magus v0.4.2 is out. See what's new
¶ View markdown source · ✎ Suggest an edit
2 min read

MGS1027: a secret grant is malformed

A grant was declared but cannot be used:

magus\secret.endpoint: secret grant "op://vault/openai/key": host "*.openai.com" contains
a wildcard; declare one grant per destination

Why this is refused rather than repaired

A grant is the single declaration that decides where a credential is forwarded. The loopback endpoint sends to the host it names and nowhere else, so a declaration magus cannot read exactly is one it cannot honor.

So a grant magus cannot interpret exactly is not a grant it can enforce approximately. Guessing at one of these would either widen the scope silently or narrow it to nothing, and both failures are invisible at the point they matter:

  • A grant that is too wide sends a live credential somewhere you did not name.
  • A grant that matches nothing sends every request unauthenticated, forever, and surfaces as an unexplained 401 from the far end with nothing pointing back at the declaration.

The second is the reason this fires eagerly, at declaration, rather than at the first request.

What triggers it

Cause Example Fix
Missing ref, host, or header SecretGrant{ host = "api.example.com" } Supply all three.
A wildcard host host = "*.example.com" Declare one grant per destination. A pattern reads as convenience until a subdomain someone else controls satisfies it.
A URL or userinfo instead of a host host = "https://api.example.com/v1" Use a bare host[:port].
A non-ASCII host host = "exämple.com" Punycode it yourself. magus will not guess an encoding for the one field that decides where a credential may go - case folding a non-ASCII host lets a lookalike name satisfy the grant.
An illegal header name header = "X Api Key" Use a valid HTTP field name. Left to the transport, this fails at request time, far from the line that declared it.
Whitespace or a newline in a field host = " api.example.com" Remove it. Leading space used to validate and then match nothing.
A non-str field value host = 42 Buzz does not type-check object field literals, so this compiles; the grant is where it is caught.

Resolution

Fix the declaration the message names. The error carries the reference and the offending value, so it points at one line:

object SecretGrant {
    ref: str = "",
    host: str = "",
    header: str = "",
    prefix: str = "",
}

final OPENAI = SecretGrant{
    ref    = "op://vault/openai/key",
    host   = "api.openai.com",
    header = "Authorization",
    prefix = "Bearer ",
};

See also

  • Secrets - grants, endpoints, and what they do and do not protect against
  • MGS1026 - a cacheable target reaches for a credential, grants included
  • MGS2011 - a secret too short to mask
MGS1027magusfilesecretscredentialsgrantendpointinjection
Last updated (6b3c7db4)
Glossary

Magusfile

The magusfile.buzz that declares a project's targets (as export funs) and binds its spells. See targets.

Target

A named operation (build, test, ...) you invoke with magus run <target>; it may compose a spell's tool-native operations and depend on other targets. See targets.

Op

A single tool-native command a target composes (long form: operation); the middle of the work hierarchy (Spell to Op to Target). See operations.

Ward

A coded diagnostic that inspects a resolved op and nudges or blocks an anti-pattern before it runs. See wards.

Buzz

The language magusfiles are written in (the .buzz engine). See engines.

Cache

The content-addressed store magus consults before running a target, so unchanged work is skipped. See cache.

Sandbox

The restricted filesystem and environment a target runs in, so builds stay reproducible and side-effect-free. See sandbox.

CI

An ordinary magusfile-defined target you compose yourself with magus\needs - magus does not hardcode its stages. Magus.RunCI treats it specially only in that it strips the rw charm, it is the anchor magus affected ci keys off, and a selected scope with no project declaring it is a load error rather than a silent no-op. See targets.

Conventions

This page uses none of the site's convention markers. The full set is on the conventions page.