fix: EA-1 refuse authorize of an already-recorded key (v0.1.3)

authorize never checked the target fingerprint against existing docs before
save()'s upsert-by-_id, so authorizing the local machine's own public key
under a new friendly name silently replaced the local authorizer record
(can_authorize demoted to False) while printing a success banner. With a
sole authorizer this bricks the CLI: authorize refuses (not permitted),
init refuses (already initialized), and revoke of the local key refuses
(refusing to revoke the local key) -- no in-CLI recovery. Mirror revoke's
local-key guard and extend it to any existing _id, so a duplicate target
is refused with a clear message instead of silently replacing the record.

Signed-off-by: disqualifier <dev@disqualifier.me>

This commit is contained in:

dsql

2026-07-02 16:41:09 -04:00

parent f2e9e5fe35

commit bfeee80712

4 changed files with 34 additions and 11 deletions

									
										pyproject.toml
									
		+1
		-1
	
												View File
												
				@@ -4,7 +4,7 @@ build-backend = "hatchling.build"

				[project]

				name = "envelope_authorizer"

				version = "0.1.2"

				version = "0.1.3"

				description = "CLI key-authorization manager for envelope_crypto"

				requires-python = ">=3.10"

				dependencies = [