smcli: self-healing sessions — refresh-token grant + auto-relogin

Vault access tokens expire (~10min); consumers hit 401s after container recreates. Now: refresh_token persisted at login and rotated on every refresh (Vaultwarden semantics); 401 on an authed call refreshes once and retries; if refresh is unavailable, full relogin (password+TOTP injected by the sm shims from the TSGCOO vault-account env) is attempted before failing. cmdLogin passes the TOTP seed again (regression). QA: corrupted access_token -> TSGCOO sm read self-healed end-to-end. Ticket: https://projects.knownelement.com/issues/832
2026-09-07 09:43:50 -05:00
parent e067eee330
commit cf4094b9e4
4 changed files with 41 additions and 9 deletions
@@ -10,7 +10,7 @@
 name: knel-secretsmanager
 services:
  smcli:
-    image: git.knownelement.com/knel/knel-secretsmanager-cli@sha256:46d80c0a0ef53a9303dd54b3799a64a61cd4e4dc892282bc4d8a220378117ce9
+    image: git.knownelement.com/knel/knel-secretsmanager-cli@sha256:8abfc55dfa7ca9e70b286a249b7ca823531bd55da29bed70d3354a58ec4d8fec
    container_name: ukrrs-secretsmgr-cli
    restart: unless-stopped
    entrypoint: ["sleep", "infinity"]