Fix OpenBao route pattern used to sign/verify with a given OpenBao entity

Author: touilleMan

libparsec/crates/openbao/src/lib.rs

@@ -88,7 +88,7 @@ impl OpenBaoCmds {
     }
 
     /// This signing system relies on the fact OpenBao is configured to only
-    /// allow POST `/transit/sign/user-{entity_id}` (i.e. the signing API) to
+    /// allow POST `/transit/sign/entity-{entity_id}` (i.e. the signing API) to
     /// the user referenced in OpenBao by this entity ID.
     ///
     /// This way the verify operation knows the entity ID of the author, and can

libparsec/crates/openbao/src/sign.rs

@@ -13,7 +13,7 @@ enum SignOutcome {
 }
 
 fn generate_sign_key_name(openbao_entity_id: &str) -> String {
-    format!("user-{}", openbao_entity_id)
+    format!("entity-{}", openbao_entity_id)
 }
 
 pub async fn sign(cmds: &OpenBaoCmds, payload: &[u8]) -> Result<String, OpenBaoSignError> {

server/parsec/cli/testbed.py

@@ -530,7 +530,7 @@ async def test_openbao_create_key(request: Request, key_name: str):
     if not entity_id:
         return Response(status_code=403)
 
-    if key_name != f"user-{entity_id}":
+    if key_name != f"entity-{entity_id}":
         return Response(status_code=403)
 
     # See https://openbao.org/api-docs/secret/transit/#create-key
@@ -592,7 +592,7 @@ async def test_openbao_sign(request: Request, key_name: str):
     if not entity_id:
         return Response(status_code=403)
 
-    if key_name != f"user-{entity_id}":
+    if key_name != f"entity-{entity_id}":
         return Response(status_code=403)
 
     # See https://openbao.org/api-docs/secret/transit/#sign-data
@@ -640,7 +640,7 @@ async def test_openbao_verify(request: Request, key_name: str):
     if not entity_id:
         return Response(status_code=403)
 
-    author_entity_id = key_name.removeprefix("user-")
+    author_entity_id = key_name.removeprefix("entity-")
 
     # See https://openbao.org/api-docs/secret/transit/#verify-signed-data