ace-lab 0.8.0 → 0.13.0

data/lib/ace/lab/molecules/protected_publication_publisher.rb

@@ -1,110 +0,0 @@
-# frozen_string_literal: true
-require "json"
-require "digest"
-require "net/http"
-require "timeout"
-require "rubygems/package"
-require "etc"
-require "ace/herdr/molecules/bounded_process"
-require "ace/assign/authority/private_directory"
-
-module Ace
-  module Lab
-    module Molecules
-      # The admitted receiver owns permission. This boundary only invokes the
-      # existing single-artifact publisher and independently checks registry bytes.
-      class ProtectedPublicationPublisher
-        def initialize(process: Ace::Herdr::Molecules::BoundedProcess, http: Net::HTTP)
-          @process, @http = process, http
-        end
-
-        def verify!(publication:, artifact_digest:, platform:, deadline:)
-          remaining = remaining!(deadline)
-          path = "/api/v2/rubygems/#{publication.fetch('gem_name')}/versions/#{publication.fetch('version')}.json?platform=#{URI.encode_www_form_component(platform)}"
-          connection = @http.new("rubygems.org", 443, nil)
-          connection.use_ssl = true
-          connection.open_timeout = remaining
-          connection.read_timeout = remaining
-          connection.write_timeout = remaining
-          connection.max_retries = 0
-          response = nil
-          body = +""
-          Timeout.timeout(remaining, IOError) do
-            connection.start do |session|
-              connection.read_timeout = remaining!(deadline)
-            session.request(Net::HTTP::Get.new(path)) do |received|
-              response = received
-              received.read_body do |chunk|
-                remaining!(deadline)
-                raise IOError, "registry response exceeds bound" if body.bytesize + chunk.bytesize > 65_536
-                body << chunk
-                connection.read_timeout = remaining!(deadline)
-              end
-            end
-          end
-          end
-          remaining!(deadline)
-          return result("absent", "registry_version_absent") if response.is_a?(Net::HTTPNotFound)
-          return result("uncertain", "registry_verification_unavailable") unless response.is_a?(Net::HTTPSuccess)
-          value = JSON.parse(body, object_class: UniqueObject, max_nesting: 16)
-          unless value.is_a?(Hash) && value["name"] == publication.fetch("gem_name") &&
-              value["version"] == publication.fetch("version") && value["platform"] == platform &&
-              value["sha"].is_a?(String) && value["sha"].match?(/\A[0-9a-f]{64}\z/) && value["yanked"] == false
-            return result("uncertain", "registry_verification_invalid")
-          end
-          value["sha"] == artifact_digest ? result("succeeded", "registry_exact_artifact") : result("failed", "registry_artifact_conflict")
-        rescue StandardError
-          result("uncertain", "registry_verification_unavailable")
-        end
-
-        def push!(operation:, publication:, artifact:, artifact_digest:, otp:, deadline:)
-          unless Process.uid == operation.fetch("executor_uid") && Process.euid == Process.uid &&
-              operation.fetch("argv").last == "--scoped-publication" &&
-              (otp.nil? || otp.is_a?(String) && otp.match?(/\A[0-9]{6}\z/))
-            raise SecurityError, "fixed publication executor differs"
-          end
-          environment = {"PATH" => "/usr/bin:/bin", "LANG" => "C.UTF-8", "HOME" => Etc.getpwuid(Process.uid).dir}
-          environment["GEM_HOST_OTP_CODE"] = otp if otp
-          input = {"artifact" => artifact, "artifact_digest" => artifact_digest,
-            "gem_name" => publication.fetch("gem_name"), "version" => publication.fetch("version")}
-          process = @process.call(operation.fetch("argv"), stdin_data: JSON.generate(input),
-            timeout_s: [remaining!(deadline), 30].min, output_limit: 1024, stderr_limit: 1024,
-            cleanup_group: true, environment: environment, chdir: File.dirname(artifact))
-          remaining!(deadline)
-          return result("uncertain", "publisher_reply_unavailable") if process.oversized || !process.status.success?
-          value = JSON.parse(process.stdout, object_class: UniqueObject, max_nesting: 4)
-          allowed = {"otp-required" => "provider_rejected_before_acceptance", "otp-rejected" => "provider_rejected_before_acceptance",
-            "otp-expired" => "provider_rejected_before_acceptance", "failed" => %w[provider_rejected_non_otp executor_credentials_unavailable invalid_artifact_selection artifact_identity_mismatch artifact_metadata_mismatch invalid_scoped_input],
-            "uncertain" => %w[registry_verification_required provider_result_ambiguous unclassified_push_result publisher_interrupted artifact_changed_during_push]}
-          unless value.is_a?(Hash) && value.keys.sort == %w[classification code] && Array(allowed[value["classification"]]).include?(value["code"])
-            return result("uncertain", "publisher_reply_invalid")
-          end
-          value.freeze
-        rescue StandardError
-          result("uncertain", "publisher_reply_unavailable")
-        ensure
-          environment&.delete("GEM_HOST_OTP_CODE")
-        end
-
-        private
-
-        class UniqueObject < Hash
-          def []=(key, value)
-            raise JSON::ParserError, "duplicate registry field" if key?(key)
-            super
-          end
-        end
-
-        def remaining!(deadline)
-          value = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
-          raise IOError, "publication deadline expired" unless value.positive?
-          value
-        end
-
-        def result(classification, code)
-          {"classification" => classification, "code" => code}.freeze
-        end
-      end
-    end
-  end
-end

data/lib/ace/lab/molecules/protected_service_handler.rb

@@ -1,43 +0,0 @@
-# frozen_string_literal: true
-
-require "json"
-require "ace/herdr/molecules/bounded_process"
-require "timeout"
-require "ace/assign/authority/private_directory"
-
-module Ace
-  module Lab
-    module Molecules
-      # Source-owned receiver handler. Permission admission is a separate
-      # authority operation; this runner never grants or reconstructs it.
-      class ProtectedServiceHandler
-        MAX_STDOUT = 16 * 1024
-        MAX_STDERR = 8 * 1024
-
-        def execute(operation:, envelope:, candidate_root:)
-          unless Process.uid == operation.fetch("executor_uid") && Process.euid == operation.fetch("executor_uid")
-            raise SecurityError, "handler executor differs"
-          end
-          root = Ace::Assign::Authority::PrivateDirectory.verify!(candidate_root)
-          result = Ace::Herdr::Molecules::BoundedProcess.call(operation.fetch("argv"),
-            stdin_data: JSON.generate(envelope), timeout_s: 30,
-            output_limit: MAX_STDOUT, stderr_limit: MAX_STDERR, cleanup_group: true,
-            environment: {"PATH" => "/usr/bin:/bin", "LANG" => "C.UTF-8", "HOME" => root}, chdir: root)
-          return nil if result.oversized || !result.status.success?
-          out = result.stdout
-          response = JSON.parse(out)
-          request = envelope.fetch("request")
-          unless response.is_a?(Hash) && response.keys.sort == %w[evidence input_digest outcome request_id] &&
-              response["request_id"] == request.fetch("request_id") && response["input_digest"] == request.fetch("input_digest") &&
-              %w[succeeded failed].include?(response["outcome"]) && response["evidence"].is_a?(Array)
-            return nil
-          end
-          response
-        rescue JSON::ParserError, Timeout::Error, Ace::Herdr::Molecules::BoundedProcess::PostLaunchError,
-          IOError, SystemCallError
-          nil
-        end
-      end
-    end
-  end
-end

data/lib/ace/lab/molecules/protected_service_policy.rb

@@ -1,156 +0,0 @@
-# frozen_string_literal: true
-
-require "json"
-require "etc"
-require "ace/assign/atoms/evidence_digest"
-require_relative "../authorization_path"
-require_relative "../atoms/service_input"
-require "ace/git/atoms/service_pr_input"
-require_relative "grant_resolver"
-require_relative "caller_authorizer"
-require_relative "service_policy"
-require_relative "../atoms/protected_workspace_prune_input"
-require_relative "../atoms/protected_publication_input"
-
-module Ace
-  module Lab
-    module Molecules
-      # The receiver and authority share the existing input/policy owners.
-      # Only composition supplies collaborators; no wire-selected policy,
-      # executable, input path or caller identity is accepted here.
-      class ProtectedServicePolicy
-        def initialize(proposal_resolver:, document_loader: nil, cleanup_owner: nil)
-          @proposal_resolver = proposal_resolver
-          @cleanup_owner = cleanup_owner
-          @document_loader = document_loader || -> { GrantResolver.trusted_document(Ace::Lab.authorization_path) }
-        end
-
-        def input_binding(bytes, expected_digest:, expected_target:, operation:)
-          unless bytes.is_a?(String) && bytes.bytesize.between?(1, Atoms::ServiceInput::MAX_BYTES)
-            raise ArgumentError, "structured service input exceeds its fixed limit"
-          end
-          input = if operation == "prune-preserved-workspace"
-            Atoms::ProtectedWorkspacePruneInput.parse(bytes)
-          elsif operation == "publish"
-            Atoms::ProtectedPublicationInput.decode!(bytes)
-          else
-            JSON.parse(bytes)
-          end
-          raise ArgumentError, "structured service input must be an object" unless input.is_a?(Hash)
-          Atoms::ServiceInput.validate!(input)
-          if Ace::Git::Atoms::ServicePrInput::OPERATIONS.include?(operation)
-            Ace::Git::Atoms::ServicePrInput.validate(input, operation: operation)
-          end
-          digest = Atoms::ServiceInput.digest(input)
-          target = Atoms::ServiceInput.target(input)
-          unless digest == expected_digest && target == expected_target
-            raise SecurityError, "structured service input differs from the bound digest or target"
-          end
-          deep_freeze(input: input, input_digest: digest, target: target)
-        rescue JSON::ParserError
-          raise ArgumentError, "structured service input must be valid JSON"
-        end
-
-        def prepare!(binding, input_bytes:)
-          input = input_binding(input_bytes, expected_digest: binding.fetch("input_digest"),
-            expected_target: binding.fetch("target"), operation: binding.fetch("operation"))
-          if binding["operation"] == "publish" && input.fetch(:input).dig("publication", "head") != binding.fetch("candidate_head")
-            raise SecurityError, "publication input head differs from admitted candidate"
-          end
-          authorized = authorize!(binding)
-          canonical = snapshot(binding).merge("executor_uid" => authorized.fetch(:operation).fetch("executor_uid"), "transport" => "unix")
-          deep_freeze(authorized.merge(binding: canonical, input: input.fetch(:input)))
-        end
-
-        # Selected by installed composition, independently of receiver fields.
-        # Ordinary services never acquire this domain-specific root capability.
-        def dispatch_owner_binding!(binding)
-          return nil unless binding.fetch("operation") == "prune-preserved-workspace"
-          unless @cleanup_owner
-            raise SecurityError, "fixed cleanup owner composition is unavailable"
-          end
-          @cleanup_owner.identity!
-        end
-
-        # Called again inside each claim/begin CAS retry using the immutable
-        # binding and ephemeral parsed input, never a caller filesystem path.
-        def authorize!(binding)
-          uid = binding.fetch("caller_uid")
-          document = visible_document!(project: binding.fetch("project_id"), uid: uid)
-          resolver = ->(reference, exact) { @proposal_resolver.call(binding.fetch("project_id"), reference, exact) }
-          policy = ServicePolicy.new(document, resolver)
-          operation = policy.operation!(binding.fetch("operation"), project: binding.fetch("project_id"), service_id: binding.fetch("service_id"))
-          unless operation.fetch("transport", "local") == "local"
-            raise Ace::Lab::InvalidConfigurationError, "protected receiver requires a fixed local handler operation"
-          end
-          unless operation.fetch("executor_uid").positive? && operation.fetch("executor_uid") != uid
-            raise SecurityError, "protected executor must be a separate nonroot account"
-          end
-          if binding.key?("executor_uid") && binding["executor_uid"] != operation.fetch("executor_uid")
-            raise SecurityError, "configured executor differs from the recorded claim"
-          end
-          decision = policy.authorize!(binding.fetch("authorization"), binding)
-          digest = Ace::Assign::Atoms::EvidenceDigest.digest("operation" => operation, "authorization" => decision,
-            "caller_uid" => uid, "project_id" => binding.fetch("project_id"))
-          if binding.key?("policy_digest") && binding["policy_digest"] != digest
-            raise SecurityError, "service policy changed after claim"
-          end
-          deep_freeze(operation: snapshot(operation), policy_digest: digest,
-            operation_digest: Ace::Assign::Atoms::EvidenceDigest.digest(operation))
-        end
-
-        # Read-only selection of the installed named cleanup receiver; no
-        # proposal authorization or effect capability is minted by preview.
-        def workspace_prune_receiver!(project:, uid:, service_id:, executor_uid:)
-          document = visible_document!(project: project, uid: uid)
-          policy = ServicePolicy.new(document, ->(*) { raise SecurityError, "preview cannot resolve proposal grants" })
-          operation = policy.operation!("prune-preserved-workspace", project: project, service_id: service_id)
-          unless operation.fetch("executor_uid") == executor_uid && executor_uid.is_a?(Integer) && executor_uid.positive? && executor_uid != uid
-            raise SecurityError, "preview receiver differs from the installed cleanup operation"
-          end
-          true
-        end
-
-        def visible!(project:, uid:)
-          visible_document!(project: project, uid: uid)
-          true
-        end
-
-        def authorize_update!(existing, replacement, _pending)
-          initial_effect = existing.nil? && %w[accepted uncertain].include?(replacement["state"])
-          fresh_dispatch = existing && existing["dispatch_phase"] == "issued" && replacement["dispatch_phase"] == "dispatch_started"
-          authorize!(replacement) if initial_effect || fresh_dispatch
-          true
-        end
-
-        private
-
-        def visible_document!(project:, uid:)
-          raise SecurityError, "protected caller UID is invalid" unless uid.is_a?(Integer) && uid.positive?
-          username = begin
-            Etc.getpwuid(uid).name
-          rescue ArgumentError
-            nil
-          end
-          document = @document_loader.call
-          identities = CallerAuthorizer.matchable_identities(username, uid)
-          visibility = CallerAuthorizer.new(principals: document.fetch("principals", {}), identity: identities)
-          raise SecurityError, "caller project grant has been revoked" unless visibility.authorized?(project)
-          document
-        end
-
-        def snapshot(value)
-          JSON.parse(JSON.generate(value))
-        end
-
-        def deep_freeze(value)
-          case value
-          when Hash then value.each { |key, item| deep_freeze(key); deep_freeze(item) }
-          when Array then value.each { |item| deep_freeze(item) }
-          end
-          value.freeze
-        end
-      end
-    end
-  end
-end

data/lib/ace/lab/molecules/service_executor.rb

@@ -1,99 +0,0 @@
-# frozen_string_literal: true
-
-require "json"
-require "ace/herdr/molecules/bounded_process"
-require "socket"
-require "timeout"
-require "time"
-
-module Ace
-  module Lab
-    module Molecules
-      # Executes one fixed, deployment-configured argv under its OS account.
-      # Domain handlers receive structured JSON on stdin and return a small
-      # receipt; their stdout/stderr are never journaled or returned to callers.
-      class ServiceExecutor
-        # The trusted policy is reloaded through +policy_loader+ immediately
-        # before the effect: a revocation or operation change after the claim
-        # must still stop dispatch. The candidate head is revalidated through
-        # +head_loader+ for the same reason: a concurrent commit must not let
-        # a stale reviewed candidate execute.
-        def execute(operation:, request:, input:, policy_loader:, authorization:, head_loader:)
-          fresh = policy_loader.call
-          current = fresh.operation!(request.fetch("operation"), project: request.fetch("project_id"),
-            service_id: request.fetch("service_id"))
-          raise SecurityError, "executor operation changed before dispatch" unless current == operation
-          fresh.authorize!(authorization, request)
-          unless head_loader.call == request.fetch("candidate_head")
-            raise SecurityError, "candidate head changed before dispatch"
-          end
-          if Time.iso8601(current.fetch("lease_expires_at")) <= Time.now.utc
-            raise SecurityError, "executor lease has expired"
-          end
-          out = if operation.fetch("transport", "local") == "unix"
-            invoke_unix(operation, request, input)
-          else
-            invoke_local(operation, request, input)
-          end
-          return nil unless out && out.bytesize <= 16 * 1024
-          response = JSON.parse(out)
-          return nil unless valid_response?(response, request)
-          {"outcome" => response.fetch("outcome"), "evidence" => response.fetch("evidence"),
-           "executor_uid" => current.fetch("executor_uid")}
-        rescue JSON::ParserError, Timeout::Error, SystemCallError, IOError,
-          Ace::Herdr::Molecules::BoundedProcess::PostLaunchError
-          # Transport failures after the claim (broken pipe, connection
-          # reset, socket loss) leave the effect unknown: uncertainty, not a
-          # classified crash, is the honest outcome.
-          nil
-        end
-
-        private
-
-        # The existing process owner bounds both streams and the whole run,
-        # and cleans the owned process group on timeout and normal exit.
-        def invoke_local(operation, request, input)
-          unless Process.uid == operation.fetch("executor_uid") && Process.euid == operation.fetch("executor_uid")
-            raise SecurityError, "current OS identity is not the configured executor"
-          end
-          result = Ace::Herdr::Molecules::BoundedProcess.call(operation.fetch("argv"),
-            stdin_data: JSON.generate({"request" => request, "input" => input}),
-            timeout_s: 30, output_limit: 16 * 1024, stderr_limit: 8192, cleanup_group: true)
-          result.stdout if result.status.success? && !result.oversized
-        end
-
-        def invoke_unix(operation, request, input)
-          path = operation.fetch("socket_path")
-          stat = File.lstat(path)
-          unless stat.socket? && stat.uid == operation.fetch("executor_uid") && (stat.mode & 0o002).zero?
-            raise SecurityError, "service socket owner or permissions do not match the executor"
-          end
-          # One deadline covers connecting, writing, and reading: a stalled
-          # peer must leave the claimed effect uncertain, never block.
-          Timeout.timeout(30) do
-            UNIXSocket.open(path) do |socket|
-              peer_uid, = socket.getpeereid
-              raise SecurityError, "service peer identity does not match the executor" unless peer_uid == stat.uid
-              socket.write(JSON.generate({"request" => request, "input" => input}) + "\n")
-              socket.flush
-              socket.gets(16 * 1024 + 1)
-            end
-          end
-        end
-
-        def valid_response?(response, request)
-          response.is_a?(Hash) && response.keys.sort == %w[evidence input_digest outcome request_id] &&
-            response["request_id"] == request["request_id"] &&
-            response["input_digest"] == request["input_digest"] &&
-            %w[succeeded failed].include?(response["outcome"]) &&
-            response["evidence"].is_a?(Array) && !response["evidence"].empty? &&
-            response["evidence"].all? do |item|
-              item.is_a?(Hash) && item.keys.sort == %w[ref sha256] &&
-                item["ref"].is_a?(String) && item["ref"].match?(/\A[a-zA-Z0-9_.:\/-]{1,256}\z/) &&
-                item["sha256"].is_a?(String) && item["sha256"].match?(/\A[0-9a-f]{64}\z/)
-            end
-        end
-      end
-    end
-  end
-end