89 lines
4.6 KiB
Python
89 lines
4.6 KiB
Python
|
"""Build one synthetic present_existing intake envelope (INFD-WP-0010-T02 release check).
|
||
|
|
|
||
|
|
The envelope pins an approval id the caller names and a deliberately wrong binding
|
||
|
|
digest, so a successful approval read always ends in a 409 refusal and no memo is
|
||
|
|
stored, no budget is spent and no approval is created, entered or consumed. It only
|
||
|
|
prints JSON; posting it is a separate, founder-run step (see
|
||
|
|
deploy/lifecycle/RELEASE-INFD-WP-0010-T02.md). The content is synthetic and secret-free.
|
||
|
|
"""
|
||
|
|
|
||
|
|
import argparse
|
||
|
|
from datetime import datetime, timezone
|
||
|
|
import hashlib
|
||
|
|
import json
|
||
|
|
import sys
|
||
|
|
|
||
|
|
ACTOR = "service:nk-bind-executor"
|
||
|
|
SUBMITTER = "nk-bind-executor"
|
||
|
|
PROFILE_ACTIONS = ["bounded-execution"]
|
||
|
|
WRONG_DIGEST = "sha256:" + "0" * 64
|
||
|
|
WORKLOAD = "http://informed-decision-workload.informed-decision.svc.cluster.local:8081/v1/memos"
|
||
|
|
TOKEN_FILE = "/var/run/secrets/informed-decision-intake/token"
|
||
|
|
|
||
|
|
# Runs inside the founder's probe pod (python from the service image). Prints status and the
|
||
|
|
# refusal body only; never prints the token.
|
||
|
|
POSTER = """import json, urllib.error, urllib.request
|
||
|
|
token = open(%r).read().strip()
|
||
|
|
request = urllib.request.Request(%r, data=ENVELOPE.encode(), method="POST",
|
||
|
|
headers={"Authorization": "Bearer " + token, "Content-Type": "application/json"})
|
||
|
|
try:
|
||
|
|
response = urllib.request.urlopen(request, timeout=20)
|
||
|
|
print(response.status, response.read().decode()[:400])
|
||
|
|
except urllib.error.HTTPError as error:
|
||
|
|
print(error.code, error.read().decode()[:400])
|
||
|
|
""" % (TOKEN_FILE, WORKLOAD)
|
||
|
|
|
||
|
|
|
||
|
|
def build(approval_id, stamp):
|
||
|
|
memo_id = "probe-" + stamp
|
||
|
|
item_id = memo_id + "-packet"
|
||
|
|
content = ("Synthetic release probe for the present_existing intake profile. "
|
||
|
|
"It is refused by design and must never be shown for review.\n")
|
||
|
|
packet_hash = "sha256:" + hashlib.sha256(content.encode()).hexdigest()
|
||
|
|
memo = {
|
||
|
|
"id": memo_id, "version": 1, "sealed": False, "locale": "en",
|
||
|
|
"question": "Synthetic release probe: is this refused before review?",
|
||
|
|
"requested_act": "approve", "binding_level": "organizational", "step_kind": "approve",
|
||
|
|
"brief": "Synthetic present_existing release probe; never bound.",
|
||
|
|
"binding": {"justification": None, "terms": None,
|
||
|
|
"principal": {"id": "pending-human-session", "kind": "person", "role": "reviewer",
|
||
|
|
"display_name": "Named reviewer in net-kingdom-admins", "identifiers": []},
|
||
|
|
"target": {"environment": "prod", "id": "probe:" + memo_id, "kind": "bounded-execution",
|
||
|
|
"label": "synthetic release probe", "requires_new_bind": False}},
|
||
|
|
"packet": [{"item_id": item_id, "label": item_id, "hash": packet_hash}],
|
||
|
|
"highlights": [],
|
||
|
|
"approval_id": approval_id, "approval_binding_digest": WRONG_DIGEST,
|
||
|
|
}
|
||
|
|
return {
|
||
|
|
"kind": "informed-decision.memo-intake", "version": 1,
|
||
|
|
"idempotency_key": memo_id, "memo_class": "bounded-execution",
|
||
|
|
"review_group": "net-kingdom-admins", "drafted_by": "informed-decision-release-probe",
|
||
|
|
"approval_intent": {"action": "bounded-execution", "principal": "admin",
|
||
|
|
"purpose": "Synthetic present_existing release probe",
|
||
|
|
"target": {"admission_id": "PROBE-" + stamp, "admission_digest": WRONG_DIGEST}},
|
||
|
|
"memo": memo,
|
||
|
|
"packet": [{"item_id": item_id, "media_type": "text/plain", "content": content}],
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
def main():
|
||
|
|
parser = argparse.ArgumentParser(description=__doc__)
|
||
|
|
parser.add_argument("--approval-id", required=True, help="existing approval UUID, or a random UUID")
|
||
|
|
parser.add_argument("--program", action="store_true",
|
||
|
|
help="print a self-contained python program that posts the envelope (for `python -`)")
|
||
|
|
parser.add_argument("--stamp", default=datetime.now(timezone.utc).strftime("%Y%m%d%H%M%S"))
|
||
|
|
args = parser.parse_args()
|
||
|
|
envelope = build(args.approval_id, args.stamp)
|
||
|
|
# Offline self-check against the same validator intake uses.
|
||
|
|
from informed_decision.intake import PresentExisting, SubmitterGrant, validate_submission
|
||
|
|
validate_submission(envelope, submitter_id=SUBMITTER,
|
||
|
|
grant=SubmitterGrant(SUBMITTER, frozenset({"bounded-execution"}),
|
||
|
|
frozenset({"net-kingdom-admins"})),
|
||
|
|
present_existing=PresentExisting(ACTOR, frozenset(PROFILE_ACTIONS)))
|
||
|
|
raw = json.dumps(envelope, separators=(",", ":"))
|
||
|
|
sys.stdout.write("ENVELOPE = %r\n%s" % (raw, POSTER) if args.program else raw + "\n")
|
||
|
|
|
||
|
|
|
||
|
|
if __name__ == "__main__":
|
||
|
|
main()
|