Add agentvault seed-oauth for oauth2-proxy credentials #9

2026-08-30T15:31:45+10:00

unkin-agent commented

2026-08-30 15:31:45 +10:00

Why

Seeding an oauth2-proxy secret by hand means an interactive agent plumbing a client secret and a cookie secret through a shell, which the credential classifier blocks. agentvault seed-oauth is a sibling of seed-outpost that does the whole thing in one self-contained invocation: it reads the KV path itself, fills in only what is missing, and prints key names and the new KV version — never a value.

How

SeedOAuth in internal/agent is a read-modify-write over the KV-v2 path: client_id comes from the flag, client_secret and cookie_secret are generated only when absent (or with --rotate), and every other key on the path is written back untouched.
Secrets are 32 bytes of crypto/rand; cookie_secret is base64url so it decodes to exactly the 32 bytes oauth2-proxy requires.
Nothing is written when nothing changed — the command reports version: unchanged instead of cutting a pointless KV version.
The KV client gains ReadKVOptional (a missing secret is empty, not an error, so a first seed works) and WriteKVAny (non-string fields survive the round trip).
Errors are distinguished per stage — AppRole login, read denied, write denied — and tests cover fresh create, the patch case where an existing client_secret is kept, other-key preservation, --rotate, idempotence, denials, and that no output or error carries secret material.

## Why Seeding an oauth2-proxy secret by hand means an interactive agent plumbing a client secret and a cookie secret through a shell, which the credential classifier blocks. `agentvault seed-oauth` is a sibling of `seed-outpost` that does the whole thing in one self-contained invocation: it reads the KV path itself, fills in only what is missing, and prints key names and the new KV version — never a value. ## How - `SeedOAuth` in `internal/agent` is a read-modify-write over the KV-v2 path: `client_id` comes from the flag, `client_secret` and `cookie_secret` are generated only when absent (or with `--rotate`), and every other key on the path is written back untouched. - Secrets are 32 bytes of `crypto/rand`; `cookie_secret` is base64url so it decodes to exactly the 32 bytes oauth2-proxy requires. - Nothing is written when nothing changed — the command reports `version: unchanged` instead of cutting a pointless KV version. - The KV client gains `ReadKVOptional` (a missing secret is empty, not an error, so a first seed works) and `WriteKVAny` (non-string fields survive the round trip). - Errors are distinguished per stage — AppRole login, read denied, write denied — and tests cover fresh create, the patch case where an existing `client_secret` is kept, other-key preservation, `--rotate`, idempotence, denials, and that no output or error carries secret material.

unkin-agent added 1 commit 2026-08-30 15:31:45 +10:00

Add agentvault seed-oauth for oauth2-proxy credentials

ci/woodpecker/pr/build Pipeline was successful

Details

ci/woodpecker/pr/test Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

155392a809

Seeding an oauth2-proxy secret by hand means an agent shell-plumbing a
client secret and a cookie secret, which the classifier blocks. seed-oauth
does it in one self-contained invocation: it reads the KV path, fills in
only the keys that are missing, preserves everything else and prints key
names and the new version, never a value.

- Add SeedOAuth in internal/agent: read-modify-write of the client_id,
  client_secret and cookie_secret keys with per-key created/kept/rotated
  actions and a no-op when nothing changed.
- Generate secrets from 32 crypto/rand bytes; cookie_secret is base64url so
  it decodes to exactly the 32 bytes oauth2-proxy requires.
- Add ReadKVOptional (missing secret = empty) and WriteKVAny (non-string
  fields survive a round trip) to the KV-v2 client.
- Wire the seed-oauth subcommand and document it in README and AGENTS.md.
- Cover fresh create, patch-preserves-client_secret, other-key
  preservation, --rotate, idempotence, denial errors and secret leakage.

benvin merged commit d9645ec5e4 into main

2026-08-30 15:41:13 +10:00

benvin deleted branch benvin/agentvault-seed-oauth

2026-08-30 15:41:14 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/agent-tools#9