coulomb/informed-decision
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Deploy verified-group T03 review surface and packet preparation

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
This commit is contained in:
tegwick 2026-09-14 02:47:31 +02:00
parent c5367a5a54
commit 6fb35d953b
14 changed files with 2876 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

6
informed_decision/oidc.py
View file

@ -40,6 +40,7 @@ class HumanSession:
access_token: str = field(repr=False)
csrf: str = field(default_factory=lambda: secrets.token_urlsafe(32), repr=False)
roles: tuple[str, ...] = ()
groups: tuple[str, ...] = ()
class KeyCapeLogin:
@ -151,6 +152,9 @@ class KeyCapeLogin:
if (not isinstance(access.get("roles"), list)
or any(not isinstance(x, str) for x in access["roles"])):
raise LoginError("human approver profile required")
groups = access.get("groups")
if not isinstance(groups, list) or any(not isinstance(x, str) or not x for x in groups):
raise LoginError("human approver profile required")
assurance = access.get("assurance")
if (not isinstance(assurance, dict) or assurance.get("level") != "aal2"
or assurance.get("mfa") is not True or assurance.get("source") != "key-cape"
@ -169,7 +173,7 @@ class KeyCapeLogin:
assert_human_control_dischargeable(human)
session = HumanSession(access["sub"], Claim(access["tenant"], tenant_route), human,
dict(assurance), min(identity["exp"], access["exp"], self.clock() + 900),
tokens["access_token"], roles=tuple(access["roles"]))
tokens["access_token"], roles=tuple(access["roles"]), groups=tuple(groups))
with self._lock:
self._prune()
if len(self._sessions) >= self.capacity:

3
informed_decision/policy.py
View file

@ -64,7 +64,8 @@ def build_request(session: HumanSession, memo, action, policy_version):
"subject": {"id": session.subject, "type": "human", "tenant": session.tenant.value,
"attributes": {"tenant_source": session.tenant.route.value,
"principal_type_source": session.principal_type.route.value,
"assurance": dict(session.assurance), "roles": list(session.roles)}},
"assurance": dict(session.assurance), "roles": list(session.roles),
"groups": list(session.groups)}},
"action": action,
"resource": {"id": "memo:" + memo.id, "type": "decision-memo",
"system": "informed-decision", "tenant": "tenant:platform"},