From f76e5f16da7316a426e82b3988da06b7233d13d1 Mon Sep 17 00:00:00 2001
From: whyour <imwhyour@gmail.com>
Date: Wed, 2 Sep 2026 07:18:07 +0800
Subject: [PATCH] fix(ql3): bound secret config auth namespaces

---
 .../application/coordinator.ts                |  2 +-
 .../secret-and-config/decisionCoordinator.ts  |  2 +-
 .../reconciliationCapturePrepare.test.cjs     | 26 +++++++++++++++----
 3 files changed, 23 insertions(+), 7 deletions(-)

diff --git a/packages/ql3-local-owner-cli/src/deployment/reconciliation/application/secret-and-config/application/coordinator.ts b/packages/ql3-local-owner-cli/src/deployment/reconciliation/application/secret-and-config/application/coordinator.ts
index 85a9d7bf..41e2ac02 100644
--- a/packages/ql3-local-owner-cli/src/deployment/reconciliation/application/secret-and-config/application/coordinator.ts
+++ b/packages/ql3-local-owner-cli/src/deployment/reconciliation/application/secret-and-config/application/coordinator.ts
@@ -226,7 +226,7 @@ async function authenticate(
       databasePath: options.targetDatabasePath,
       ownerPepperKeyringDirectory: options.ownerPepperKeyringDirectory,
       credentialFilePath: options.credentialFilePath,
-      authenticationNamespace: 'local_reconciliation_secret_config_apply',
+      authenticationNamespace: 'reconcile_secret_config_apply',
       now: () => atMs,
     });
     assertReviewer(authenticated, reviewer, atMs);
diff --git a/packages/ql3-local-owner-cli/src/deployment/reconciliation/application/secret-and-config/decisionCoordinator.ts b/packages/ql3-local-owner-cli/src/deployment/reconciliation/application/secret-and-config/decisionCoordinator.ts
index b35fa217..38b1b440 100644
--- a/packages/ql3-local-owner-cli/src/deployment/reconciliation/application/secret-and-config/decisionCoordinator.ts
+++ b/packages/ql3-local-owner-cli/src/deployment/reconciliation/application/secret-and-config/decisionCoordinator.ts
@@ -766,7 +766,7 @@ async function authorization(
       databasePath: command.options.targetDatabasePath,
       ownerPepperKeyringDirectory: command.options.ownerPepperKeyringDirectory,
       credentialFilePath: command.options.credentialFilePath,
-      authenticationNamespace: 'local_reconciliation_secret_config',
+      authenticationNamespace: 'reconcile_secret_config_decision',
       now: () => command.request.committedAtMs,
     });
     const reviewer = strongReviewer(
diff --git a/packages/ql3-local-owner-cli/test/reconciliationCapturePrepare.test.cjs b/packages/ql3-local-owner-cli/test/reconciliationCapturePrepare.test.cjs
index e20c7144..0d23a845 100644
--- a/packages/ql3-local-owner-cli/test/reconciliationCapturePrepare.test.cjs
+++ b/packages/ql3-local-owner-cli/test/reconciliationCapturePrepare.test.cjs
@@ -1887,9 +1887,13 @@ function secretConfigDecisionCommitFixture(
     },
     async authenticate(_database, authenticateOptions) {
       authentications += 1;
+      assert.match(
+        authenticateOptions.authenticationNamespace,
+        /^[a-z][a-z0-9_]{0,31}$/,
+      );
       assert.equal(
         authenticateOptions.authenticationNamespace,
-        'local_reconciliation_secret_config',
+        'reconcile_secret_config_decision',
       );
       return {
         principal: {
@@ -1897,7 +1901,7 @@ function secretConfigDecisionCommitFixture(
             type: 'user',
             id: options.reviewerId ?? 'review-owner',
           },
-          authenticationId: 'local_reconciliation_secret_config:test',
+          authenticationId: 'reconcile_secret_config_decision:test',
           authenticatedAtMs: committedAtMs,
           expiresAtMs: committedAtMs + authorizationLifetimeMs + 60_000,
           assurance: options.assurance ?? 'local_console',
@@ -2107,11 +2111,19 @@ async function appliedSecretConfigFixture(t, options = {}) {
       return { async close() {} };
     },
     async authenticate(_database, authenticationOptions) {
+      assert.match(
+        authenticationOptions.authenticationNamespace,
+        /^[a-z][a-z0-9_]{0,31}$/,
+      );
+      assert.equal(
+        authenticationOptions.authenticationNamespace,
+        'reconcile_secret_config_apply',
+      );
       const authenticatedAtMs = authenticationOptions.now();
       return {
         principal: {
           subject: { type: 'user', id: 'review-owner' },
-          authenticationId: 'local_reconciliation_secret_config_apply:test',
+          authenticationId: 'reconcile_secret_config_apply:test',
           authenticatedAtMs,
           expiresAtMs: authenticatedAtMs + 60 * 60 * 1_000,
           assurance: 'local_console',
@@ -4503,15 +4515,19 @@ test('Secret/Config apply publishes encrypted material atomically and recovers e
     },
     async authenticate(_database, options) {
       authentications += 1;
+      assert.match(
+        options.authenticationNamespace,
+        /^[a-z][a-z0-9_]{0,31}$/,
+      );
       assert.equal(
         options.authenticationNamespace,
-        'local_reconciliation_secret_config_apply',
+        'reconcile_secret_config_apply',
       );
       const authenticatedAtMs = options.now();
       return {
         principal: {
           subject: { type: 'user', id: 'review-owner' },
-          authenticationId: 'local_reconciliation_secret_config_apply:test',
+          authenticationId: 'reconcile_secret_config_apply:test',
           authenticatedAtMs,
           expiresAtMs: authenticatedAtMs + 60 * 60 * 1_000,
           assurance: 'local_console',