fix: warn on key-id mismatch in list; pin envelope_crypto v1.1.0, mongo v1.1.0

envelope_crypto 1.1.0 raises KeyMismatchError (a ValueError) instead of
InvalidTag for a flag sealed under another key, which fell into the silent
ValueError arm of _can_authorize and dropped the D5 warning. catch it first
and warn naming both key ids. the mongo extra pin moves to the current
release so it co-installs with consumers on mongo v1.1.0.

Signed-off-by: disqualifier <dev@disqualifier.me>

pyproject.toml

@@ -8,14 +8,14 @@ version = "1.1.0"
 description = "CLI key-authorization manager for envelope_crypto"
 requires-python = ">=3.10"
 dependencies = [
-    "envelope_crypto @ git+https://git.rethinkstudios.io/rethink-public/envelope_crypto.git@v1.0.0",
+    "envelope_crypto @ git+https://git.rethinkstudios.io/rethink-public/envelope_crypto.git@v1.1.0",
     "cryptography>=42.0",
     "tomli>=2.0; python_version<'3.11'",
 ]
 
 [project.optional-dependencies]
 mongo = [
-    "mongo @ git+https://git.rethinkstudios.io/rethink-public/mongo.git@v1.0.0",
+    "mongo @ git+https://git.rethinkstudios.io/rethink-public/mongo.git@v1.1.0",
 ]
 
 [project.scripts]

src/envelope_authorizer/commands/list_keys.py

@@ -9,6 +9,7 @@ import logging
 from datetime import datetime, timezone
 
 from cryptography.exceptions import InvalidTag
+from envelope_crypto import KeyMismatchError
 
 from . import boot_local, doc_meta, read_flag
 
@@ -18,13 +19,20 @@ log = logging.getLogger(__name__)
 def _can_authorize(crypto, doc) -> str:
     """decrypted authority of a doc as Yes/No, or `?` if unreadable here
 
-    a malformed/foreign flag degrades to `?` for display continuity. a GCM auth-tag
+    a malformed flag degrades to `?` silently. a flag that can't be read here is
-    failure is logged first (WARNING): it is either a foreign key this host can't
+    logged first (WARNING) so the security signal stays visible rather than render
-    decrypt or a tampered authz record, and this layer can't tell them apart, so the
+    identically to a `?`: a kid mismatch means it was sealed under another key; a GCM
-    security signal must stay visible rather than render identically to a `?`.
+    auth-tag failure (no kid, pre-1.1.0 flag) is a foreign key or a tampered record
+    and this layer can't tell them apart.
     """
     try:
         return "Yes" if read_flag(crypto, doc["meta"]["authorizer"]) else "No"
+    except KeyMismatchError as error:
+        friendly = doc_meta(doc).get("friendly", doc.get("_id", "?"))
+        log.warning(
+            "flag %s sealed under another key (key id %s, loaded %s)", friendly, error.blob_kid, error.key_kid,
+        )
+        return "?"
     except (KeyError, TypeError, ValueError):
         return "?"
     except InvalidTag: