vaultkit 0.1.0

data/lib/vkit/core/auth_client.rb

@@ -0,0 +1,104 @@
+require "net/http"
+require "uri"
+require "json"
+require "openssl"
+
+module Vkit
+  module Core
+    class AuthClient
+      DEFAULT_BASE_URL = ENV["VKIT_ENDPOINT"] || "http://localhost:3000"
+
+      def initialize(base_url: DEFAULT_BASE_URL)
+        @base_url = base_url.chomp("/")
+      end
+
+      def discover
+        uri = uri_for("/auth/cli")
+        res = http_get(uri)
+        parse_json(res)
+      end
+
+      def start_cli_login
+        uri = uri_for("/auth/cli/start")
+        req = Net::HTTP::Post.new(uri)
+        req["Content-Type"] = "application/json"
+        req.body = "{}"
+
+        res = http_request(uri, req)
+        parse_json(res)
+      end
+
+      def poll_cli_login(poll_token)
+        uri = uri_for("/auth/cli/poll?token=#{poll_token}")
+        req = Net::HTTP::Get.new(uri)
+
+        http_request(uri, req, allow_non_200: true)
+      end
+
+      def password_login(email:, password:)
+        uri = uri_for("/api/users/sign_in")
+        req = Net::HTTP::Post.new(uri)
+        req["Content-Type"] = "application/json"
+        req.body = JSON.dump(
+          user: {
+            email: email,
+            password: password
+          }
+        )
+
+        res = http_request(uri, req)
+        body = parse_json(res)
+
+        {
+          token: body["token"],
+          user: body["user"]
+        }
+      end
+
+      def whoami(token)
+        uri = uri_for("/auth/whoami")
+        req = Net::HTTP::Get.new(uri)
+        req["Authorization"] = "Bearer #{token}"
+
+        res = http_request(uri, req)
+        body = parse_json(res)
+
+        body["user"]
+      end
+
+      private
+
+      def uri_for(path)
+        URI("#{@base_url}#{path}")
+      end
+
+      def http_get(uri)
+        req = Net::HTTP::Get.new(uri)
+        http_request(uri, req)
+      end
+
+      def http_request(uri, req, allow_non_200: false)
+        http = Net::HTTP.new(uri.host, uri.port)
+        http.use_ssl = uri.scheme == "https"
+        http.verify_mode = OpenSSL::SSL::VERIFY_NONE
+
+        res = http.request(req)
+
+        return res if allow_non_200
+
+        unless res.is_a?(Net::HTTPSuccess)
+          raise "HTTP #{res.code}: #{res.body}"
+        end
+
+        res
+      end
+
+      def parse_json(res)
+        JSON.parse(res.body)
+      rescue JSON::ParserError
+        raise "Invalid JSON response from server"
+      end
+    end
+  end
+end
+

data/lib/vkit/core/credential_resolver.rb

@@ -0,0 +1,37 @@
+require_relative "providers/vaultkit_provider"
+
+module Vkit
+  module Core
+    class CredentialResolver
+      def initialize(datasource_store: DatasourceStore.new)
+        @store = datasource_store
+      end
+
+      # Main entry point
+      def resolve(datasource_id)
+        ds = @store.fetch(datasource_id)
+        raise "Unknown datasource: #{datasource_id}" unless ds
+
+        provider = provider_for(ds[:provider] || "vaultkit")
+        provider.resolve(ds)
+      end
+
+      private
+
+      def provider_for(name)
+        case name
+        when "vaultkit"
+          Providers::VaultKitProvider.new
+        when "aws"
+          Providers::AwsSecretsProvider.new
+        when "gcp"
+          Providers::GcpSecretManagerProvider.new
+        when "azure"
+          Providers::AzureKeyVaultProvider.new
+        else
+          raise "Unknown credential provider: #{name}"
+        end
+      end
+    end
+  end
+end

data/lib/vkit/core/credential_store.rb

@@ -0,0 +1,186 @@
+require "json"
+require "fileutils"
+require "open3"
+require "rbconfig"
+
+module Vkit
+  module Core
+    class CredentialStore
+      SERVICE = "vkit"
+      ACCOUNT = "credentials"
+
+      def initialize
+        @os = RbConfig::CONFIG["host_os"]
+        @fallback_path = File.join(Dir.home, ".vkit", "credentials.json")
+      end
+
+      def save(endpoint:, token:, user:)
+        payload = {
+          "endpoint" => endpoint,
+          "token" => token,
+          "user" => user
+        }
+
+        case
+        when mac?
+          mac_keychain_store(payload)
+        when linux? && secret_tool_available?
+          linux_secret_service_store(payload)
+        else
+          file_store(payload)
+        end
+
+        true
+      end
+
+      def endpoint
+        load_payload&.dig("endpoint")
+      end
+
+      def token
+        load_payload&.dig("token")
+      end
+
+      def user
+        load_payload&.dig("user")
+      end
+
+      def logged_in?
+        !!(endpoint && token)
+      end
+
+      def clear!
+        case
+        when mac?
+          mac_keychain_delete
+        when linux? && secret_tool_available?
+          linux_secret_service_delete
+        else
+          file_delete
+        end
+      end
+
+      def clear_token!
+        payload = load_payload
+        return unless payload
+      
+        payload.delete("token")
+      
+        case
+        when mac?
+          mac_keychain_store(payload)
+        when linux? && secret_tool_available?
+          linux_secret_service_store(payload)
+        else
+          file_store(payload)
+        end
+      end
+
+      def load_payload
+        case
+        when mac?
+          mac_keychain_load
+        when linux? && secret_tool_available?
+          linux_secret_service_load
+        else
+          file_load
+        end
+      end
+
+      def mac?
+        @os =~ /darwin/
+      end
+
+      def linux?
+        @os =~ /linux/
+      end
+
+      def secret_tool_available?
+        system("which secret-tool > /dev/null 2>&1")
+      end
+
+      def mac_keychain_store(payload)
+        mac_keychain_delete
+        system(
+          "security", "add-generic-password",
+          "-a", ACCOUNT,
+          "-s", SERVICE,
+          "-w", payload.to_json,
+          "-U"
+        )
+      end
+
+      def mac_keychain_load
+        stdout, _stderr, status =
+          Open3.capture3(
+            "security", "find-generic-password",
+            "-a", ACCOUNT,
+            "-s", SERVICE,
+            "-w"
+          )
+
+        return nil unless status.success?
+        JSON.parse(stdout)
+      rescue
+        nil
+      end
+
+      def mac_keychain_delete
+        system(
+          "security", "delete-generic-password",
+          "-a", ACCOUNT,
+          "-s", SERVICE,
+          out: File::NULL,
+          err: File::NULL
+        )
+      end
+
+      def linux_secret_service_store(payload)
+        Open3.capture3(
+          "secret-tool",
+          "store",
+          "--label=VaultKit Credentials",
+          "service", SERVICE,
+          "account", ACCOUNT,
+          stdin_data: payload.to_json
+        )
+      end
+
+      def linux_secret_service_load
+        stdout, _stderr, status =
+          Open3.capture3(
+            "secret-tool",
+            "lookup",
+            "service", SERVICE,
+            "account", ACCOUNT
+          )
+
+        return nil unless status.success?
+        JSON.parse(stdout)
+      rescue
+        nil
+      end
+
+      def linux_secret_service_delete
+        linux_secret_service_store({})
+      end
+
+      def file_store(payload)
+        FileUtils.mkdir_p(File.dirname(@fallback_path))
+        File.write(@fallback_path, JSON.pretty_generate(payload))
+        File.chmod(0o600, @fallback_path)
+      end
+
+      def file_load
+        return nil unless File.exist?(@fallback_path)
+        JSON.parse(File.read(@fallback_path))
+      rescue
+        nil
+      end
+
+      def file_delete
+        FileUtils.rm_f(@fallback_path)
+      end
+    end
+  end
+end

data/lib/vkit/core/table_formatter.rb

@@ -0,0 +1,36 @@
+module Vkit
+  module Core
+    class TableFormatter
+      def self.render(rows)
+        return puts "(no rows)" if rows.nil? || rows.empty?
+
+        headers = rows.first.keys
+
+        # Calculate column widths
+        col_widths = headers.map do |h|
+          [h.length, *rows.map { |r| r[h].to_s.length }].max
+        end
+
+        # Builders
+        def self.border(col_widths)
+          "+" + col_widths.map { |w| "-" * (w + 2) }.join("+") + "+"
+        end
+
+        def self.row(values, col_widths)
+          "|" + values.map.with_index { |v, i| " #{v.to_s.ljust(col_widths[i])} " }.join("|") + "|"
+        end
+
+        # Print table
+        puts border(col_widths)
+        puts row(headers, col_widths)
+        puts border(col_widths)
+
+        rows.each do |row|
+          puts row(row.values_at(*headers), col_widths)
+        end
+
+        puts border(col_widths)
+      end
+    end
+  end
+end

data/lib/vkit/policy/bundle_compiler.rb

@@ -0,0 +1,154 @@
+require "json"
+require "yaml"
+require "digest"
+require "time"
+
+module Vkit
+  module Policy
+    class BundleCompiler
+      FORMAT_VERSION = "v1"
+
+      def self.compile!(org_slug:, bundle_version:, policies_dir:, registry_dir:, source: {})
+        policies = load_policies(policies_dir)
+        registry = load_registry(registry_dir)
+
+        bundle = {
+          "bundle" => {
+            "format_version" => FORMAT_VERSION,
+            "org_slug" => org_slug,
+            "bundle_version" => bundle_version,
+            "created_at" => Time.now.utc.iso8601,
+            "source" => normalize_source(source),
+            "checksum" => "" # filled below
+          },
+          "registry" => registry,
+          "policies" => normalize_policies(policies),
+          "signing" => nil
+        }
+
+        canonical = canonical_json(bundle)
+        bundle["bundle"]["checksum"] = Digest::SHA256.hexdigest(canonical)
+
+        bundle
+      end
+
+      # Loading
+      def self.load_policies(dir)
+        files = Dir[File.join(dir, "*.y{a,}ml")].sort
+        raise "No policy files found in #{dir}" if files.empty?
+
+        files.map do |f|
+          data = YAML.load_file(f)
+          raise "Policy file #{f} must be a Hash" unless data.is_a?(Hash)
+          data.merge("__file" => File.basename(f))
+        end
+      end
+
+      def self.load_registry(dir)
+        path = File.join(dir, "registry.yaml")
+        raise "Missing datasets/registry.yaml" unless File.exist?(path)
+
+        raw = YAML.load_file(path)
+        normalize_registry(raw)
+      end
+
+      # Normalization
+      def self.normalize_source(source)
+        { "type" => "git" }.merge(source.transform_keys(&:to_s))
+      end
+
+      def self.normalize_policies(policies)
+        seen = {}
+
+        normalized = policies.map do |p|
+          id = p["id"].to_s.strip
+          raise "Policy id missing in #{p["__file"]}" if id.empty?
+          raise "Duplicate policy id: #{id}" if seen[id]
+          seen[id] = true
+
+          {
+            "id" => id,
+            "description" => p["description"],
+            "match" => p["match"],
+            "when" => p["context"],          # ADAPT authoring → runtime
+            "action" => normalize_action(p["action"]),
+            "reason" => p.dig("action", "reason"),
+            "approval" => extract_approval(p),
+            "masking" => extract_masking(p),
+            "ttl_seconds" => p.dig("action", "ttl"),
+            "priority" => p["priority"]
+          }.compact
+        end
+
+        normalized.sort_by { |p| [-(p["priority"] || 0), p["id"]] }
+      end
+
+      def self.normalize_action(action)
+        return "allow" unless action.is_a?(Hash)
+
+        return "deny" if action["deny"]
+        return "require_approval" if action["require_approval"]
+        return "mask" if action["mask"]
+        "allow"
+      end
+
+      def self.extract_approval(p)
+        return unless p.dig("action", "require_approval")
+        { "approver_role" => p.dig("action", "approver_role") }
+      end
+
+      def self.extract_masking(p)
+        return unless p.dig("action", "mask")
+        p["masking"]
+      end
+
+      def self.normalize_registry(raw)
+        datasets = raw.map do |name, data|
+          {
+            "name" => name.to_s,
+            "datasource" => data["datasource"].to_s,
+            "fields" => normalize_fields(data["fields"] || {})
+          }
+        end
+      
+        datasources =
+          datasets
+            .map { |d| d["datasource"] }
+            .uniq
+            .map { |ds| { "name" => ds, "type" => "postgres", "config" => {} } }
+      
+        {
+          "datasets" => datasets,
+          "datasources" => datasources
+        }
+      end      
+
+      def self.normalize_fields(fields)
+        fields.map do |name, meta|
+          {
+            "name" => name.to_s,
+            "type" => meta["type"],
+            "sensitivity" => meta["sensitivity"].to_s,
+            "tags" => [meta["category"]].compact.map(&:to_s)
+          }
+        end
+      end
+
+      # Canonicalization
+      def self.canonical_json(obj)
+        JSON.generate(sort_keys_deep(obj))
+      end
+
+      def self.sort_keys_deep(value)
+        case value
+        when Hash
+          value.keys.sort.each_with_object({}) { |k, h| h[k] = sort_keys_deep(value[k]) }
+        when Array
+          value.map { |v| sort_keys_deep(v) }
+        else
+          value
+        end
+      end
+    end
+  end
+end