPROLE, name: 'upstream', tokenTtl: ttl });

package/src/openbao/host-approles.test.ts

@@ -80,9 +80,21 @@ describe('hostAppRoles', () => {
     }
   });
 
-  it('refuses unknown classes, duplicate hosts and names that would blur the separator', () => {
+  it('gives a host in two classes one role per class', () => {
+    const hosts = [
+      { class: 'pve-node', name: 'node-c' },
+      { class: 'operator-signer', name: 'node-c' },
+    ];
+    assert.deepEqual(
+      hostAppRoles({ ...INPUT, hosts }).map((role) => role.name),
+      ['operator-signer--node-c', 'pve-node--node-c'],
+    );
+  });
+
+  it('refuses unknown classes, a host twice in one class and names that blur the separator', () => {
     const bad = [
       { class: 'nope', name: 'node-c' },
+      { class: 'constructor', name: 'node-d' },
       { class: 'pve-node', name: 'node-a' },
       { class: 'pve-node', name: 'node-a' },
       { class: 'pve-node', name: 'node--x' },
@@ -93,7 +105,8 @@ describe('hostAppRoles', () => {
       (error: unknown) => {
         assert.ok(error instanceof Error);
         assert.match(error.message, /unknown class `nope`/);
-        assert.match(error.message, /`node-a` is listed twice/);
+        assert.match(error.message, /unknown class `constructor`/);
+        assert.match(error.message, /`node-a` is listed twice in class `pve-node`/);
         assert.match(error.message, /`node--x` is not lowercase/);
         assert.match(error.message, /`Node-Y` is not lowercase/);
         return true;

package/src/openbao/host-approles.ts

@@ -96,22 +96,37 @@ export const hostAppRoles = (input: HostAppRolesInput): readonly BaoAuthRoleProp
   const problems = Object.entries(input.classes).flatMap(([name, spec]) =>
     classProblems(name, spec),
   );
+  /**
+   * ⛔ DEDUPED ON THE ROLE NAME, NOT THE HOST NAME. A host may sit in several classes (one machine
+   *   that is both a signer and a node), and each class gives it its own role: `<class>--<host>`
+   *   differs, so nothing collides. Until 2026-09-21 this keyed on the host alone and refused that
+   *   estate outright. What it must still refuse is the same host twice in ONE class: two
+   *   declarations of one role name, so one AppRole that two resources would each claim.
+   */
   const seen = new Set<string>();
   const roles: BaoAuthRoleProps[] = [];
   for (const host of input.hosts) {
     if (!NAME.test(host.name)) {
       problems.push(`host \`${host.name}\` is not lowercase letters, digits, single hyphens`);
     }
-    if (seen.has(host.name)) problems.push(`host \`${host.name}\` is listed twice`);
-    seen.add(host.name);
-    const spec = input.classes[host.class];
+    const name = hostRoleName(host.class, host.name);
+    if (seen.has(name)) {
+      problems.push(`host \`${host.name}\` is listed twice in class \`${host.class}\``);
+    }
+    seen.add(name);
+    /**
+     * ⛔ OWN KEYS ONLY. `classes['constructor']` is Object's constructor, not undefined, so a host
+     *   naming it passed as a class with no policies and no secretIdTtl, never checked by
+     *   classProblems, and wrote a role whose secret_id never expires.
+     */
+    const spec = Object.hasOwn(input.classes, host.class) ? input.classes[host.class] : undefined;
     if (spec === undefined) {
       problems.push(`host \`${host.name}\` names unknown class \`${host.class}\``);
       continue;
     }
     roles.push({
       bindSecretId: true,
-      name: hostRoleName(host.class, host.name),
+      name,
       secretIdNumUses: spec.secretIdNumUses ?? 0,
       secretIdTtl: spec.secretIdTtl,
       tokenMaxTtl: spec.tokenMaxTtl,

package/src/openbao/jwt-config.ts

@@ -10,6 +10,11 @@
  *
  * ★ REPLACE SEMANTICS (REPLACE.md): `mount` changed → `replace`: the new mount gets the config;
  *   the old one keeps its own until that mount is disabled. There is no identity but the mount.
+ * ⛔ A MOVE ONTO A MOUNT WHOSE CONFIG EXISTS FAILS THE PLAN, like every other family's move onto an
+ *   occupied path (rename-identity.ts). With no delete, nothing is lost to a swap, which MEASURED
+ *   2026-09-21 ended with each config where it was declared. But the new generation writes over
+ *   the config it lands on, which changes who can log in on that mount: an issuer or key set
+ *   someone else manages, silently replaced. Move through a mount with no config instead.
  */
 import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';
@@ -22,11 +27,12 @@ import {
   attributesOf,
   configPath,
   matches,
-  mountOf,
   problems,
   wouldErase,
   writeBody,
 } from './jwt-config-form.ts';
+import { declaredOr } from './rename.ts';
+import { type Identity, guardRename, judgeRename } from './rename-identity.ts';
 import { type RoleSpec, planRole, readRoleAt, reconcileRole } from './role-reconcile.ts';
 
 export type { BaoJwtAuthConfigAttributes, BaoJwtAuthConfigProps } from './jwt-config-form.ts';
@@ -43,6 +49,16 @@ export const BaoJwtAuthConfig = Resource<BaoJwtAuthConfig>('Bao.JwtAuthConfig',
   defaultRemovalPolicy: 'retain',
 });
 
+/** The identity is the mount alone; a trailing `/` is the same mount (`configPath` trims it). */
+const IDENTITY: Identity<BaoJwtAuthConfigAttributes> = {
+  declared: (props) => {
+    const mount = declaredOr(props, 'mount', 'jwt');
+    return mount === undefined ? undefined : configPath({ mount });
+  },
+  family: 'Bao.JwtAuthConfig',
+  recorded: (output) => configPath(output),
+};
+
 export const jwtConfigSpec = (
   props: BaoJwtAuthConfigProps,
 ): RoleSpec<BaoJwtAuthConfigAttributes> => ({
@@ -67,14 +83,19 @@ export const BaoJwtAuthConfigProvider = () =>
           return found?.attributes;
         }),
 
-        diff: Effect.fn(function* ({ news, output }) {
-          if (output === undefined || !isResolved(news)) return undefined;
-          if (mountOf(news) !== output.mount) return { action: 'replace' } as const;
+        diff: Effect.fn(function* ({ news, olds, output }) {
+          // ⛔ The mount first, before isResolved; onto a mount with a config fails the plan.
+          const move = yield* judgeRename(IDENTITY, olds, news, output);
+          if (output === undefined) return undefined;
+          if (move !== undefined) return { action: 'replace' } as const;
+          if (!isResolved(news)) return undefined;
           return { action: yield* planRole(jwtConfigSpec(news)) } as const;
         }),
 
         /** ⛔ Refuses, before writing, a live config that carries an OIDC client (wouldErase). */
-        reconcile: Effect.fn(function* ({ news }) {
+        reconcile: Effect.fn(function* ({ news, output }) {
+          // ⛔ An `update` across a move the diff could not see — refused before any write.
+          yield* guardRename(IDENTITY, news, output);
           return yield* reconcileRole(jwtConfigSpec(news));
         }),