release: 1.2.0

Signed-off-by: disqualifier <dev@disqualifier.me>

README.md

@@ -13,26 +13,26 @@ authorization system and the key-document schema; the crypto primitives live in
 ## Install
 
 ```
-envelope_authorizer @ git+ssh://git@git.rethinkstudios.io/rethink-public/envelope_authorizer.git@v1.0.1
+envelope_authorizer @ git+ssh://git@git.rethinkstudios.io/rethink-public/envelope_authorizer.git@v1.2.0
 ```
 
 Direct:
 
 ```bash
-pip install "envelope_authorizer @ git+ssh://git@git.rethinkstudios.io/rethink-public/envelope_authorizer.git@v1.0.1"
+pip install "envelope_authorizer @ git+ssh://git@git.rethinkstudios.io/rethink-public/envelope_authorizer.git@v1.2.0"
 ```
 
 The base install uses a local JSON file for storage (stdlib only). For shared
 dev→server storage, install the mongo extra:
 
 ```bash
-pip install "envelope_authorizer[mongo] @ git+ssh://git@git.rethinkstudios.io/rethink-public/envelope_authorizer.git@v1.0.1"
+pip install "envelope_authorizer[mongo] @ git+ssh://git@git.rethinkstudios.io/rethink-public/envelope_authorizer.git@v1.2.0"
 ```
 
 Installing pulls `envelope_crypto` (and `mongo` with the extra). After install,
 the `authorizer` command is on your PATH; `python -m envelope_authorizer` also works.
 
-Drop the `@v1.0.1` suffix from the line above to install the latest unpinned.
+Drop the `@v1.2.0` suffix from the line above to install the latest unpinned.
 
 ## Trust model (read this)
 

pyproject.toml

@@ -4,18 +4,18 @@ build-backend = "hatchling.build"
 
 [project]
 name = "envelope_authorizer"
-version = "1.0.1"
+version = "1.2.0"
 description = "CLI key-authorization manager for envelope_crypto"
 requires-python = ">=3.10"
 dependencies = [
-    "envelope_crypto @ git+ssh://git@git.rethinkstudios.io/rethink-public/envelope_crypto.git@v1.0.0",
+    "envelope_crypto @ git+https://git.rethinkstudios.io/rethink-public/envelope_crypto.git@v1.1.0",
     "cryptography>=42.0",
     "tomli>=2.0; python_version<'3.11'",
 ]
 
 [project.optional-dependencies]
 mongo = [
-    "mongo @ git+ssh://git@git.rethinkstudios.io/rethink-public/mongo.git@v1.0.0",
+    "mongo @ git+https://git.rethinkstudios.io/rethink-public/mongo.git@v1.1.0",
 ]
 
 [project.scripts]

src/envelope_authorizer/commands/list_keys.py

@@ -5,16 +5,39 @@ CAN_AUTHORIZE (`?` if unreadable here). prints only fingerprint/metadata - never
 the wrapped key or DEK.
 """
 
+import logging
 from datetime import datetime, timezone
 
+from cryptography.exceptions import InvalidTag
+from envelope_crypto import KeyMismatchError
+
 from . import boot_local, doc_meta, read_flag
 
+log = logging.getLogger(__name__)
+
 
 def _can_authorize(crypto, doc) -> str:
-    """decrypted authority of a doc as Yes/No, or `?` if unreadable here"""
+    """decrypted authority of a doc as Yes/No, or `?` if unreadable here
+
+    a malformed flag degrades to `?` silently. a flag that can't be read here is
+    logged first (WARNING) so the security signal stays visible rather than render
+    identically to a `?`: a kid mismatch means it was sealed under another key; a GCM
+    auth-tag failure (no kid, pre-1.1.0 flag) is a foreign key or a tampered record
+    and this layer can't tell them apart.
+    """
     try:
         return "Yes" if read_flag(crypto, doc["meta"]["authorizer"]) else "No"
-    except Exception:
+    except KeyMismatchError as error:
+        friendly = doc_meta(doc).get("friendly", doc.get("_id", "?"))
+        log.warning(
+            "flag %s sealed under another key (key id %s, loaded %s)", friendly, error.blob_kid, error.key_kid,
+        )
+        return "?"
+    except (KeyError, TypeError, ValueError):
+        return "?"
+    except InvalidTag:
+        friendly = doc_meta(doc).get("friendly", doc.get("_id", "?"))
+        log.warning("auth-tag verification failed for flag %s - foreign key or tampered record", friendly)
         return "?"