dh-cli 0.8.7__tar.gz → 0.8.8__tar.gz

{dh_cli-0.8.7 → dh_cli-0.8.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dh-cli
-Version: 0.8.7
+Version: 0.8.8
 Summary: Dayhoff Labs developer CLI
 Author-email: Dayhoff Labs <dev@dayhofflabs.com>
 License: # PolyForm Noncommercial License 1.0.0

{dh_cli-0.8.7 → dh_cli-0.8.8}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "dh-cli"
-version = "0.8.7"
+version = "0.8.8"
 description = "Dayhoff Labs developer CLI"
 requires-python = ">=3.11"
 readme = "README.md"

{dh_cli-0.8.7 → dh_cli-0.8.8}/src/dh_cli/bedrock/commands.py

@@ -17,15 +17,30 @@ from __future__ import annotations
 
 import datetime as dt
 import json
+import re
 import sys
-from typing import Optional
+from typing import Optional, TypedDict
+from uuid import uuid4
 
 import click
 
 from dh_cli._identity import HandleResolutionError, resolve_handle_from_session
+from dh_cli.github_commands import _scrub_token
 
 from . import cost_report as cr
 
+
+class BedrockKeyPayload(TypedDict):
+    """The JSON shape stored in `cursor-bedrock/<handle>`."""
+
+    access_key_id: str
+    secret_access_key: str
+    region: str
+
+
+# Matches the admin SSO role within an assumed-role ARN.
+_ADMIN_ROLE_RE = re.compile(r"AWSReservedSSO_DevAdminAccess_")
+
 # Hard-coded for the dev account. Kept here (not as user-facing flags)
 # because they never change in practice and making every dev remember
 # them is the whole reason this command exists.
@@ -124,9 +139,18 @@ def bedrock_key(handle: Optional[str], region: str, mode: str):
     resolved = handle or _resolve_handle()
     secret_id = f"{_SECRET_PREFIX}{resolved}"
 
+    sm = boto3.client("secretsmanager", region_name=region)
+    not_found = getattr(sm.exceptions, "ResourceNotFoundException", None)
+    if not (isinstance(not_found, type) and issubclass(not_found, BaseException)):
+        not_found = ()
     try:
-        sm = boto3.client("secretsmanager", region_name=region)
         resp = sm.get_secret_value(SecretId=secret_id)
+    except not_found:
+        raise click.ClickException(
+            f"No key yet for `{resolved}` (secret `{secret_id}` has no current "
+            f"version). Ask an admin to run `dh bedrock rotate --handle {resolved}` "
+            "to mint your first key."
+        )
     except Exception as exc:
         raise click.ClickException(
             f"Could not read secret `{secret_id}`: {exc}\n"
@@ -151,6 +175,107 @@ def bedrock_key(handle: Optional[str], region: str, mode: str):
         click.echo(json.dumps(payload, indent=2))
 
 
+# --------------------------------------------------------------------------
+# `dh bedrock rotate`
+# --------------------------------------------------------------------------
+
+
+@bedrock.command("rotate")
+@click.option(
+    "--handle",
+    "-u",
+    required=True,
+    help="Developer handle (e.g. 'dma'). Mints a key for `dev-cursor-<handle>`.",
+)
+@click.option(
+    "--region",
+    default=_DEFAULT_REGION,
+    show_default=True,
+    help="AWS region for the Secrets Manager secret.",
+)
+def bedrock_rotate(handle: str, region: str):
+    """Admin: mint a fresh Cursor Bedrock key for a developer.
+
+    Runs as `dev-admin`. Creates a new IAM access key for
+    `dev-cursor-<handle>`, writes it to `cursor-bedrock/<handle>`, then
+    deletes the prior key (delete-now).
+
+    \b
+    Examples:
+      dh bedrock rotate --handle dma
+    """
+    import boto3
+
+    user_name = f"dev-cursor-{handle}"
+    secret_id = f"{_SECRET_PREFIX}{handle}"
+
+    # Admin pre-check (defense-in-depth) — before any AWS mutation.
+    sts = boto3.Session().client("sts")
+    caller_arn = sts.get_caller_identity()["Arn"]
+    if not _ADMIN_ROLE_RE.search(caller_arn):
+        raise click.ClickException(
+            f"This command must be run as dev-admin (`awslogin dev-admin`). "
+            f"Current caller is not a DevAdminAccess role: {caller_arn}"
+        )
+
+    iam = boto3.client("iam")
+    sm = boto3.client("secretsmanager", region_name=region)
+
+    # Preflight — before create_access_key.
+    try:
+        resp = iam.list_access_keys(UserName=user_name)
+    except Exception as exc:
+        raise click.ClickException(
+            f"Could not list access keys for `{user_name}`: {exc}\n"
+            f"The IAM user may not exist yet — run `tfa` to provision it first."
+        )
+
+    prior_active_ids = [
+        meta["AccessKeyId"]
+        for meta in resp.get("AccessKeyMetadata", [])
+        if meta.get("Status") == "Active"
+    ]
+    if len(prior_active_ids) >= 2:
+        raise click.ClickException(
+            f"`{user_name}` already has 2 active keys (the IAM per-user limit). "
+            f"Delete one before rotating."
+        )
+
+    # Transaction: create → put → delete prior.
+    create_resp = iam.create_access_key(UserName=user_name)
+    new_akid = create_resp["AccessKey"]["AccessKeyId"]
+    new_secret = create_resp["AccessKey"]["SecretAccessKey"]
+
+    payload: BedrockKeyPayload = {
+        "access_key_id": new_akid,
+        "secret_access_key": new_secret,
+        "region": region,
+    }
+    try:
+        sm.put_secret_value(
+            SecretId=secret_id,
+            SecretString=json.dumps(payload),
+            ClientRequestToken=uuid4().hex,
+        )
+    except Exception as exc:
+        # Roll back the just-created key. Scrub the secret BEFORE building
+        # the message so the ClickException output can never leak it.
+        iam.delete_access_key(UserName=user_name, AccessKeyId=new_akid)
+        scrubbed = _scrub_token(str(exc), new_secret)
+        raise click.ClickException(
+            f"PutSecretValue failed for `{secret_id}`; rolled back new key "
+            f"{new_akid}. No prior key was deleted. Error: {scrubbed}"
+        )
+
+    # Only after put succeeds: delete prior active keys (not the new one).
+    for old_id in prior_active_ids:
+        if old_id == new_akid:
+            continue
+        iam.delete_access_key(UserName=user_name, AccessKeyId=old_id)
+
+    click.echo(f"Rotated `{secret_id}`. New access_key_id: {new_akid}")
+
+
 # --------------------------------------------------------------------------
 # `dh bedrock cost`
 # --------------------------------------------------------------------------

{dh_cli-0.8.7 → dh_cli-0.8.8}/tests/bedrock/test_cost_command.py

@@ -23,15 +23,32 @@ def _sts_stub(arn: str = _DEV_ARN):
     return sts
 
 
+def _session_stub(sts: MagicMock) -> MagicMock:
+    """boto3.Session() stub whose .client('sts') returns `sts`.
+
+    `_resolve_handle` (used by `bedrock_cost --me`) goes through
+    `_identity.resolve_handle_from_session(boto3.Session())`, which
+    calls `session.client('sts')`. The S3 client used by walk_logs
+    still goes through `boto3.client('s3', ...)` directly, which is
+    patched separately.
+    """
+    session = MagicMock()
+    session.client.return_value = sts
+    return session
+
+
 def _patch_boto3(sts=None):
+    sts_stub = sts or _sts_stub()
+
     def _client(name, **_kwargs):
         if name == "s3":
             return MagicMock()
-        if name == "sts":
-            return sts or _sts_stub()
-        raise AssertionError(f"unexpected boto3 client: {name}")
+        raise AssertionError(f"unexpected boto3.client call: {name}")
 
-    return patch("boto3.client", side_effect=_client)
+    return (
+        patch("boto3.Session", return_value=_session_stub(sts_stub)),
+        patch("boto3.client", side_effect=_client),
+    )
 
 
 def _invoke(args):
@@ -55,8 +72,10 @@ def test_cost_default_window_is_last_seven_days_ending_today_utc(load_fixture):
         captured_kwargs.update(kwargs)
         return iter([load_fixture("A_cache_write.json")])
 
+    p_sess, p_cli = _patch_boto3()
     with (
-        _patch_boto3(),
+        p_sess,
+        p_cli,
         patch("dh_cli.bedrock.cost_report.walk_logs", side_effect=_walk_stub),
         patch(
             "dh_cli.bedrock.cost_report.fetch_cost_explorer_total",
@@ -80,8 +99,10 @@ def test_cost_default_window_is_last_seven_days_ending_today_utc(load_fixture):
 
 def test_cost_explicit_past_end_runs_ce_reconcile(load_fixture):
     """When --end is in the past, CE reconcile runs as before."""
+    p_sess, p_cli = _patch_boto3()
     with (
-        _patch_boto3(),
+        p_sess,
+        p_cli,
         patch("dh_cli.bedrock.cost_report.walk_logs") as walk,
         patch(
             "dh_cli.bedrock.cost_report.fetch_cost_explorer_total",
@@ -118,8 +139,10 @@ def test_cost_me_filters_by_caller_handle_for_principal_type_grouping(load_fixtu
             ]
         )
 
+    p_sess, p_cli = _patch_boto3(sts=_sts_stub(_DEV_ARN))
     with (
-        _patch_boto3(sts=_sts_stub(_DEV_ARN)),
+        p_sess,
+        p_cli,
         patch("dh_cli.bedrock.cost_report.walk_logs", side_effect=_walk_stub),
         patch(
             "dh_cli.bedrock.cost_report.fetch_cost_explorer_total",

dh_cli-0.8.8/tests/bedrock/test_cursor_bedrock_isolation.py

@@ -0,0 +1,271 @@
+"""Invariant test: the per-user Cursor Bedrock secret policy isolates
+devs on BOTH the read and write planes.
+
+Runs nightly against dev via `iam:SimulatePrincipalPolicy`. A future
+Terraform change that drops the `DenyNonOwnerDataAccess` write actions,
+the `ArnNotLike` admin carve-out, or the `AllowAdminRotate` statement
+will fail this within 24 hours.
+
+This is the behavioral counterpart to `verify_cursor_keys.sh`, which
+only checks the policy *shape* (and runs as admin, whose identity policy
+bypasses the resource policy, so it cannot prove the deny actually
+fires). Mirrors `tests/github/test_engine_role_cannot_read_github_pat.py`,
+with one important difference:
+
+- The github engine-role test simulates an *identity* policy only and
+  asserts `implicitDeny` (the role simply has no grant). THIS test
+  exercises the secret's *resource-based* policy and asserts
+  `explicitDeny` for the cross-user data actions (the resource-policy
+  deny actively fires) and `allowed` for owner-read / admin-write.
+
+SimulatePrincipalPolicy + resource-policy nuance (confirmed against the
+boto3 docs while implementing):
+
+- The simulator does NOT auto-fetch a resource's policy; it must be
+  passed as the `ResourcePolicy` string. We fetch the live policy via
+  `secretsmanager:GetResourcePolicy` so the test tracks whatever
+  Terraform actually applied (not a hard-coded copy).
+- Resource-policy evaluation in the simulator is only wired up cleanly
+  for IAM *users*, not roles. Our principals are SSO permission-set
+  *roles*, so we drive the decision purely from the resource policy +
+  `ContextEntries` (`aws:userid`, `aws:PrincipalArn`,
+  `aws:MultiFactorAuthPresent`) and pass a real principal ARN as
+  `CallerArn`. The identity-policy side (DeveloperAccess's broad
+  `cursor-bedrock/*` grant) is what the resource-policy deny is the
+  belt-and-suspenders for; here we assert the resource policy in
+  isolation, which is the statement under test.
+- `ResourceOwner` is the dev account, since the simulated secret ARN
+  carries the account already but the resource policy is supplied
+  out-of-band.
+
+Fallback if the simulator ever stops honoring `ResourcePolicy` for
+`secretsmanager:*` (as it does for `sts:Assume*`): the operator's live
+owner/non-owner `aws secretsmanager get-secret-value` /
+`put-secret-value` probes (run under the respective SSO sessions) are
+the ground-truth backstop; see `blueprints/scripts/bedrock/README.md`.
+
+Marked `integration` so it doesn't run in the default `pytest` unit
+suite (no AWS creds in CI runners).
+"""
+
+from __future__ import annotations
+
+import os
+
+import pytest
+
+ACCOUNT_ID = "074735440724"
+REGION = "us-east-1"
+
+# A non-owner DeveloperAccess role ARN (the principal whose cross-user
+# access must be denied) and a DevAdminAccess role ARN (the rotate
+# principal whose write must be allowed). Plus the owner handle for the
+# allowed-read case. Set these to run the guard; unset => skip.
+#
+# IMPORTANT: `simulate_principal_policy` honors a `ResourcePolicy` /
+# accepts a `CallerArn` only for IAM *user* sources, not assumed-role
+# ARNs. The deny/allow conditions key on `aws:userid` / `aws:PrincipalArn`
+# which we supply via ContextEntries regardless, so point these at IAM
+# user ARNs that the simulator will accept (the decision is driven by the
+# resource policy + context, not by the source identity's own policies).
+# If only SSO role ARNs are available and the simulator rejects them,
+# fall back to the live owner/non-owner probes documented in the runbook.
+NONOWNER_DEV_ROLE_ARN_ENV = "DH_BEDROCK_NONOWNER_DEV_ROLE_ARN"
+ADMIN_ROLE_ARN_ENV = "DH_BEDROCK_ADMIN_ROLE_ARN"
+OWNER_HANDLE_ENV = "DH_BEDROCK_OWNER_HANDLE"
+
+# The handle whose secret the non-owner principal tries to touch. Any
+# handle that is NOT the non-owner's own session name works; default to a
+# real per-user handle from cursor_bedrock_users.
+OTHER_HANDLE = os.environ.get("DH_BEDROCK_OTHER_HANDLE", "toni")
+
+
+def _secret_arn(handle: str) -> str:
+    return f"arn:aws:secretsmanager:{REGION}:{ACCOUNT_ID}:secret:cursor-bedrock/{handle}"
+
+
+def _role_unique_id(role_arn: str) -> str:
+    """`aws:userid` for an assumed SSO role is `<role-unique-id>:<session>`.
+
+    We don't have the role's unique id from the ARN alone, so we resolve
+    it from IAM. Tests that only need `aws:PrincipalArn` (the
+    cross-user/admin cases keyed on the role ARN) don't call this.
+    """
+    import boto3
+
+    role_name = role_arn.split("/")[-1]
+    iam = boto3.client("iam")
+    return iam.get_role(RoleName=role_name)["Role"]["RoleId"]
+
+
+def _fetch_resource_policy(handle: str) -> str:
+    import boto3
+
+    sm = boto3.client("secretsmanager", region_name=REGION)
+    resp = sm.get_resource_policy(SecretId=f"cursor-bedrock/{handle}")
+    policy = resp.get("ResourcePolicy")
+    if not policy:
+        pytest.skip(f"cursor-bedrock/{handle} has no resource policy attached")
+    return policy
+
+
+def _simulate(
+    *,
+    caller_arn: str,
+    action: str,
+    resource_arn: str,
+    resource_policy: str,
+    context_entries: list[dict],
+) -> str:
+    import boto3
+
+    iam = boto3.client("iam")
+    result = iam.simulate_principal_policy(
+        PolicySourceArn=caller_arn,
+        ActionNames=[action],
+        ResourceArns=[resource_arn],
+        ResourcePolicy=resource_policy,
+        ResourceOwner=ACCOUNT_ID,
+        CallerArn=caller_arn,
+        ContextEntries=context_entries,
+    )
+    return result["EvaluationResults"][0]["EvalDecision"]
+
+
+def _ctx(principal_arn: str, userid: str) -> list[dict]:
+    return [
+        {
+            "ContextKeyName": "aws:PrincipalArn",
+            "ContextKeyValues": [principal_arn],
+            "ContextKeyType": "string",
+        },
+        {
+            "ContextKeyName": "aws:userid",
+            "ContextKeyValues": [userid],
+            "ContextKeyType": "string",
+        },
+        {
+            "ContextKeyName": "aws:MultiFactorAuthPresent",
+            "ContextKeyValues": ["true"],
+            "ContextKeyType": "boolean",
+        },
+    ]
+
+
+def _require(env_var: str) -> str:
+    value = os.environ.get(env_var)
+    if not value:
+        pytest.skip(
+            f"Set {env_var} (and the other DH_BEDROCK_* role ARNs / owner "
+            f"handle) to run the Cursor Bedrock isolation guard."
+        )
+    return value
+
+
+@pytest.mark.integration
+def test_non_owner_developer_denied_get():
+    """A DeveloperAccess non-owner is explicitly denied GetSecretValue on
+    another user's cursor-bedrock secret (DenyNonOwnerDataAccess fires)."""
+    dev_arn = _require(NONOWNER_DEV_ROLE_ARN_ENV)
+    policy = _fetch_resource_policy(OTHER_HANDLE)
+    # Session name deliberately != OTHER_HANDLE so the userid doesn't match.
+    decision = _simulate(
+        caller_arn=dev_arn,
+        action="secretsmanager:GetSecretValue",
+        resource_arn=_secret_arn(OTHER_HANDLE),
+        resource_policy=policy,
+        context_entries=_ctx(dev_arn, "AROANONOWNERDEV:intruder"),
+    )
+    assert decision == "explicitDeny", (
+        f"A non-owner DeveloperAccess principal must be explicitly denied "
+        f"GetSecretValue on cursor-bedrock/{OTHER_HANDLE}; got {decision}. "
+        f"DenyNonOwnerDataAccess (read plane) regressed."
+    )
+
+
+@pytest.mark.integration
+def test_non_owner_developer_denied_put():
+    """Write-plane isolation: a non-owner non-admin is explicitly denied
+    PutSecretValue (cannot overwrite another dev's key)."""
+    dev_arn = _require(NONOWNER_DEV_ROLE_ARN_ENV)
+    policy = _fetch_resource_policy(OTHER_HANDLE)
+    decision = _simulate(
+        caller_arn=dev_arn,
+        action="secretsmanager:PutSecretValue",
+        resource_arn=_secret_arn(OTHER_HANDLE),
+        resource_policy=policy,
+        context_entries=_ctx(dev_arn, "AROANONOWNERDEV:intruder"),
+    )
+    assert decision == "explicitDeny", (
+        f"A non-owner DeveloperAccess principal must be explicitly denied "
+        f"PutSecretValue on cursor-bedrock/{OTHER_HANDLE}; got {decision}. "
+        f"The write-hole (Council C1) reopened."
+    )
+
+
+@pytest.mark.integration
+def test_non_owner_developer_denied_update_stage():
+    """Write-plane isolation: a non-owner non-admin is explicitly denied
+    UpdateSecretVersionStage."""
+    dev_arn = _require(NONOWNER_DEV_ROLE_ARN_ENV)
+    policy = _fetch_resource_policy(OTHER_HANDLE)
+    decision = _simulate(
+        caller_arn=dev_arn,
+        action="secretsmanager:UpdateSecretVersionStage",
+        resource_arn=_secret_arn(OTHER_HANDLE),
+        resource_policy=policy,
+        context_entries=_ctx(dev_arn, "AROANONOWNERDEV:intruder"),
+    )
+    assert decision == "explicitDeny", (
+        f"A non-owner DeveloperAccess principal must be explicitly denied "
+        f"UpdateSecretVersionStage on cursor-bedrock/{OTHER_HANDLE}; got "
+        f"{decision}. DenyNonOwnerDataAccess (write plane) regressed."
+    )
+
+
+@pytest.mark.integration
+def test_owner_developer_allowed_get():
+    """The owner reading their OWN secret is allowed. The match is on
+    aws:userid StringLike "*:<owner>", so the simulated session name must
+    equal the owner handle and the resolved role unique-id is its prefix."""
+    dev_arn = _require(NONOWNER_DEV_ROLE_ARN_ENV)
+    owner = _require(OWNER_HANDLE_ENV)
+    policy = _fetch_resource_policy(owner)
+    role_id = _role_unique_id(dev_arn)
+    decision = _simulate(
+        caller_arn=dev_arn,
+        action="secretsmanager:GetSecretValue",
+        resource_arn=_secret_arn(owner),
+        resource_policy=policy,
+        # userid ends in ":<owner>" (matches AllowOwnerSSORead StringLike).
+        context_entries=_ctx(dev_arn, f"{role_id}:{owner}"),
+    )
+    assert decision == "allowed", (
+        f"The owner reading cursor-bedrock/{owner} under their own SSO "
+        f"session must be allowed; got {decision}. AllowOwnerSSORead "
+        f"regressed (or the deny over-fires on the owner)."
+    )
+
+
+@pytest.mark.integration
+def test_admin_allowed_put():
+    """The DevAdminAccess rotate role writing another user's secret is
+    allowed: AllowAdminRotate fires and the deny's ArnNotLike carve-out
+    lets it through."""
+    admin_arn = _require(ADMIN_ROLE_ARN_ENV)
+    policy = _fetch_resource_policy(OTHER_HANDLE)
+    decision = _simulate(
+        caller_arn=admin_arn,
+        action="secretsmanager:PutSecretValue",
+        resource_arn=_secret_arn(OTHER_HANDLE),
+        resource_policy=policy,
+        # Admin session name != OTHER_HANDLE; the allow is keyed on the
+        # admin's aws:PrincipalArn, not userid.
+        context_entries=_ctx(admin_arn, "AROADMIN:dma"),
+    )
+    assert decision == "allowed", (
+        f"The DevAdminAccess rotate role must be allowed PutSecretValue on "
+        f"cursor-bedrock/{OTHER_HANDLE}; got {decision}. Either "
+        f"AllowAdminRotate or the DenyNonOwnerDataAccess ArnNotLike "
+        f"carve-out regressed — `dh bedrock rotate` would break."
+    )

{dh_cli-0.8.7 → dh_cli-0.8.8}/tests/bedrock/test_key_command.py

@@ -138,6 +138,32 @@ def test_key_unrecognised_caller_arn_exits_with_hint():
     assert "awslogin" in result.output
 
 
+def test_key_no_current_version_gives_clear_error():
+    """A container with no AWSCURRENT version (a freshly-provisioned,
+    not-yet-rotated handle) must give a clear "no key yet — ask an admin to
+    run `dh bedrock rotate --handle <you>`" message, not a raw boto error.
+
+    The no-AWSCURRENT case surfaces as `get_secret_value` raising
+    ResourceNotFoundException for the version."""
+
+    class _ResourceNotFound(Exception):
+        pass
+
+    sm = MagicMock()
+    sm.exceptions.ResourceNotFoundException = _ResourceNotFound
+    sm.get_secret_value.side_effect = _ResourceNotFound(
+        "Secrets Manager can't find the specified secret value for staging label: AWSCURRENT"
+    )
+
+    p_sess, p_cli = _patch_boto3(sm=sm)
+    with p_sess, p_cli:
+        result = _invoke([])
+    assert result.exit_code != 0
+    out = result.output.lower()
+    assert "rotate" in out
+    assert "admin" in out
+
+
 def test_key_resolves_handle_from_dev_admin_access_session():
     """DevAdminAccess (and any other AWSReservedSSO_* role) must resolve
     to the session-name as the developer handle. Regression: earlier the

dh_cli-0.8.8/tests/bedrock/test_rotate.py

@@ -0,0 +1,284 @@
+"""Tests for `dh bedrock rotate` — the admin-run key minter.
+
+`rotate` is the one place `iam:CreateAccessKey` + `secretsmanager:PutSecretValue`
+are called for a per-developer Cursor Bedrock key. It runs as the *admin*
+(`dev-admin`), mints a fresh key for `dev-cursor-<handle>`, writes the
+`{access_key_id, secret_access_key, region}` JSON to `cursor-bedrock/<handle>`,
+and **then** deletes the prior key (delete-now).
+
+The tests lock in the security/correctness invariants:
+- `--handle` is required.
+- Non-admin callers fail fast BEFORE any AWS write.
+- Happy path is create → put → delete, in that order.
+- Works against an empty container (no AWSCURRENT) — onboarding seed.
+- A `PutSecretValue` failure rolls back the just-created key, never touching
+  any prior key.
+- The `secret_access_key` never appears in stdout/stderr on any path.
+- Preflight catches missing users and the 2-active-key IAM limit before
+  `CreateAccessKey`.
+- The new (non-secret) `access_key_id` is printed on success.
+"""
+
+from __future__ import annotations
+
+import json
+from unittest.mock import MagicMock, patch
+
+from click.testing import CliRunner
+
+_ADMIN_ARN = "arn:aws:sts::074735440724:assumed-role/AWSReservedSSO_DevAdminAccess_2506d659c73583cc/dma"
+_DEV_ARN = "arn:aws:sts::074735440724:assumed-role/AWSReservedSSO_DeveloperAccess_abcdef1234567890/dma"
+
+_NEW_AKID = "AKIANEWKEY0000000NEW"
+_OLD_AKID = "AKIAOLDKEY0000000OLD"
+# Distinctive sentinel — a substring match anywhere in output is a real leak.
+_SENTINEL_SECRET = "wSENTINEL/SecretAccessKey/0123456789ABCDEFROT"
+
+
+def _build_sts_stub(arn: str = _ADMIN_ARN) -> MagicMock:
+    sts = MagicMock()
+    sts.get_caller_identity.return_value = {"Arn": arn}
+    return sts
+
+
+def _build_session_stub(sts: MagicMock) -> MagicMock:
+    session = MagicMock()
+    session.client.return_value = sts
+    return session
+
+
+def _build_iam_stub(
+    *,
+    existing_key_ids: list[str] | None = None,
+    new_akid: str = _NEW_AKID,
+    new_secret: str = _SENTINEL_SECRET,
+    list_keys_error: Exception | None = None,
+) -> MagicMock:
+    iam = MagicMock()
+    if list_keys_error is not None:
+        iam.list_access_keys.side_effect = list_keys_error
+    else:
+        ids = existing_key_ids if existing_key_ids is not None else []
+        iam.list_access_keys.return_value = {
+            "AccessKeyMetadata": [{"AccessKeyId": k, "Status": "Active"} for k in ids]
+        }
+    iam.create_access_key.return_value = {
+        "AccessKey": {"AccessKeyId": new_akid, "SecretAccessKey": new_secret}
+    }
+    return iam
+
+
+def _build_sm_stub(*, put_error: Exception | None = None) -> MagicMock:
+    sm = MagicMock()
+    if put_error is not None:
+        sm.put_secret_value.side_effect = put_error
+    else:
+        sm.put_secret_value.return_value = {"VersionId": "v1"}
+    return sm
+
+
+def _patch_boto3(*, sts=None, iam=None, sm=None, parent=None):
+    sts_stub = sts or _build_sts_stub()
+    session_stub = _build_session_stub(sts_stub)
+    iam_stub = iam if iam is not None else _build_iam_stub()
+    sm_stub = sm if sm is not None else _build_sm_stub()
+
+    # Attach IAM + SM to a shared parent Mock so `parent.mock_calls` records
+    # cross-client call ORDER (create_access_key vs put_secret_value vs
+    # delete_access_key). This is the load-bearing invariant: a test that only
+    # checks "all three were called" would pass a buggy delete-before-put.
+    if parent is not None:
+        parent.attach_mock(iam_stub, "iam")
+        parent.attach_mock(sm_stub, "sm")
+
+    def _client(name, **_kwargs):
+        if name == "iam":
+            return iam_stub
+        if name == "secretsmanager":
+            return sm_stub
+        if name == "sts":
+            return sts_stub
+        raise AssertionError(f"unexpected boto3.client call: {name}")
+
+    return (
+        patch("boto3.Session", return_value=session_stub),
+        patch("boto3.client", side_effect=_client),
+    )
+
+
+def _invoke(args):
+    from dh_cli.bedrock.commands import bedrock
+
+    runner = CliRunner()
+    return runner.invoke(bedrock, ["rotate", *args], standalone_mode=True)
+
+
+def _all(result) -> str:
+    out = result.output or ""
+    try:
+        err = result.stderr or ""
+    except ValueError:
+        err = ""
+    return out + err
+
+
+def test_rotate_requires_handle():
+    """`--handle` is required — invoking with no handle exits non-zero."""
+    p_sess, p_cli = _patch_boto3()
+    with p_sess, p_cli:
+        result = _invoke([])
+    assert result.exit_code != 0
+
+
+def test_rotate_rejects_non_admin_caller():
+    """A DeveloperAccess caller is rejected before any AWS write, with a
+    message naming dev-admin."""
+    iam = _build_iam_stub()
+    sm = _build_sm_stub()
+    p_sess, p_cli = _patch_boto3(sts=_build_sts_stub(_DEV_ARN), iam=iam, sm=sm)
+    with p_sess, p_cli:
+        result = _invoke(["--handle", "dma"])
+    assert result.exit_code != 0
+    assert "dev-admin" in _all(result).lower()
+    iam.create_access_key.assert_not_called()
+    sm.put_secret_value.assert_not_called()
+    iam.delete_access_key.assert_not_called()
+
+
+def test_rotate_admin_caller_happy_path():
+    """Admin ARN → CreateAccessKey, PutSecretValue (JSON with the 3 fields),
+    then DeleteAccessKey on the prior key, in that order; exit 0."""
+    parent = MagicMock()
+    iam = _build_iam_stub(existing_key_ids=[_OLD_AKID])
+    sm = _build_sm_stub()
+    p_sess, p_cli = _patch_boto3(iam=iam, sm=sm, parent=parent)
+    with p_sess, p_cli:
+        result = _invoke(["--handle", "dma"])
+    assert result.exit_code == 0, _all(result)
+
+    iam.create_access_key.assert_called_once_with(UserName="dev-cursor-dma")
+
+    sm.put_secret_value.assert_called_once()
+    put_kwargs = sm.put_secret_value.call_args.kwargs
+    assert put_kwargs["SecretId"] == "cursor-bedrock/dma"
+    # A ClientRequestToken makes the put idempotent / collision-safe.
+    assert put_kwargs.get("ClientRequestToken")
+    payload = json.loads(put_kwargs["SecretString"])
+    assert payload["access_key_id"] == _NEW_AKID
+    assert payload["secret_access_key"] == _SENTINEL_SECRET
+    assert payload["region"] == "us-east-1"
+
+    iam.delete_access_key.assert_called_once_with(UserName="dev-cursor-dma", AccessKeyId=_OLD_AKID)
+
+    # Load-bearing ordering invariant: create BEFORE put BEFORE delete. Read
+    # the cross-client call order off the shared parent mock; a buggy
+    # delete-before-put (which would destroy the only live key before the new
+    # value is stored) must fail here, not pass on "all three called".
+    names = [name for name, _args, _kwargs in parent.mock_calls]
+    create_i = names.index("iam.create_access_key")
+    put_i = names.index("sm.put_secret_value")
+    delete_i = names.index("iam.delete_access_key")
+    assert create_i < put_i < delete_i
+
+
+def test_rotate_against_empty_container_seeds_first_version():
+    """Container with no prior key → create + put, no delete (no prior key),
+    exit 0. No --init flag needed."""
+    iam = _build_iam_stub(existing_key_ids=[])
+    sm = _build_sm_stub()
+    p_sess, p_cli = _patch_boto3(iam=iam, sm=sm)
+    with p_sess, p_cli:
+        result = _invoke(["--handle", "newbie"])
+    assert result.exit_code == 0, _all(result)
+    iam.create_access_key.assert_called_once_with(UserName="dev-cursor-newbie")
+    sm.put_secret_value.assert_called_once()
+    iam.delete_access_key.assert_not_called()
+
+
+def test_rotate_put_failure_rolls_back_new_key():
+    """PutSecretValue raises → DeleteAccessKey called on the just-created key
+    id, exit non-zero, and NO prior key is deleted."""
+    iam = _build_iam_stub(existing_key_ids=[_OLD_AKID])
+    sm = _build_sm_stub(put_error=RuntimeError("PutSecretValue boom"))
+    p_sess, p_cli = _patch_boto3(iam=iam, sm=sm)
+    with p_sess, p_cli:
+        result = _invoke(["--handle", "dma"])
+    assert result.exit_code != 0
+    iam.create_access_key.assert_called_once()
+    # The rollback deletes the NEW key, exactly once, and never the old one.
+    iam.delete_access_key.assert_called_once_with(UserName="dev-cursor-dma", AccessKeyId=_NEW_AKID)
+
+
+def test_rotate_create_access_key_not_retried_on_put_failure():
+    """CreateAccessKey returns the secret half exactly once and is
+    unrecoverable, so a Put failure must NOT trigger a retry of
+    CreateAccessKey (which would orphan a second key and burn the 2-key
+    limit)."""
+    iam = _build_iam_stub(existing_key_ids=[_OLD_AKID])
+    sm = _build_sm_stub(put_error=RuntimeError("PutSecretValue boom"))
+    p_sess, p_cli = _patch_boto3(iam=iam, sm=sm)
+    with p_sess, p_cli:
+        result = _invoke(["--handle", "dma"])
+    assert result.exit_code != 0
+    assert iam.create_access_key.call_count == 1
+
+
+def test_rotate_never_prints_secret_on_any_path():
+    """The sentinel secret must not appear in stdout/stderr on the happy
+    path OR a Put-failure path."""
+    # Happy path.
+    iam = _build_iam_stub(existing_key_ids=[_OLD_AKID])
+    sm = _build_sm_stub()
+    p_sess, p_cli = _patch_boto3(iam=iam, sm=sm)
+    with p_sess, p_cli:
+        result = _invoke(["--handle", "dma"])
+    assert result.exit_code == 0, _all(result)
+    assert _SENTINEL_SECRET not in _all(result)
+
+    # Put-failure path — the error message echoes the secret.
+    iam = _build_iam_stub(existing_key_ids=[_OLD_AKID])
+    sm = _build_sm_stub(put_error=RuntimeError(f"boom involving {_SENTINEL_SECRET}"))
+    p_sess, p_cli = _patch_boto3(iam=iam, sm=sm)
+    with p_sess, p_cli:
+        result = _invoke(["--handle", "dma"])
+    assert result.exit_code != 0
+    assert _SENTINEL_SECRET not in _all(result)
+
+
+def test_rotate_preflight_missing_user():
+    """list_access_keys raising NoSuchEntity → clear error BEFORE
+    CreateAccessKey."""
+    err = RuntimeError("NoSuchEntity: user dev-cursor-ghost not found")
+    iam = _build_iam_stub(list_keys_error=err)
+    sm = _build_sm_stub()
+    p_sess, p_cli = _patch_boto3(iam=iam, sm=sm)
+    with p_sess, p_cli:
+        result = _invoke(["--handle", "ghost"])
+    assert result.exit_code != 0
+    iam.create_access_key.assert_not_called()
+    sm.put_secret_value.assert_not_called()
+
+
+def test_rotate_preflight_two_active_keys():
+    """User already has 2 active keys → clear 'delete one first' error before
+    CreateAccessKey (avoids LimitExceeded mid-transaction)."""
+    iam = _build_iam_stub(existing_key_ids=["AKIAONE0000000000ONE", "AKIATWO0000000000TWO"])
+    sm = _build_sm_stub()
+    p_sess, p_cli = _patch_boto3(iam=iam, sm=sm)
+    with p_sess, p_cli:
+        result = _invoke(["--handle", "dma"])
+    assert result.exit_code != 0
+    iam.create_access_key.assert_not_called()
+    sm.put_secret_value.assert_not_called()
+
+
+def test_rotate_prints_new_access_key_id_on_success():
+    """The new access_key_id (AKIA…) appears in stdout; the secret does not."""
+    iam = _build_iam_stub(existing_key_ids=[_OLD_AKID])
+    sm = _build_sm_stub()
+    p_sess, p_cli = _patch_boto3(iam=iam, sm=sm)
+    with p_sess, p_cli:
+        result = _invoke(["--handle", "dma"])
+    assert result.exit_code == 0, _all(result)
+    assert _NEW_AKID in result.output
+    assert _SENTINEL_SECRET not in _all(result)