From 8ec402b80a7b1f80825cdba09cde08fc79cc62ae Mon Sep 17 00:00:00 2001 From: Tim Schindler Date: Mon, 17 Aug 2026 07:58:01 +0200 Subject: [PATCH 1/2] docs: prepare CHANGELOG for v0.10.0 release --- CHANGELOG.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 998a66c..04ed64b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,8 @@ All notable changes to this project will be documented in this file. ## [Unreleased] +## [0.10.0] - 2026-08-17 + ### Changed - An invalid `cache_ttl` (unparseable, zero or negative) now fails the command instead of silently defaulting; the error names the config file, the expected duration syntax and `--refresh` From a78cc64659640e3b5455b62dafe6bbd393cb8f9c Mon Sep 17 00:00:00 2001 From: Tim Schindler Date: Sun, 23 Aug 2026 19:30:14 +0200 Subject: [PATCH 2/2] docs: record measured AWS vs Azure session revocation behaviour --- CLAUDE.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/CLAUDE.md b/CLAUDE.md index cd75563..a96f3c1 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -48,6 +48,8 @@ Custom `SCAAccessService` follows SDK conventions: - **Exit policy (deliberate, not blanket "fail closed"):** exit 0 when every requested session was accepted, which *includes* `in_progress` — a documented async success state, so failing on it would make legitimate revocations look broken. Exit 1 on `not_applicable`, unrecognized statuses and missing rows. So exit 0 does not prove access is gone; only that nothing was refused or unaccounted for. State it that precisely in docs — `ClassifyRevocationStatus` fails closed, the *command* does not fail on in-progress - `outcome` (`revoked`/`in_progress`/`not_applicable`/`unknown`) is the single classification field in the JSON. Do not add derived booleans (`accepted`, `complete`, `revoked`) beside it: two representations of one concept drift apart and disagree. Callers switch on `outcome` - Never attribute a cause for `REVOCATION_NOT_APPLICABLE` (e.g. an AWS/STS story). Observing the status does not prove the reason, and grant supports Azure/AWS/GCP plus group sessions. Render provider-neutral text and keep the raw token + - **Observed live (2026-08-18, one tenant):** AWS sessions return `REVOCATION_NOT_APPLICABLE` and stay active — `sts:GetCallerIdentity` still succeeds after the revoke. Azure roles and Entra groups return `REVOCATION_IN_PROGRESS` and disappear within ~25s. Cause: AWS exposes no session-scoped revocation primitive (STS tokens cannot be invalidated, and `aws:TokenIssueTime` deny / permission removal are role-scoped, so they would hit every concurrent session on that role). Azure/Entra elevations are role assignments, which are individually removable. **So `grant revoke` cannot contain leaked AWS credentials** — use the IAM console's Revoke sessions, or wait out expiry + - The provider-neutral rule above still stands for *user-facing text*: this note records what was measured, it is not licence to print an AWS story at runtime - `GET /api/access/{CSP}/eligibility/groups` — list eligible Entra ID groups (response: `groupId`/`groupName`/`directoryId`) - `POST /api/access/elevate/groups` — request group membership elevation (response wrapped in `response` key, same as cloud elevation) - **Headers:** `Authorization: Bearer {jwt}`, `X-API-Version: 2.0`, `Content-Type: application/json`