capsium 0.2.0 → 0.3.0

data/lib/capsium/package.rb

@@ -6,58 +6,88 @@ require "tmpdir"
 
 module Capsium
   class Package
+    autoload :Cipher, "capsium/package/cipher"
+    autoload :CircularDependencyError, "capsium/package/dependency_resolver"
+    autoload :Composition, "capsium/package/composition"
+    autoload :Authentication, "capsium/package/authentication"
+    autoload :AuthenticationConfig, "capsium/package/authentication_config"
+    autoload :AuthenticationData, "capsium/package/authentication_config"
+    autoload :BasicAuthConfig, "capsium/package/authentication_config"
     autoload :Dataset, "capsium/package/dataset"
     autoload :DatasetConfig, "capsium/package/storage_config"
+    autoload :DependencyError, "capsium/package/dependency_resolver"
+    autoload :DependencyNotFoundError, "capsium/package/dependency_resolver"
+    autoload :DependencyResolver, "capsium/package/dependency_resolver"
+    autoload :DependencyVisibilityError, "capsium/package/dependency_resolver"
     autoload :DigitalSignatures, "capsium/package/security_config"
+    autoload :EncryptionConfig, "capsium/package/encryption_config"
+    autoload :EncryptionEnvelope, "capsium/package/encryption_config"
     autoload :IntegrityChecks, "capsium/package/security_config"
+    autoload :LayerConfig, "capsium/package/storage_config"
     autoload :Manifest, "capsium/package/manifest"
     autoload :ManifestConfig, "capsium/package/manifest_config"
+    autoload :MergedView, "capsium/package/merged_view"
     autoload :Metadata, "capsium/package/metadata"
     autoload :MetadataData, "capsium/package/metadata_config"
+    autoload :OAuth2Config, "capsium/package/authentication_config"
+    autoload :Preparation, "capsium/package/preparation"
     autoload :Repository, "capsium/package/metadata_config"
+    autoload :ResolvedDependency, "capsium/package/dependency_resolver"
     autoload :Resource, "capsium/package/manifest_config"
+    autoload :ResponseRewrite, "capsium/package/routes_config"
     autoload :Route, "capsium/package/routes_config"
     autoload :Routes, "capsium/package/routes"
     autoload :RoutesConfig, "capsium/package/routes_config"
     autoload :Security, "capsium/package/security"
     autoload :SecurityConfig, "capsium/package/security_config"
     autoload :SecurityData, "capsium/package/security_config"
+    autoload :Signer, "capsium/package/signer"
     autoload :Storage, "capsium/package/storage"
     autoload :StorageConfig, "capsium/package/storage_config"
     autoload :StorageData, "capsium/package/storage_config"
+    autoload :Store, "capsium/package/store"
+    autoload :Testing, "capsium/package/testing"
+    autoload :UnsatisfiableDependencyError, "capsium/package/dependency_resolver"
     autoload :Validator, "capsium/package/validator"
+    autoload :Verification, "capsium/package/verification"
+    autoload :Version, "capsium/package/version"
+    autoload :VersionRange, "capsium/package/version"
+
+    include Verification
+    include Composition
+    include Preparation
 
     attr_reader :name, :path, :manifest, :metadata, :routes, :storage,
-                :security, :load_type
+                :security, :load_type, :resolved_dependencies, :authentication
 
     MANIFEST_FILE = "manifest.json"
     METADATA_FILE = "metadata.json"
     STORAGE_FILE = "storage.json"
     ROUTES_FILE = "routes.json"
     SECURITY_FILE = "security.json"
+    SIGNATURE_FILE = "signature.sig"
+    AUTHENTICATION_FILE = "authentication.json"
     CONTENT_DIR = "content"
     DATA_DIR = "data"
 
-    def initialize(path, load_type: nil)
+    # Loads a package directory or .cap file. Composite packages
+    # (metadata.dependencies, ARCHITECTURE.md section 4a) resolve against
+    # the package store given as `store` (directory path or Store) or via
+    # CAPSIUM_STORE. `dependency_chain` is internal: the ancestor GUIDs
+    # used for circular-dependency detection during recursive resolution.
+    def initialize(path, load_type: nil, decryption_key: nil, store: nil,
+                   dependency_chain: [])
+      @decryption_key = decryption_key
       @original_path = Pathname.new(path).expand_path
       @path = prepare_package(@original_path).to_s
       @load_type = load_type || determine_load_type(path)
       create_package_structure
       load_package
       @name = metadata.name
+      @resolved_dependencies = resolve_dependencies(store, dependency_chain)
+      validate_dependency_references!
       verify_integrity!
-    end
-
-    def prepare_package(path)
-      return path if File.directory?(path)
-
-      if File.file?(path)
-        return decompress_cap_file(path) if File.extname(path) == ".cap"
-
-        raise Error, "The package must have a .cap extension"
-      end
-
-      raise Error, "Invalid package path: #{path}"
+      verify_signature!
     end
 
     def solidify
@@ -67,13 +97,6 @@ module Capsium
       @storage.save_to_file unless @storage.empty?
     end
 
-    def decompress_cap_file(file_path)
-      package_path = File.join(Dir.mktmpdir, package_stem(file_path))
-      FileUtils.mkdir_p(package_path)
-      Packager.new.unpack(file_path, package_path)
-      package_path
-    end
-
     def load_package
       # Mandatory
       @metadata = Metadata.new(metadata_path)
@@ -83,16 +106,25 @@ module Capsium
       @storage = Storage.new(storage_path)
       @routes = Routes.new(routes_path, @manifest, @storage)
       @security = Security.new(security_path)
+      @authentication = Authentication.new(authentication_path)
     end
 
     def cleanup
-      return unless @path != @original_path.to_s && File.directory?(@path)
-
-      FileUtils.remove_entry(@path)
+      @resolved_dependencies.each { |dependency| dependency.package.cleanup }
+      FileUtils.remove_entry(@path) if @path != @original_path.to_s && File.directory?(@path)
     end
 
-    def datasets
-      storage.datasets
+    def datasets = storage.datasets
+
+    # The merged content view across the storage layers (ARCHITECTURE.md
+    # section 5a); exported_only gives the dependent-package view (section 4a).
+    # Resolved dependencies act as read-only layers below all own layers.
+    def merged_view(exported_only: false)
+      @merged_views ||= {}
+      @merged_views[exported_only] ||=
+        MergedView.new(@path, storage: @storage, manifest: @manifest,
+                              dependency_views: dependency_views,
+                              exported_only: exported_only)
     end
 
     # The .cap file this package was loaded from, or nil when loaded
@@ -102,55 +134,7 @@ module Capsium
     end
 
     def content_files
-      Dir.glob(File.join(content_path, "**", "*")).select do |file|
-        File.file?(file)
-      end
-    end
-
-    def determine_load_type(path)
-      return :directory if File.directory?(path)
-      return :cap_file if File.extname(path) == ".cap"
-
-      :unsaved
-    end
-
-    # Verifies the package against security.json (ARCHITECTURE.md section
-    # 6). Returns a list of typed errors; empty when no security.json is
-    # present or all checksums match.
-    def verify_integrity
-      return [] unless @security.present?
-
-      @security.verify(@path)
+      Dir.glob(File.join(content_path, "**", "*")).select { |file| File.file?(file) }
     end
-
-    def verify_integrity!
-      @security.verify!(@path) if @security.present?
-    end
-
-    private
-
-    def package_stem(file_path)
-      File.basename(file_path, ".cap")
-    end
-
-    def create_package_structure
-      FileUtils.mkdir_p(@path)
-      FileUtils.mkdir_p(content_path)
-      FileUtils.mkdir_p(data_path)
-    end
-
-    def content_path = File.join(@path, CONTENT_DIR)
-
-    def data_path = File.join(@path, DATA_DIR)
-
-    def routes_path = File.join(@path, ROUTES_FILE)
-
-    def storage_path = File.join(@path, STORAGE_FILE)
-
-    def metadata_path = File.join(@path, METADATA_FILE)
-
-    def manifest_path = File.join(@path, MANIFEST_FILE)
-
-    def security_path = File.join(@path, SECURITY_FILE)
   end
 end

data/lib/capsium/packager.rb

@@ -33,7 +33,7 @@ module Capsium
 
       Dir.mktmpdir do |dir|
         FileUtils.cp_r("#{directory}/.", dir)
-        FileUtils.rm_f(File.join(dir, Package::SECURITY_FILE))
+        strip_security_artifacts(dir)
         new_package = Package.new(dir)
         new_package.solidify
         generate_security(new_package)
@@ -68,6 +68,31 @@ module Capsium
       end
     end
 
+    # Unpacks a .cap into a temporary directory, yields it for read-only
+    # inspection and returns the block's value.
+    def with_unpacked_cap(cap_path)
+      Dir.mktmpdir do |dir|
+        unpack(cap_path, dir)
+        yield dir
+      end
+    end
+
+    # Unpacks a .cap into a temporary directory, yields it for
+    # modification, then recompresses the result back over cap_path.
+    # The modified package is loaded (verifying integrity and any
+    # declared signature) before recompressing.
+    def transform_cap(cap_path)
+      with_unpacked_cap(cap_path) do |dir|
+        yield dir
+        Dir.mktmpdir do |tmp|
+          tmp_cap = File.join(tmp, File.basename(cap_path))
+          compress_package(Package.new(dir), tmp_cap)
+          FileUtils.mv(tmp_cap, cap_path)
+        end
+      end
+      cap_path
+    end
+
     def relative_path_current(absolute_path)
       Pathname.new(absolute_path).relative_path_from(Dir.pwd).to_s
     end
@@ -94,5 +119,13 @@ module Capsium
       security = Package::Security.generate(package.path)
       security.save_to_file
     end
+
+    # security.json is regenerated on pack; signing artifacts are dropped
+    # because signing is a post-pack step (`capsium package sign`).
+    def strip_security_artifacts(directory)
+      FileUtils.rm_f(File.join(directory, Package::SECURITY_FILE))
+      FileUtils.rm_f(File.join(directory, Package::SIGNATURE_FILE))
+      FileUtils.rm_f(File.join(directory, Package::Signer::PUBLIC_KEY_FILE))
+    end
   end
 end

data/lib/capsium/reactor/authenticator.rb

@@ -0,0 +1,180 @@
+# frozen_string_literal: true
+
+require "base64"
+
+module Capsium
+  class Reactor
+    # Request authentication and route authorization for the reactor
+    # (05x-authentication, ARCHITECTURE.md section 4b).
+    #
+    # When the package's authentication.json enables basicAuth, every
+    # route is challenged (401 + WWW-Authenticate) until valid htpasswd
+    # credentials arrive. When oauth2 is enabled, the login and callback
+    # endpoints run the authorization-code flow and establish a signed
+    # session cookie. Route-level accessControl is enforced after
+    # authentication: 401 when unauthenticated, 403 when the identity
+    # lacks a required role.
+    class Authenticator
+      LOGIN_PATH = "/auth/login"
+
+      attr_reader :authentication, :deploy
+
+      def initialize(authentication, deploy:, package_path:, base_url: nil,
+                     state_file: nil)
+        @authentication = authentication
+        @deploy = deploy
+        @package_path = package_path
+        @base_url = base_url
+        @state_file = state_file
+        build_oauth2_flow if oauth2_enabled?
+      end
+
+      def enabled?
+        @authentication.enabled?
+      end
+
+      # The paths this authenticator answers itself (OAuth2 login and
+      # callback), mounted by the reactor.
+      def endpoints
+        oauth2_enabled? ? [LOGIN_PATH, @authentication.oauth2.redirect_path] : []
+      end
+
+      def endpoint?(path)
+        endpoints.include?(path)
+      end
+
+      def serve_endpoint(request, response)
+        if request.path == LOGIN_PATH
+          response.status = 302
+          response["Location"] = @oauth2_flow.authorization_url(request)
+          response.body = "Redirecting to the identity provider"
+        else
+          handle_callback(request, response)
+        end
+      end
+
+      # The identity for a request — from the session cookie or Basic
+      # credentials — or nil. An identity always carries "roles"
+      # (possibly empty).
+      def authenticate(request)
+        identity = @session&.identity_from(request)
+        identity || authenticate_basic(request)
+      end
+
+      # 401, with a Basic challenge when basicAuth is enabled.
+      def challenge(response)
+        response.status = 401
+        response["Content-Type"] = "text/plain"
+        response["WWW-Authenticate"] = %(Basic realm="#{realm}") if basic_enabled?
+        response.body = "Unauthorized"
+      end
+
+      # :ok, :unauthenticated or :forbidden for a route's accessControl
+      # ({"roles": [...], "authenticationRequired": bool}).
+      def authorize(identity, access_control)
+        return :ok unless access_control
+        return :unauthenticated if unauthenticated?(identity, access_control)
+        return :forbidden unless roles_allowed?(identity, access_control["roles"])
+
+        :ok
+      end
+
+      private
+
+      def unauthenticated?(identity, access_control)
+        access_control.fetch("authenticationRequired", true) && identity.nil?
+      end
+
+      def roles_allowed?(identity, roles)
+        return true if roles.nil? || roles.empty?
+        return false if identity.nil?
+
+        roles.intersect?(identity["roles"])
+      end
+
+      def basic_enabled? = !!@authentication.basic_auth&.enabled?
+
+      def oauth2_enabled? = !!@authentication.oauth2&.enabled?
+
+      def realm = @authentication.basic_auth&.realm || "capsium"
+
+      def authenticate_basic(request)
+        return unless basic_enabled?
+
+        credentials = basic_credentials(request["Authorization"])
+        return unless credentials
+
+        username, password = credentials
+        return unless htpasswd.verify?(username, password)
+
+        { "name" => username, "roles" => Array(@deploy.roles[username]) }
+      end
+
+      def basic_credentials(header)
+        return unless header&.start_with?("Basic ")
+
+        Base64.decode64(header.delete_prefix("Basic ")).split(":", 2)
+      rescue ArgumentError
+        nil
+      end
+
+      def htpasswd
+        @htpasswd ||= Htpasswd.new(htpasswd_path)
+      end
+
+      # deploy.json's basicAuth.passwdFile overrides the package's
+      # (reactor-side secret storage); the package's passwdFile is
+      # package-relative otherwise.
+      def htpasswd_path
+        @deploy.passwd_file ||
+          File.join(@package_path, @authentication.basic_auth.passwd_file.to_s)
+      end
+
+      def build_oauth2_flow
+        secret = @deploy.client_secret
+        if secret.nil? || secret.empty?
+          raise Error,
+                "oauth2 is enabled but no clientSecret is configured " \
+                "(deploy.json or CAPSIUM_DEPLOY; never in the package)"
+        end
+
+        @session = Session.new(secret: @deploy.session_secret,
+                               state_file: @state_file)
+        @oauth2_flow = OAuth2.new(@authentication.oauth2, client_secret: secret,
+                                                          session: @session,
+                                                          base_url: @base_url)
+      end
+
+      def handle_callback(request, response)
+        query = request.query
+        return respond_invalid_state(response) unless @oauth2_flow.valid_state?(query["state"])
+
+        userinfo = @oauth2_flow.complete(query["code"], request)
+        response.status = 302
+        response["Location"] = "/"
+        response["Set-Cookie"] = @session.cookie_for(identity_from(userinfo))
+        response.body = "Authenticated"
+      rescue OAuth2::FlowError => e
+        response.status = 502
+        response["Content-Type"] = "text/plain"
+        response.body = "OAuth2 provider error: #{e.message}"
+      end
+
+      def respond_invalid_state(response)
+        response.status = 401
+        response["Content-Type"] = "text/plain"
+        response.body = "Invalid OAuth2 state"
+      end
+
+      def identity_from(userinfo)
+        name = userinfo["email"] || userinfo["sub"] || userinfo["name"]
+        {
+          "sub" => userinfo["sub"] || userinfo["id"],
+          "email" => userinfo["email"],
+          "name" => userinfo["name"],
+          "roles" => Array(userinfo["roles"]) | Array(@deploy.roles[name])
+        }.compact
+      end
+    end
+  end
+end

data/lib/capsium/reactor/deploy.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+require "json"
+
+module Capsium
+  class Reactor
+    # Reactor-side deployment configuration (deploy.json): everything
+    # that must NOT ship in the package — OAuth2 client secrets, the
+    # session signing secret, role assignments, an alternate htpasswd
+    # file, the public base URL. Shape:
+    #
+    #   {
+    #     "baseUrl": "http://localhost:8864",
+    #     "authentication": {
+    #       "basicAuth": { "passwdFile": "/secure/.htpasswd" },
+    #       "oauth2": { "clientSecret": "..." },
+    #       "sessionSecret": "...",
+    #       "roles": { "alice": ["admin"] }
+    #     }
+    #   }
+    #
+    # Loaded from an explicit path, an already-parsed Hash, or the
+    # CAPSIUM_DEPLOY environment variable; empty when unconfigured.
+    class Deploy
+      FILE = "deploy.json"
+      ENV_VAR = "CAPSIUM_DEPLOY"
+
+      attr_reader :config
+
+      def self.load(source)
+        return new(source) if source.is_a?(Hash)
+
+        path = source || ENV.fetch(ENV_VAR, nil)
+        return new({}) if path.nil? || path.to_s.empty?
+        raise Error, "deploy configuration not found: #{path}" unless File.file?(path)
+
+        new(JSON.parse(File.read(path)))
+      end
+
+      def initialize(config)
+        @config = config
+      end
+
+      def authentication
+        config["authentication"] || {}
+      end
+
+      def base_url
+        config["baseUrl"]
+      end
+
+      def client_secret
+        authentication.dig("oauth2", "clientSecret")
+      end
+
+      def session_secret
+        authentication["sessionSecret"]
+      end
+
+      def passwd_file
+        authentication.dig("basicAuth", "passwdFile")
+      end
+
+      # Role assignments keyed by identity name (basic-auth username,
+      # OAuth2 email or subject): {"alice": ["admin", "user"]}.
+      def roles
+        authentication["roles"] || {}
+      end
+    end
+  end
+end

data/lib/capsium/reactor/htpasswd.rb

@@ -0,0 +1,154 @@
+# frozen_string_literal: true
+
+require "base64"
+require "bcrypt"
+require "digest"
+require "openssl"
+
+module Capsium
+  class Reactor
+    # Apache htpasswd verification (05x-authentication). Supported hash
+    # formats:
+    # - bcrypt ($2a$/$2b$/$2y$, `htpasswd -B`) via the bcrypt gem
+    # - Apache apr1 MD5 ($apr1$, `htpasswd -m`) and md5-crypt ($1$),
+    #   pure-Ruby md5-crypt
+    # - unsalted SHA-1 ({SHA}, `htpasswd -s`)
+    # - anything else (DES, $5$/$6$) via the platform's crypt(3) —
+    #   support depends on the OS
+    class Htpasswd
+      # md5-crypt as deployed by Apache htpasswd, OpenSSL and glibc
+      # ($1$ and $apr1$ magics; identical except for the magic string).
+      # NOTE: Poul-Henning Kamp's original FreeBSD implementation mixed
+      # the magic in at the % 7 step where all deployed implementations
+      # mix in the password (see apr_md5.c, glibc crypt-md5.c).
+      module Md5Crypt
+        ITOA64 = "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
+        DIGEST_GROUPS = [[0, 6, 12], [1, 7, 13], [2, 8, 14], [3, 9, 15], [4, 10, 5]].freeze
+
+        def self.verify(hash, password)
+          _prefix, magic, salt, = hash.split("$", 4)
+          return false if salt.nil? || salt.empty?
+
+          Reactor.secure_compare(digest(password, salt, "$#{magic}$"), hash)
+        end
+
+        def self.digest(password, salt, magic)
+          final = initial_digest(password, salt, magic)
+          1000.times do |i|
+            final = stretch_digest(i, password, salt, final)
+          end
+          "#{magic}#{salt}$#{to64(final)}"
+        end
+
+        def self.initial_digest(password, salt, magic)
+          inner = Digest::MD5.digest(password + salt + password)
+          context = Digest::MD5.new
+          context << password << magic << salt
+          length = password.length
+          while length.positive?
+            context << inner[0, [16, length].min]
+            length -= 16
+          end
+          length = password.length
+          while length.positive?
+            context << (length.odd? ? "\0" : password[0])
+            length >>= 1
+          end
+          context.digest
+        end
+
+        def self.stretch_digest(iteration, password, salt, final)
+          context = Digest::MD5.new
+          context << (iteration.odd? ? password : final)
+          context << salt unless (iteration % 3).zero?
+          context << password unless (iteration % 7).zero?
+          context << (iteration.odd? ? final : password)
+          context.digest
+        end
+
+        # The custom base-64 of md5-crypt: digest triples permuted, first
+        # index to the high bits, 22 characters total.
+        def self.to64(final)
+          encoded = +""
+          DIGEST_GROUPS.each do |a, b, c|
+            value = final[c].ord | (final[b].ord << 8) | (final[a].ord << 16)
+            4.times do
+              encoded << ITOA64[value & 0x3f]
+              value >>= 6
+            end
+          end
+          value = final[11].ord
+          2.times do
+            encoded << ITOA64[value & 0x3f]
+            value >>= 6
+          end
+          encoded
+        end
+      end
+
+      attr_reader :path
+
+      def initialize(path)
+        raise Error, "htpasswd file not found: #{path}" unless File.file?(path)
+
+        @path = path
+        @entries = parse(path)
+      end
+
+      def usernames
+        @entries.keys
+      end
+
+      def verify?(username, password)
+        hash = @entries[username]
+        return false unless hash
+
+        verify_hash(hash, password)
+      end
+
+      private
+
+      def parse(path)
+        File.readlines(path, chomp: true).each_with_object({}) do |line, entries|
+          next if line.strip.empty? || line.start_with?("#")
+
+          username, hash = line.split(":", 2)
+          entries[username] = hash
+        end
+      end
+
+      def verify_hash(hash, password)
+        case hash
+        when /\A\$2[aby]\$/ then verify_bcrypt(hash, password)
+        when /\A\$(?:apr1|1)\$/ then Md5Crypt.verify(hash, password)
+        when /\A\{SHA\}/ then verify_sha1(hash, password)
+        else verify_crypt(hash, password)
+        end
+      end
+
+      # The bcrypt gem predates htpasswd's $2y$ tag; the variants are
+      # algorithmically identical, normalized here.
+      def verify_bcrypt(hash, password)
+        BCrypt::Password.new(hash.sub(/\A\$2y\$/, "$2a$")) == password
+      rescue BCrypt::Errors::InvalidHash
+        false
+      end
+
+      def verify_sha1(hash, password)
+        digest = "{SHA}#{Base64.strict_encode64(Digest::SHA1.digest(password))}"
+        Reactor.secure_compare(digest, hash)
+      end
+
+      def verify_crypt(hash, password)
+        computed = password.crypt(hash)
+        computed && Reactor.secure_compare(computed, hash)
+      end
+    end
+
+    # Constant-time string comparison (length-check first).
+    def self.secure_compare(own, theirs)
+      own.bytesize == theirs.bytesize &&
+        OpenSSL.fixed_length_secure_compare(own, theirs)
+    end
+  end
+end

data/lib/capsium/reactor/introspection.rb

@@ -64,8 +64,11 @@ module Capsium
         entry = {
           package: package.name,
           valid: errors.empty?,
-          lastChecked: Time.now.utc.iso8601
+          lastChecked: Time.now.utc.iso8601,
+          signed: package.signed?,
+          encrypted: package.encrypted?
         }
+        entry[:signatureValid] = package.verify_signature if package.signed?
         entry[:reason] = errors.map(&:message).join("; ") unless errors.empty?
         { contentValidity: [entry] }
       end