Repository navigation
90-day key rotation policy: due keys wait for approval, auto-approve is the paid add-on (CLI 0.16.0) - #270
Merged
Conversation
…0.16.0) Every automatic secret older than the team's max age (90 days default) is queued as one run in awaiting-approval. An owner/admin approves it on the Rotation page or with `teams rotation-approve`; machine keys can queue but never approve. logicsrc-rotate --queue (*/5 cron) runs approved runs with propagate + health checks + rollback. rotation_auto_approve per team is the paid automatic rotation add-on (off by default). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| const maxAge = maxAgeDays(team); | ||
| const due = (await rotationPlan(team.id, { maxAge, now, vaultFilter })).filter((p) => p.due); | ||
| const open = (await all( | ||
| `SELECT * FROM credshare_rotation_runs WHERE team_id = ? AND status IN (${OPEN_RUN_STATUSES.map(() => "?").join(",")}) ORDER BY created_at DESC`, |
ThreatCrush Security Scan67 finding(s) HIGH/CRITICAL: 6 | MEDIUM: 29 | LOW: 32
…and 17 more. Full results in the Security tab. Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Anthony (2026-10-29): logicsrc should rotate keys every 90 days by default, with our approval, fast (about 10 minutes), and automatic rotation as a paid add-on for premium users.
Builds on #265 (rotators, propagate) and #269 (run queue).
What changes
credshare_teams.rotation_max_age_daysoverrides it). The plan rows now carryageDaysanddue.neverand manual keys are never due.POST /api/credshare/teams/:slug/rotation/due(owner/admin or a machine key),logicsrc teams rotate-keys <team> --queue-due, or the "Queue the due keys now" button. Every due key, oldest first, at most 200, goes into ONE run inawaiting-approval. While it is open the call is idempotent.POST .../rotation/runs/:id/approve,logicsrc teams rotation-approve <team> <run-id>, or the Approve button on the Rotation page. Owner/admin only, a person (machine keys get 403). The approver is recorded (approved_by/approved_at) and audited. Decline = cancel.logicsrc-rotate --queue(meant for a */5 cron) runs approved runs with--from-queue --propagate --approve(3 sites at a time, health checks, rollback) and mails the outcome. The weekly run queues the due run first and the mail links to the approve page. Low memory skips a tick.credshare_teams.rotation_auto_approve = 1queues due runs already approved. Off for every team. No self-serve toggle or billing yet.011_rotation_policy.sql(sqlite + pg), additive only.Tests
No live rotation was run.
🤖 Generated with Claude Code