feat(migrations): add OpenBao migration for event-ledger

[shelleyshen-0]

TL;DR

Adds the OpenBao migration needed to integrate event-ledger into the self-managed stack. Event-ledger's Cassandra credentials are provisioned in its own KV2 secrets engine, its JWT secrets engine is set up as an issuer so SIS and NVCA can obtain JWTs for inbound writes, and event-ledger is registered as a service in api-keys-api.

Additional Details

22_setup_event-ledger.sh sets up:

• services/event-ledger/kv — Cassandra credentials for event_ledger_app_v0
• services/event-ledger/jwt — JWT secrets engine; SIS and NVCA sign tokens from here (scopes: fnds:createEvent,fnds:archiveEvents) to authenticate inbound writes
• JWT auth role for the event-ledger service account in the nvcf namespace
• Signing policies merged into the existing sis-api and nvca auth roles via merge_jwt_role_policies (no policy loss on re-run)

07_setup_api-keys.sh adds event-ledger to the registrations/services KV array and switches to overwrite=true so re-runs on existing clusters pick up the new entry (this also fixes the same gap for the prior NVCT registration).

For the Reviewer

• 07_setup_api-keys.sh lines 37 and 88-91: write_secrets_kv is idempotent by default — it skips the write if the key already exists. Without overwrite=true, existing clusters that ran migrations before this change would never get event-ledger (or NVCT) added to the registration list. The content is fully deterministic so overwriting on every run is safe.

For QA

N/A

Issues

Relates to #167

Checklist

• I am familiar with the Contributing Guidelines.
• I have signed off my commits for Developer Certificate of Origin (DCO) compliance.
• New or existing tests cover these changes.
• The documentation is up to date with these changes.

Summary by CodeRabbit

• New Features
  • Added secure secret storage and access policies for the event-ledger service.
  • Enabled event creation and archival permissions for approved API callers.
  • Added JWT-based authentication and signing access for event-ledger integrations.
  • Registered the event-ledger service alongside the existing NVCT service for API key authorization.

[coderabbitai]

📝 Walkthrough

Walkthrough

The migrations register event-ledger as a service, provision its Vault KV and JWT configuration, store Cassandra credentials, and create JWT signing and authentication roles for event-ledger, SIS, and NVCA.

Changes

Event Ledger Vault Provisioning

Layer / File(s)	Summary
Register event-ledger service migrations/openbao/migrations/07_setup_api-keys.sh	Adds the event-ledger service identifier to the service registration payload and updates the KV write call.
Provision event-ledger secrets and access migrations/openbao/migrations/22_setup_event-ledger.sh	Initializes the event-ledger KV and JWT mounts, stores Cassandra credentials, and creates service-account policies and authentication.
Configure SIS and NVCA signing migrations/openbao/migrations/22_setup_event-ledger.sh	Creates JWT secret roles, signing policies, scopes, and authentication roles for SIS and NVCA.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Migration as 22_setup_event-ledger.sh
  participant Vault
  participant EventLedger as event-ledger service account
  participant SIS
  participant NVCA
  Migration->>Vault: Provision KV and JWT mounts
  Migration->>Vault: Store Cassandra credentials and policies
  Migration->>Vault: Create event-ledger auth role
  Migration->>Vault: Create SIS and NVCA signing roles
  SIS->>Vault: Sign scoped JWT
  NVCA->>Vault: Sign scoped JWT
  EventLedger->>Vault: Authenticate with event-ledger policies

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title follows Conventional Commits and accurately describes the primary change: a new migration for event-ledger integration.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/migrations/event-ledger-openbao

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@migrations/openbao/migrations/07_setup_api-keys.sh`:
- Around line 90-93: Add repository-native tests covering the base64-decoded
registration payload and overwrite behavior in
migrations/openbao/migrations/07_setup_api-keys.sh:90-93, and generated KV/JWT
mounts, policies, and preservation of existing SIS/NVCA role policies in
migrations/openbao/migrations/22_setup_event-ledger.sh:42-106; otherwise
document why these tests are not applicable and run the repository-native test
runner.

In `@migrations/openbao/migrations/22_setup_event-ledger.sh`:
- Line 44: The write_secrets_kv invocation for Cassandra credentials must not
interpolate DEFAULT_CASSANDRA_PASSWORD into the bao kv put arguments. Update the
event-ledger migration and its supporting write_secrets_kv flow in functions.sh
to use OpenBao’s stdin/file input form for the password while preserving the
existing username and secret path.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 3655c746-1a25-421f-831f-477c0a975127

📥 Commits

Reviewing files that changed from the base of the PR and between 8f8a920 and b86592a.

📒 Files selected for processing (2)

• migrations/openbao/migrations/07_setup_api-keys.sh
• migrations/openbao/migrations/22_setup_event-ledger.sh