Skip to content

Keyblind v0.9.2 — Enterprise roadmap complete (Phases 2–4)

Latest
Latest

Choose a tag to compare

View all tags
@aarifmms aarifmms released this 26 Oct 02:35
· 12 commits to main since this release
v0.9.2
bf90ecf

What's new in v0.9.2

The enterprise roadmap is now complete: Phases 2 (identity + RBAC), 3 (provider-native rotation), and 4 (compliance + support) all ship here, building on the Phase 1 control plane from v0.9.1.

Phase 2 — Identity & RBAC

Real identity replaces shared-passphrase team vaults:

  • RBAC core — a hosted control plane (Turso/libSQL) with orgs, members (owner/admin/member), groups, and group→scope grants. The service signs a value-free manifest (deny list + group-derived scopes) with the org Ed25519 key; local vaults enforce it on control-plane sync.
  • SSO + short-lived credentials — multi-provider OIDC SSO (discovery, PKCE S256, nonce, id_token verification), plus nonce/expiry-bound self-signed requests and org-issued keyblind-agent-token-v1 tokens.
  • Multi-org + provisioning + logout — active-org switcher, SSO auto-provisioning by slug, and IdP end-session via back-channel logout + refresh-token revocation.

Phase 3 — Provider-native rotation

Rotate a cloud credential and its vault value in one command, with a rollback window and audit trail:

keyblind rotate <name> --provider aws --iam-user <user>   # or gcp | azure
keyblind rotate --provider aws --overdue 90               # batch overdue
keyblind rotate --finalize                                # revoke past rollback window
keyblind rotate --pending                                 # status

Adapters: AWS IAM access keys, GCP service-account keys, Azure app client secrets. All three were live-validated against real cloud accounts, which surfaced two propagation bugs (fresh AWS keys and Azure client secrets take ~9–10s to become usable) — verify now retries with backoff.

Phase 4 — Compliance & support

SOC 2 / ISO 27001 narrative (docs/compliance.md), key-escrow/recovery policy (docs/key-escrow.md), and an enterprise license tier with a support SLA (docs/support-sla.md).

Fixes

  • AWS rotation verify dropped an empty AWS_PROFILE that broke STS calls.
  • Azure rotation verify retries through the client-secret propagation window.
  • SSO callback provider lookup and 401 handling on unauthenticated org routes.

Result

  • 234 tests passing (1 platform-skipped).
  • Signed npm provenance via staged publishing.

Full docs: https://github.com/aarifmms/keyblind

Assets 2
Loading