brama subscription authenticator list¶

List what the latest provider sign-in observed and whether Skarbiec reports a usable authenticator seed. These are separate observations: an account can require a phone approval without a stored seed, and a successful sign-in alone does not prove that two-factor authentication is disabled. An account that needs one is given one with authenticator enrol.

Invocation¶

brama subscription authenticator list [--provider <PROVIDER>] [--gateway <ORIGIN> | --gateway-consumer <NAME>] [--bearer-role <ROLE>] [--json]

Output and state¶

<N> account(s) asked for a second factor, <N> did not ask in the observed sign-in, <N> unobserved
  <provider> <account> -> needs a second factor | not requested in the observed sign-in | unobserved; seed <state>
    <evidence>

With --json: {required, not_required, unknown, accounts: [{provider, account, login_item, required, method, seed, seed_error, evidence}]}. required is true, false or null. False means no challenge was requested in the observed sign-in; null means the sign-in supplied no challenge observation. method distinguishes an observed phone approval from an authenticator challenge. A missing login reports no_login_declared, not a missing seed.

The command reads the pool and vault metadata, prints no secret and writes nothing. A failed seed inspection reports the actual operation and error. In pool responses, an unavailable seed observation is null with seed_error; Brama Desktop displays it in the selected account's Second factor section rather than showing an absent seed.

Refusals¶

A pool or vault read that fails prints its own sentence on standard error and exits 1. An unknown argument exits 2. On a workstation that reads the fleet vault remotely, the local reading is refused by the vault program (this machine holds no Skarbiec vault), and the refusal adds the reading that answers: brama subscription authenticator list --gateway-consumer <consumer> --bearer-role <role>. A gateway that cannot read its vault answers HTTP 503 with the vault program’s error; a request without the brama-desktop console identity is refused like every admin route.

An active member without a recorded account refuses the report rather than being counted under its member ID. The error names the subscription and provider, and directs you to brama subscription attribute <provider> on the gateway that owns its grant. Both text and JSON modes exit 1 without printing account totals. A member label is never evidence of its account identity.

Real qualification

tests/subscriptions/identity/authenticator.rs runs on the isolated gateway's vault host. Supply BRAMA, CONSUMER, BEARER_ROLE, GATEWAY_SOURCE_REVISION, SKARBIEC_BIN, ATTRIBUTED_PROVIDER, space-separated ATTRIBUTED_ACCOUNTS, UNATTRIBUTED_PROVIDER and UNATTRIBUTED_MEMBER for actual gateway state. The journey verifies the responding revision, exact attributed accounts, both text and JSON refusals for missing identity, and unchanged pool and vault metadata. It retains commands, exit statuses, source revision and binary checksum. Its second journey, authenticator_report_is_read_from_the_gateway_vault, runs on a workstation without the fleet vault: the local reading must be refused naming --gateway-consumer, and the gateway reading must list exactly ATTRIBUTED_ACCOUNTS, each with its seed state or the error that kept it unread.

Supply CLI_SOURCE_REVISION as well: shared setup retains brama version and refuses a different CLI build before contacting the gateway. This is separate from the expected gateway revision.

cargo test --test subscription-capacity authenticator_identity -- --ignored --nocapture

Back to brama subscription or the CLI tree.