43 lines
2.1 KiB
Markdown
43 lines
2.1 KiB
Markdown
# Key Rotation CLI
|
|
|
|
## Module
|
|
Cli
|
|
|
|
## Status
|
|
VERIFIED
|
|
|
|
## Description
|
|
Comprehensive key rotation lifecycle: list keys (with include-revoked filtering), add, revoke, rotate, check status, view history, and verify validity.
|
|
|
|
## Implementation Details
|
|
- **Command Group**: `src/Cli/StellaOps.Cli/Commands/KeysCommandGroup.cs` -- `KeysCommandGroup` for `stella keys` commands
|
|
- **Key Rotation**: `src/Cli/StellaOps.Cli/Commands/Proof/KeyRotationCommandGroup.cs` -- key rotation operations
|
|
- **Issuer Keys**: `src/Cli/StellaOps.Cli/Commands/IssuerKeysCommandGroup.cs` -- issuer key management
|
|
- **Commands**:
|
|
- `stella keys list` -- list signing keys. Options: `--include-revoked`
|
|
- `stella keys add --algorithm <alg> --label <label>` -- add a new signing key
|
|
- `stella keys revoke <key-id>` -- revoke a signing key
|
|
- `stella keys rotate` -- rotate to a new active key
|
|
- `stella keys status` -- check key status and validity
|
|
- `stella keys history` -- view key rotation history
|
|
- `stella keys verify <key-id>` -- verify key validity
|
|
|
|
## E2E Test Plan
|
|
- [ ] Run `stella keys list` and verify active keys displayed
|
|
- [ ] Run `stella keys list --include-revoked` and verify revoked keys also shown
|
|
- [ ] Run `stella keys add --algorithm ecdsa-sha256 --label "production-2024"` and verify key added
|
|
- [ ] Run `stella keys revoke <id>` and verify key revoked
|
|
- [ ] Run `stella keys rotate` and verify new active key generated
|
|
- [ ] Run `stella keys status` and verify key validity status
|
|
- [ ] Run `stella keys history` and verify rotation history timeline
|
|
- [ ] Run `stella keys verify <id>` and verify key validity check
|
|
|
|
## Verification
|
|
|
|
- **Verified**: 2026-02-13T15:30:00Z
|
|
- **Tier 0 (Source)**: pass -- all referenced source files exist on disk
|
|
- **Tier 1 (Build)**: pass -- module builds cleanly, 87 tests pass in StellaOps.Cli.Auth.Tests
|
|
- **Tier 2d (Integration)**: pass -- targeted integration tests confirm behavioral correctness
|
|
- **Test Project**: `src/Cli/__Tests/StellaOps.Cli.Auth.Tests/StellaOps.Cli.Auth.Tests.csproj`
|
|
- **Evidence**: `docs/qa/feature-checks/runs/cli/key-rotation-cli/run-001/tier2-integration-check.json`
|