magus v0.4.3 is out. See what's new
¶ View markdown source · ✎ Suggest an edit
1 min read

credential-verb

A deny rule by default: it refuses an agent minting, printing, rotating or revoking a credential through the CLI, and names what to run instead.

What it catches

An agent minting, printing, rotating or revoking a credential through the CLI.

Why

An agent holds the token it was given, and a session that mints another holds a grant nobody handed it. Refused: the console and connector token create and revoke commands, magus graph export --open --follow (its link carries a sign-in code), and magus config token print, generate and revoke, the operator token that reaches token management. It holds however the binary is spelled: ./magus, a path, go run ./cmd/magus, or inside a $(...) substitution. This is a seatbelt for a harness that opted in, not a boundary: a process running as the user can reach the same files.

Default and override

By default this rule takes the decision deny. A workspace sets it by name, in its root magusfile, to deny, advise or off:

magus\guard.builtins({"credential-verb": "advise"})

A loosening takes effect once it is committed; a tightening applies at once.

Seeing it

A verdict names its rule in brackets, which is how you got here:

deny [credential-verb]: ...

magus describe rule credential-verb prints the same entry at a terminal, and magus describe rules lists every rule this workspace enforces.

See also

ReferencePages in this section. magus moduleMagus core primitives. MGS1028: a changed file seeds a project it does not keyA changed file no project declares still pulls its containing project into the affected set. The targets it reruns could not have produced a different answer, and the file that would change the answer is the same one nothing is watching. magus runRun a named target (build, test, lint, format, ci, etc.) for the selected projects, defaulting to the cwd project when no arguments are given.
guardrulescredential-verbdeny
Last updated (1a76274f)
Earlier changes on this page (1)

Full history ↗ · Blame source ↗

Glossary

Workspace

The magus root directory that owns a set of projects and shared config; the unit magus operates over. See workspace.

Magusfile

The magusfile.buzz that declares a project's targets (as export funs) and binds its spells. See targets.

Op

A single tool-native command a target composes (long form: operation); the middle of the work hierarchy (Spell to Op to Target). See operations.

Spell

A language/runtime adapter (e.g. go, md) that maps generic targets onto a toolchain's real commands. See spells.

Buzz

The language magusfiles are written in (the .buzz engine). See engines.

CI

An ordinary magusfile-defined target you compose yourself with magus\needs: magus does not hardcode its stages. Magus.RunCI treats it specially only in that it strips the rw charm, it is the anchor magus affected ci keys off, and a selected scope with no project declaring it is a load error rather than a silent no-op. See targets.

Session

An agent host's conversation, by the id the host delivers to its hooks. magus never mints one: a record with no session is unattributed, and the OS user it carries says whose account ran it.

Run

One target executing under one magus invocation, such as magus run test web or magus affected ci. A run keeps its captured output behind an output reference. Every magus run is a run whether or not any job asked for it; see Job for how the two relate.

Conventions

This page uses none of the site's convention markers. The full set is on the conventions page.