Repository navigation
Conversation
Declare SecretContentType api_key_v2 on the programmatic access token secret return, move the existing action tests onto typed AAD, and add handler-level proof: an actual SDK InvokeAction through a random-loopback Snowflake SQL API fixture and SDK JWE with exact payload bytes. Missing, opaque, generic, wrong-type, wrong-purpose and wrong-version AAD refuse before any provider SQL. Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com> Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…nowflake-declare-api-key-v2
The Snowflake PAT API_KEY arm encodes through secretcontracts.APIKeyV2, so the validated content type and bytes travel together. The declaration uses the exported type ID and the action fails if the issued plaintext does not carry it, rather than overwriting its schema. Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>
Generated by go mod vendor from the previous commit. Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Squire (anthropic/claude-sonnet-5-5): The Snowflake programmatic access token action now declares
api_key_v2on its secret return, with handler-level proof that the declaration gates issuance.Parent: #163 (
highb/snowflake-sdk-typed-secret-contract@0abc372c4bd51bc5134ca9ff46456b7c8db4d6ae), which itself stacks on #160 (e60de151cc81a3a5be05ee5d996d179b92c9130c). Review and merge order: #160, #163, this PR. Retarget to the parent's successor as each lands.Dependency:
baton-sdk v0.42.4-0.20261023162145-b4c6a5b06b11(commitb4c6a5b06b118bf6b74cf10a5dc5a3597e83138bof baton-sdk#1192), carried by #163. Unreleased; noreplace.What changes (one commit, 3 files under
pkg/connector)SecretContentType: "api_key_v2"on the secret return ofissue_programmatic_access_token. Native TOKEN payload, header name, role and scope handling, and revocation are unchanged.purpose=c1/fk-credential-delivery,version=1,content_type=api_key_v2), and the schema/gate test asserts the declaration.TestSnowflakeDeclaredSecretProof: actual connector registration,ListActionSchemas,InvokeActionand SDK JWE against a random-loopbackhttptestSnowflake SQL API fixture. Missing, opaque, generic, wrong-type, wrong-purpose and wrong-version AAD each fail with zero provider statements; a valid request issues exactly oneADD PROGRAMMATIC ACCESS TOKENand noREMOVE, and the decrypted bytes equal the expected canonical JSON.CONNECTOR_SECRET_PROOF_INPUTand writeCONNECTOR_SECRET_PROOF_RESULTfiles so C1 can feed its prepared request through the real handler. This is a test port only, not a shipping interface.Verification (local, commit
1a5a1f7a)go build ./...exit 0;go test -count=1 ./...exit 0, no skips.golangci-lintv2.14.0 (CI's pin): 0 issues. Two//nolint:gosecannotations cover the test-only file ports whose paths come from the harness environment.api_key(compiles) makesTestSnowflakeDeclaredSecretProofand the schema/gate test fail on their named assertions; restoring the source gives an identical sha256 and the tests pass again.Limits: no live Snowflake calls; the HTTP fixture is not a real provider. These tests do not prove the C1 to Multipass path.
Supersession: replaces the typed-declaration portion of #162, which stays untouched until a decision is made on it.
🤖 Generated with Claude Code