secrets-engine/tools/exercise_approval_identity.py

#!/usr/bin/env python3
"""Disposable KeyCape image -> actual Secrets Engine client -> Approval Engine.

Synthetic keys/credentials only. No OpenBao, cluster mutation, or model call.
The PDP is a sequencing double; this is not production authorization evidence.
"""
from __future__ import annotations

import argparse
import base64
import copy
import hashlib
import http.server
import ipaddress
import json
import os
from pathlib import Path
import secrets
import socket
import ssl
import subprocess
import sys
import tempfile
import threading
import time
from datetime import datetime, timedelta, timezone
from urllib.error import HTTPError
from urllib.parse import urlencode
from urllib.request import Request, urlopen
from unittest.mock import patch
from wsgiref.simple_server import WSGIRequestHandler, make_server

from cryptography import x509
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import rsa
from cryptography.x509.oid import NameOID
import yaml

KEYCAPE_IMAGE = "forgejo.coulomb.social/coulomb/key-cape@sha256:7ff54c54e63ee172ae9e6e7fd2da96e427352f712343d74626ee6fe0f6f82611"
ROOT = Path(__file__).resolve().parents[1]
sys.path[:0] = [str(ROOT / "src"), str(ROOT)]


def run(args):
    result = subprocess.run(args, capture_output=True, timeout=45)
    if result.returncode:
        raise RuntimeError("contained command failed")
    return result.stdout.decode().strip()


def commit(path):
    return run(["git", "-C", str(path), "rev-parse", "HEAD"])


def private_write(path, value):
    with path.open("x") as out:
        os.chmod(path, 0o600)
        out.write(value)


def exercise(args):
    sys.path.insert(0, str(args.approval_engine_source))
    from approval_engine.api import App
    from approval_engine.auth import JWTAuthenticator
    from approval_engine.store import Engine
    from secrets_engine import cli
    from secrets_engine.approval_auth import approval_token, credential_urlopen
    from secrets_engine.approval_consume import ConsumeBinding, _expected_request, consume_approval
    from secrets_engine.catalog import validate_entry
    from secrets_engine.config import Config
    from secrets_engine.errors import BackendError, DecisionError
    from tests.authorization_stub import AuthorizationStub
    from tests.test_catalog import VALID

    receipt = {
        "schema_version": 1, "target": "disposable local processes; synthetic credentials",
        "started_at": datetime.now(timezone.utc).isoformat(),
        "keycape_image": KEYCAPE_IMAGE,
        "approval_engine_commit": commit(args.approval_engine_source),
        "keycape_contract_commit": commit(args.keycape_source),
        "consumer_source_sha256": {
            name: hashlib.sha256((ROOT / "src/secrets_engine" / name).read_bytes()).hexdigest()
            for name in ("approval_auth.py", "approval_consume.py", "config.py", "service_auth.py")
        },
        "limitations": ["PDP sequencing double", "local Approval Engine source, not deployed image",
                        "no live custody or client-side read grant", "no OpenBao effect or model execution"],
        "checks": {},
    }
    with tempfile.TemporaryDirectory(prefix="approval-identity-private-") as temporary:
        root = Path(temporary)
        key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
        private_write(root / "key.pem", key.private_bytes(serialization.Encoding.PEM,
            serialization.PrivateFormat.PKCS8, serialization.NoEncryption()).decode())
        now = datetime.now(timezone.utc)
        name = x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, "local approval identity exercise")])
        cert = (x509.CertificateBuilder().subject_name(name).issuer_name(name).public_key(key.public_key())
                .serial_number(x509.random_serial_number()).not_valid_before(now - timedelta(minutes=1))
                .not_valid_after(now + timedelta(hours=1))
                .add_extension(x509.SubjectAlternativeName([x509.IPAddress(ipaddress.ip_address("127.0.0.1"))]), False)
                .add_extension(x509.BasicConstraints(ca=True, path_length=None), True)
                .sign(key, hashes.SHA256()))
        (root / "cert.pem").write_bytes(cert.public_bytes(serialization.Encoding.PEM))
        with socket.socket() as sock:
            sock.bind(("127.0.0.1", 0))
            keycape_port = sock.getsockname()[1]

        class Proxy(http.server.BaseHTTPRequestHandler):
            def log_message(self, *_args):
                pass
            def proxy(self):
                body = self.rfile.read(int(self.headers.get("Content-Length", 0))) if self.command == "POST" else None
                req = Request(f"http://127.0.0.1:{keycape_port}" + self.path, data=body,
                              headers={k: self.headers[k] for k in ("Content-Type", "Authorization") if k in self.headers})
                try:
                    response = urlopen(req, timeout=10)
                except HTTPError as error:
                    response = error
                with response:
                    self.send_response(response.code)
                    self.send_header("Content-Type", "application/json")
                    self.end_headers()
                    self.wfile.write(response.read())
            do_GET = proxy
            do_POST = proxy

        server = http.server.ThreadingHTTPServer(("127.0.0.1", 0), Proxy)
        context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
        context.load_cert_chain(root / "cert.pem", root / "key.pem")
        server.socket = context.wrap_socket(server.socket, server_side=True)
        issuer = f"https://127.0.0.1:{server.server_port}"
        proxy_thread = threading.Thread(target=server.serve_forever, daemon=True)
        proxy_thread.start()
        config = yaml.safe_load((args.keycape_source / "config/dev-config.yaml").read_text())
        clients = yaml.safe_load((args.keycape_source / "config/service-clients.example.yaml").read_text())["clients"]
        clients = [c for c in clients if c["clientId"] in ("secrets-engine-approval", "approval-engine-operator")]
        assert len(clients) == 2
        config.update(issuer=issuer, clients=clients)
        config["authelia"]["issuer"] = "https://synthetic-upstream.invalid"
        private_write(root / "config.yaml", yaml.safe_dump(config, sort_keys=False))
        values = {c["clientId"]: secrets.token_urlsafe(48) for c in clients}
        private_write(root / "env", "KEYCAPE_CONFIG=/etc/keycape/config.yaml\n" + "".join(
            c["secretRef"].removeprefix("env:") + "=" + values[c["clientId"]] + "\n" for c in clients))
        private_write(root / "approval.secret", values["secrets-engine-approval"])
        private_write(root / "pdp.token", "synthetic-pdp-token")
        container = "approval-identity-exercise-" + secrets.token_hex(5)
        created = False
        engine = None
        api_server = None
        pdp = None
        try:
            run(["docker", "run", "-d", "--rm", "--name", container, "--user", str(os.getuid()),
                 "--read-only", "--cap-drop=ALL", "--security-opt=no-new-privileges",
                 "--publish", f"127.0.0.1:{keycape_port}:8080", "--env-file", str(root / "env"),
                 "--mount", "type=bind,source=" + temporary + ",target=/etc/keycape,readonly", KEYCAPE_IMAGE])
            created = True
            with patch.dict(os.environ, {"SSL_CERT_FILE": str(root / "cert.pem"), "SECRETS_ENGINE_UNSAFE_DEMO": ""}):
                for _ in range(40):
                    try:
                        with credential_urlopen(issuer + "/jwks", timeout=1) as response:
                            if response.status == 200:
                                break
                    except Exception:
                        time.sleep(0.25)
                else:
                    raise RuntimeError("disposable KeyCape did not start")
                engine = Engine(root / "approval.sqlite")
                app = App(engine, JWTAuthenticator(issuer=issuer, audience="approval-engine", jwks_url=issuer + "/jwks"))
                class Quiet(WSGIRequestHandler):
                    def log_message(self, *_args):
                        pass
                api_server = make_server("127.0.0.1", 0, app, handler_class=Quiet)
                threading.Thread(target=api_server.serve_forever, daemon=True).start()
                api = f"http://127.0.0.1:{api_server.server_port}"

                def operator_token(scope):
                    credential = base64.b64encode(("approval-engine-operator:" + values["approval-engine-operator"]).encode()).decode()
                    req = Request(issuer + "/token", data=urlencode({"grant_type": "client_credentials", "scope": scope}).encode(),
                                  headers={"Authorization": "Basic " + credential})
                    with credential_urlopen(req, timeout=3) as response:
                        return json.load(response)["access_token"]

                def operator_request(path, payload, scope):
                    req = Request(api + path, data=json.dumps(payload).encode(),
                                  headers={"Content-Type": "application/json", "Authorization": "Bearer " + operator_token(scope)})
                    with credential_urlopen(req, timeout=3) as response:
                        return json.load(response)

                raw = copy.deepcopy(VALID)
                raw["stage"] = "prod"
                raw["approval"] = {"model": "bootstrap-only", "authorization_id": "synthetic-approval", "purpose": "disposable identity proof"}
                entry = validate_entry(raw)
                pdp = AuthorizationStub(approval_id="unused", package="secrets-engine.catalog-lane.lifecycle", version="v2").start()
                cfg = Config(catalog_dir=root, policy_dir=root, evidence_dir=root / "evidence", hub_url="", bao_addr="", topic_id="",
                             approval_url=api, approval_client_secret_file=root / "approval.secret",
                             keycape_issuer=issuer, keycape_token_url=issuer + "/token",
                             authorization_subject_id="secrets-engine", authorization_subject_type="service",
                             authorization_policy_package="secrets-engine.catalog-lane.lifecycle", authorization_policy_version="v2",
                             pdp_url=pdp.url, pdp_token_file=root / "pdp.token")
                request = _expected_request(cfg, entry, "apply")
                digest = pdp.bind_request(request)
                obj = operator_request("/v1/approvals", {
                    "id": "synthetic-approval",
                    "binding": {"action": "secrets.apply", "target": {"id": entry.id, "stage": "prod"},
                                "actor": "service:approval-engine-operator", "principal": "synthetic-operator", "purpose": "disposable identity proof"},
                    "validity": {"not_before": (now - timedelta(minutes=1)).isoformat(), "expires_at": (now + timedelta(minutes=10)).isoformat()},
                    "pdp_digest": digest, "pdp_path": True}, "approval:create")
                operator_request(f"/v1/approvals/{obj['id']}/entries", {}, "approval:approve")
                receipt["checks"]["operator_issued_and_approved_via_verified_jwt"] = True
                try:
                    cli._require_lane_approval(cfg, entry, "destroy")
                except DecisionError:
                    assert not engine.claim(obj["id"])["consumed"]
                else:
                    raise AssertionError("wrong action accepted")
                receipt["checks"]["wrong_action_refused_before_consume"] = True
                cli._require_lane_approval(cfg, entry, "apply")
                assert engine.claim(obj["id"])["consumed"]
                assert pdp.calls == ["check"]
                receipt["checks"]["actual_consumer_claim_check_consume"] = True
                binding = ConsumeBinding(obj["id"], digest)
                retry = consume_approval(base_url=api, binding=binding, token_provider=lambda: approval_token(cfg, scope="approval:consume"))
                assert retry.idempotent
                receipt["checks"]["same_digest_retry_idempotent"] = True
                try:
                    consume_approval(base_url=api, binding=ConsumeBinding(obj["id"], "sha256:" + "f" * 64),
                                     token_provider=lambda: approval_token(cfg, scope="approval:consume"))
                except DecisionError:
                    pass
                else:
                    raise AssertionError("different digest accepted")
                receipt["checks"]["different_digest_refused"] = True
                try:
                    cli._require_lane_approval(cfg, entry, "apply")
                except DecisionError:
                    pass
                else:
                    raise AssertionError("spent claim accepted")
                receipt["checks"]["spent_claim_refused"] = True
                try:
                    operator_token("approval:consume")
                except HTTPError as error:
                    assert error.code in (400, 401)
                    assert json.load(error)["error"] == "invalid_profile_usage"
                else:
                    raise AssertionError("operator consume scope accepted")
                receipt["checks"]["operator_consume_scope_denied_by_issuer"] = True
                (root / "approval.secret").write_text("synthetic-wrong-secret")
                try:
                    approval_token(cfg, scope="approval:read")
                except BackendError:
                    pass
                else:
                    raise AssertionError("wrong secret accepted")
                receipt["checks"]["wrong_secret_refused"] = True
                assert not (root / "approval.token").exists()
                receipt["checks"]["no_access_token_file_created"] = True
        finally:
            if api_server:
                api_server.shutdown()
                api_server.server_close()
            if pdp:
                pdp.stop()
            if engine:
                engine.close()
            if created:
                run(["docker", "stop", "--time=5", container])
            server.shutdown()
            server.server_close()
            proxy_thread.join()
    receipt.update(status="passed", cleanup_complete=True, finished_at=datetime.now(timezone.utc).isoformat())
    private_write(args.receipt, json.dumps(receipt, indent=2) + "\n")


def main():
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument("--keycape-source", required=True, type=Path)
    parser.add_argument("--approval-engine-source", required=True, type=Path)
    parser.add_argument("--receipt", required=True, type=Path)
    args = parser.parse_args()
    if args.receipt.exists():
        raise SystemExit("receipt path must be new")
    try:
        exercise(args)
    except Exception as error:
        # Never dump a request, client environment or credential-bearing frame.
        print("Synthetic approval identity exercise failed: " + type(error).__name__, file=sys.stderr)
        return 1
    print("Synthetic approval identity exercise passed; temporary resources removed.")
    return 0


if __name__ == "__main__":
    raise SystemExit(main())