14 lines
2.5 KiB
Python
14 lines
2.5 KiB
Python
|
"""Synthetic interoperability generator; never obtains credentials or native state."""
|
||
|
|
import hashlib, json, sys
|
||
|
|
from datetime import datetime, timedelta, timezone
|
||
|
|
sys.path.insert(0, '/home/worsch/secrets-engine/src')
|
||
|
|
from secrets_engine.execution_contract import ExecutionContract, catalog_target_digest
|
||
|
|
from secrets_engine.authorization import request_digest, approval_binding_digest
|
||
|
|
h='sha256:'+'a'*64
|
||
|
|
catalog={'lane':'synthetic','stage':'prod'}
|
||
|
|
c={'contract_version':'SECRETS-EXEC-20261011-v1','operation_id':'cbfbced0-09d5-48c8-a1e7-a2ea4dc69153','operation':'metadata-apply-ccr','execution_actor':'service:secrets-engine','ccr_id':'CCR-2099-0001','execution_grant_ccr_id':'CCR-2099-0002','ccr_immutable_sha256':h,'grant_immutable_sha256':h,'catalog_sha256':catalog_target_digest(catalog),'expected_before':h,'expected_after':h,'source_bundle':{r:{'path':'/synthetic/'+r+'.py','sha256':h} for r in ['engine_dispatcher','platform_mediator','typed_ccr','policy_auth']},'backend_origin':'http://127.0.0.1:18200','cluster_uid':'synthetic-not-native','backend_budget':{'ttl_seconds':120,'uses':12},'operation_deadline':(datetime.now(timezone.utc)+timedelta(seconds=100)).isoformat(),'operations':[{'method':method,'path':path,'payload_sha256':h} for path in ['sys/policies/acl/synthetic','auth/synthetic/role/synthetic'] for method in ['GET','PUT','GET']]}
|
||
|
|
c=ExecutionContract.parse(c).as_dict()
|
||
|
|
p={'version':'proposed-service-task-caller/v1','transport_principal':'system:serviceaccount:secrets-engine:secrets-engine','subject_id':'secrets-engine','subject_type':'service','tenant':'tenant:platform'}
|
||
|
|
r={'tenant':'tenant:platform','subject':{'id':'secrets-engine','type':'service'},'action':'execute-ccr','resource':{'id':'catalog:synthetic','type':'secret-catalog-lane','system':'secrets-engine','attributes':{'stage':'prod'}},'context':{'execution_contract':c,'catalog_target':catalog,'human_control':True,'service_actor_binding':p,'approval':{'schema_version':'0.1','kind':'approval-claim','issuer':'approval-engine','approval_id':'synthetic','valid_now':True,'consumed':False,'reason_code':'ok','binding':{'human_control':True,'pdp_path':True,'pdp_digest':h},'freshness':{'not_after':(datetime.now(timezone.utc)+timedelta(seconds=60)).isoformat()},'validity':{'expires_at':(datetime.now(timezone.utc)+timedelta(seconds=120)).isoformat()}}}}
|
||
|
|
print(json.dumps({'request':r,'request_digest':request_digest(r),'approval_binding_digest':approval_binding_digest(r),'descriptor_digest':catalog_target_digest(c)}))
|