saphan identity
Manages the signed identity store: the signed record of actors (people and their keys), OAuth client bindings, token issuers and name aliases.
Manages the signed identity store: the signed record of actors (people and their keys), OAuth client bindings, token issuers and name aliases. Every change is a new signed row, never an edit or a delete, and the readable roster files (ACTORS.md, BINDINGS.md, ISSUERS.md) are generated from the store as an audit mirror. Changes are the owner's acts and run on the machine that holds the root key, or an identity-signing delegate the root granted.
saphan identity enroll
Adds one actor, binding, issuer or alias to the store as a new signed record, then regenerates the roster files. Unlike the other changes here, it asks for no one-time terminal code. A binding must name the streams its tokens may read (--stream '*' for all); there is no default. An alias only records that an old spelling of an actor's name means the same person as a current registry name; it grants nothing and can never be used to sign or approve.
| flag | type | default | what it does |
|---|---|---|---|
--actor | string | For a binding: the actor the OAuth client is bound to; required with --kind binding. | |
--added-by | string | root | Who is enrolling the record, kept as provenance; defaults to root. |
--alg | string | For an issuer: the token signing algorithm; required with --kind issuer. | |
--audience | string | For an issuer: the audience tokens must carry; required with --kind issuer. | |
--canonical | string | For an alias: the current registry name the old spelling resolves to; required with --kind alias. | |
--jwks-uri | string | For an issuer: the URL of the issuer's public signing keys; required with --kind issuer. | |
--key-id | string | For an actor: the actor's key identifier; required with --kind actor. | |
--kind | string | What to enroll: actor, binding, issuer or alias; required. | |
--reason | string | For an actor or alias: an optional note explaining the enrolment. | |
--redirect-uri | stringSlice | For a binding: an allowed OAuth redirect URI; repeatable, and at least one is required. | |
--root-key | string | Path of the root private key; defaults to ~/.saphan/trust/root.key. If you leave it out and an identity-signing delegate that the root granted is installed beside the default root key (identity-delegate.key), the delegate signs instead, and a delegate key there with no grant covering it is refused; a key you name always signs. | |
--stream | stringSlice | For a binding: a stream the client's tokens may read, or * for all streams; repeatable and required, because tokens see exactly the streams named here and nothing else. | |
--subject | string | The record's subject: the actor name, the OAuth client ID, the issuer URL, or the old spelling for an alias; required. |
saphan identity export
Regenerates the roster files from the signed identity store; an empty store is refused rather than overwriting the files with nothing. With --machine-roster it instead writes the signed machine roster file that another workspace reads with identity import-machines; that signs the list, so it needs the root key or a granted identity-signing delegate on this machine and is refused without one.
| flag | type | default | what it does |
|---|---|---|---|
--machine-roster | string | Writes the signed machine roster to this path, for another workspace to import, instead of regenerating the roster files. |
saphan identity import
Seeds an empty identity store from the roster files, writing one root-signed record per row in a single all-or-nothing step, then regenerates the files from the store. It runs once: a store that already holds records, or a roster with no actors, is refused. ⚠ This is an owner act: it prints a one-time code on this terminal and waits for you to type it back. It is refused when no terminal is attached (for example from a script or a CI job), and in the console's browser terminal it is refused in favour of the console's passkey prompt.
| flag | type | default | what it does |
|---|---|---|---|
--root-key | string | Path of the root private key; defaults to ~/.saphan/trust/root.key. |
saphan identity import-machines
Reads a signed machine roster exported from another workspace, verifies the whole list and each row against this workspace's root key, and appends the rows that pass. It needs no private key and cannot create a machine on its own. Without --admit, it updates machines already held and re-applies the admissions the owner already made on this host, narrowed to what the roster carries; any other new machine is refused, and the command prints the line that would admit it. A roster that was altered, unsigned, or older than this store is refused as a whole, and a partial import exits with status 2.
| flag | type | default | what it does |
|---|---|---|---|
--admit | stringArray | Consents to adding one machine this workspace has never held, as machine:<id> or machine_identity:<id>; repeatable. Names given here replace, and are not merged with, the admissions already made on this host. ⚠ This is an owner act: it prints a one-time code on this terminal and waits for you to type it back. It is refused when no terminal is attached (for example from a script or a CI job), and in the console's browser terminal it is refused in favour of the console's passkey prompt. | |
--from | string | Path of the signed machine roster file to read; required. |
saphan identity revoke
Revokes an actor, binding, issuer, alias or delegation by appending a new root-signed revoke record; the history stays. A revoked actor reads as retired, while a revoked binding or issuer reads as absent. Refuses if the subject has no live record. ⚠ This is an owner act: it prints a one-time code on this terminal and waits for you to type it back. It is refused when no terminal is attached (for example from a script or a CI job), and in the console's browser terminal it is refused in favour of the console's passkey prompt.
| flag | type | default | what it does |
|---|---|---|---|
--added-by | string | root | Who is revoking the record, kept as provenance; defaults to root. |
--kind | string | What to revoke: actor, binding, issuer, alias or delegation; required. | |
--root-key | string | Path of the root private key; defaults to ~/.saphan/trust/root.key. If you leave it out and an identity-signing delegate that the root granted is installed beside the default root key (identity-delegate.key), the delegate signs instead, and a delegate key there with no grant covering it is refused; a key you name always signs. | |
--subject | string | The record to revoke: the actor name, client ID, issuer URL, alias spelling, or a delegation's key ID; required. |
Global options apply to every command — see Every command.