@atmem/architect 0.0.0-stage → 0.2.0-alpha.4.1

package/src/runtime/enterprise_audit.py

@@ -0,0 +1,91 @@
+"""Append-only private audit: owned identity/trace plus bounded outcome counts.
+
+Never store questions, titles, source/document IDs, snippets, answers or secrets.
+Withheld events must remain recordable after consent/session expiry or withdrawal;
+this writer is not an authorization grant. SQL failure prevents answer release.
+"""
+import hashlib
+from pathlib import Path
+import re
+import uuid
+from psycopg import sql
+from enterprise_identity import CompanyPrincipal
+from enterprise_sources import SourceUnavailable
+
+
+class KnowledgeAudit:
+    def __init__(self, auth, account_id):
+        if not isinstance(account_id, str) or not re.fullmatch(r'[A-Za-z0-9_-]{1,128}', account_id):
+            raise ValueError('Supply the owned company audit domain')
+        self.auth, self.account_id = auth, account_id
+
+    def bind(self, principal, *, query_id=None, attempt=None):
+        if not isinstance(principal, CompanyPrincipal) or principal.account_id != self.account_id:
+            raise ValueError('Audit identity must belong to the owned company')
+        if query_id is not None:
+            if (not isinstance(query_id, str) or str(uuid.UUID(query_id)) != query_id
+                or type(attempt) is not int or not 1 <= attempt <= 3):
+                raise ValueError('Supply the owned canonical question attempt')
+        elif attempt is not None:
+            raise ValueError('Audit attempt requires its question identity')
+        trace = str(uuid.uuid4())
+
+        def record(event):
+            if (not isinstance(event, dict) or set(event) not in (
+                    {'event', 'outcome', 'sources'}, {'event', 'outcome', 'sources', 'documents'})
+                or event['event'] not in {'knowledge.answer', 'knowledge.release'}
+                or event['outcome'] not in ({'answered', 'abstained', 'withheld'} if event['event'] == 'knowledge.answer' else {'released', 'withheld'})
+                or type(event['sources']) is not int or not 1 <= event['sources'] <= 20):
+                raise ValueError('Invalid owned audit event')
+            documents = event.get('documents')
+            if ((documents is not None and (type(documents) is not int or not 0 <= documents <= event['sources'] * 4))
+                or (event['outcome'] != 'withheld' and documents is None)):
+                raise ValueError('Invalid owned audit counts')
+            values = (self.account_id, principal.key, trace, query_id, attempt,
+                      event['event'], event['outcome'], event['sources'], documents)
+            try:
+                with self.auth.transaction() as cursor:
+                    statement = '''INSERT INTO enterprise_audit.events
+                        (account_id,principal_key,trace_id,query_id,attempt,event,outcome,source_count,document_count)
+                        SELECT %s,%s,%s,%s,%s,%s,%s,%s,%s'''
+                    if query_id is not None:
+                        # The trace comes from a known owned question/attempt, not
+                        # an arbitrary event dictionary or model-provided identity.
+                        statement += ''' WHERE EXISTS(SELECT 1 FROM enterprise_queries.requests
+                            WHERE id=%s AND account_id=%s AND principal_key=%s AND attempt>=%s)'''
+                        values += (query_id, self.account_id, principal.key, attempt)
+                    cursor.execute(statement, values)
+                    if cursor.rowcount != 1:
+                        raise ValueError('Audit question binding is no longer available')
+            except Exception:
+                raise SourceUnavailable('knowledge_audit_unavailable') from None
+        return record
+
+
+def initialize_audit(conn):
+    if conn.autocommit:
+        raise ValueError('Use an operator transaction for a fresh audit schema')
+    body = Path(__file__).with_name('enterprise_audit_schema.sql').read_bytes()
+    conn.execute(body.decode())
+    conn.execute('INSERT INTO enterprise_audit.schema_version VALUES(1,%s)', (hashlib.sha256(body).hexdigest(),))
+
+
+def grant_audit_writer(conn, role):
+    if conn.autocommit or not isinstance(role, str) or not re.fullmatch(r'[A-Za-z0-9_.@-]{1,63}', role):
+        raise ValueError('Use an owned nonadministrative role and operator transaction')
+    expected = hashlib.sha256(Path(__file__).with_name('enterprise_audit_schema.sql').read_bytes()).hexdigest()
+    if conn.execute('SELECT version,source_sha256 FROM enterprise_audit.schema_version').fetchone() != (1, expected):
+        raise ValueError('Review the exact fresh audit schema before granting access')
+    flags = conn.execute('SELECT rolsuper,rolcreatedb,rolcreaterole,rolreplication,rolbypassrls,rolcanlogin FROM pg_roles WHERE rolname=%s', (role,)).fetchone()
+    if not flags or any(flags[:5]) or not flags[5] or conn.execute("SELECT has_schema_privilege(%s,'enterprise_audit','CREATE')", (role,)).fetchone()[0]:
+        raise ValueError('Use a nonadministrative role that does not own the audit schema')
+    for table in ['memberships', 'source_mappings', 'company_bindings', 'schema_version']:
+        if conn.execute('SELECT has_table_privilege(%s,%s,%s)', (role, 'enterprise_auth.' + table, 'INSERT,UPDATE,DELETE,TRUNCATE,TRIGGER,REFERENCES')).fetchone()[0]:
+            raise ValueError('Audit runtime must not inherit authority-table write privileges')
+    if conn.execute("SELECT has_table_privilege(%s,'enterprise_audit.events','SELECT,UPDATE,DELETE,TRUNCATE,TRIGGER,REFERENCES')", (role,)).fetchone()[0]:
+        raise ValueError('Audit writer must not inherit history read/change permissions')
+    target = sql.Identifier(role)
+    conn.execute(sql.SQL('GRANT USAGE ON SCHEMA enterprise_audit TO {}').format(target))
+    conn.execute(sql.SQL('GRANT SELECT ON enterprise_audit.schema_version TO {}').format(target))
+    conn.execute(sql.SQL('GRANT INSERT ON enterprise_audit.events TO {}').format(target))
+    conn.execute(sql.SQL('GRANT USAGE ON SEQUENCE enterprise_audit.events_id_seq TO {}').format(target))

package/src/runtime/enterprise_audit_schema.sql

@@ -0,0 +1,25 @@
+-- Fresh owned installation. Runtime can append, but cannot read/rewrite history.
+CREATE SCHEMA enterprise_audit;
+REVOKE ALL ON SCHEMA enterprise_audit FROM PUBLIC;
+CREATE TABLE enterprise_audit.schema_version(
+ version integer PRIMARY KEY CHECK(version=1),source_sha256 text NOT NULL
+);
+CREATE TABLE enterprise_audit.events(
+ id bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+ account_id text NOT NULL,principal_key text NOT NULL CHECK(principal_key ~ '^[0-9a-f]{64}$'),
+ trace_id uuid NOT NULL,query_id uuid,attempt integer CHECK(attempt BETWEEN 1 AND 3),
+ event text NOT NULL CHECK(event IN('knowledge.answer','knowledge.release')),
+ outcome text NOT NULL CHECK(outcome IN('answered','abstained','withheld','released')),
+ source_count integer NOT NULL CHECK(source_count BETWEEN 1 AND 20),
+ document_count integer CHECK(document_count BETWEEN 0 AND 80),
+ created_at timestamptz NOT NULL DEFAULT clock_timestamp(),
+ CHECK((query_id IS NULL)=(attempt IS NULL)),
+ CHECK((event='knowledge.answer' AND outcome IN('answered','abstained','withheld'))
+    OR(event='knowledge.release' AND outcome IN('released','withheld'))),
+ CHECK((outcome='withheld') OR document_count IS NOT NULL),
+ CHECK(document_count IS NULL OR document_count<=source_count*4)
+);
+CREATE INDEX enterprise_audit_owner_time ON enterprise_audit.events(account_id,created_at);
+CREATE INDEX enterprise_audit_query ON enterprise_audit.events(account_id,query_id,attempt);
+REVOKE ALL ON ALL TABLES IN SCHEMA enterprise_audit FROM PUBLIC;
+REVOKE ALL ON ALL SEQUENCES IN SCHEMA enterprise_audit FROM PUBLIC;

package/src/runtime/enterprise_auth_schema.sql

@@ -0,0 +1,67 @@
+-- Fresh owned installation only. Operator controls membership/source mappings;
+-- application roles must never acquire their write permissions.
+CREATE SCHEMA enterprise_auth;
+REVOKE ALL ON SCHEMA enterprise_auth FROM PUBLIC;
+CREATE TABLE enterprise_auth.schema_version(version integer PRIMARY KEY CHECK(version=1),source_sha256 text NOT NULL);
+CREATE TABLE enterprise_auth.company_bindings(
+ account_id text PRIMARY KEY,session_domain text NOT NULL CHECK(session_domain ~ '^[0-9a-f]{64}$'),
+ version bigint NOT NULL CHECK(version>0),actor text NOT NULL DEFAULT current_user,
+ updated_at timestamptz NOT NULL DEFAULT clock_timestamp()
+);
+CREATE TABLE enterprise_auth.memberships(
+ account_id text NOT NULL,principal_key text NOT NULL CHECK(principal_key ~ '^[0-9a-f]{64}$'),
+ issuer text NOT NULL,subject text NOT NULL,active boolean NOT NULL DEFAULT false,
+ PRIMARY KEY(account_id,principal_key)
+);
+CREATE TABLE enterprise_auth.source_mappings(
+ account_id text NOT NULL,principal_key text NOT NULL,source_id text NOT NULL,
+ source_subject text NOT NULL CHECK(length(source_subject) BETWEEN 1 AND 255),
+ version bigint NOT NULL CHECK(version>0),active boolean NOT NULL DEFAULT false,
+ PRIMARY KEY(account_id,principal_key,source_id),
+ FOREIGN KEY(account_id,principal_key)REFERENCES enterprise_auth.memberships
+);
+CREATE TABLE enterprise_auth.attempts(
+ state_sha256 text PRIMARY KEY CHECK(state_sha256 ~ '^[0-9a-f]{64}$'),
+ account_id text NOT NULL,principal_key text NOT NULL,source_id text NOT NULL,
+ mapping_version bigint NOT NULL,browser_sha256 text NOT NULL,
+ flow_ciphertext text NOT NULL,expires_at timestamptz NOT NULL,consumed_at timestamptz,completed_at timestamptz,
+ FOREIGN KEY(account_id,principal_key,source_id)REFERENCES enterprise_auth.source_mappings
+);
+CREATE INDEX enterprise_auth_attempts_expiry ON enterprise_auth.attempts(expires_at);
+CREATE TABLE enterprise_auth.connections(
+ account_id text NOT NULL,principal_key text NOT NULL,source_id text NOT NULL,
+ mapping_version bigint NOT NULL,consent_id uuid NOT NULL,revision bigint NOT NULL CHECK(revision>0),
+ credential_ciphertext text,status text NOT NULL CHECK(status IN('connected','refreshing','needs_reconnect','revoked')),
+ updated_at timestamptz NOT NULL DEFAULT clock_timestamp(),
+ PRIMARY KEY(account_id,principal_key,source_id),
+ FOREIGN KEY(account_id,principal_key,source_id)REFERENCES enterprise_auth.source_mappings,
+ CHECK((status IN('connected','refreshing'))=(credential_ciphertext IS NOT NULL))
+);
+CREATE TABLE enterprise_auth.events(
+ id bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+ account_id text NOT NULL,principal_key text NOT NULL,source_id text NOT NULL,
+ event text NOT NULL CHECK(event IN('connect_started','connect_completed','refresh_completed','needs_reconnect','disconnected','session_started','session_ended')),
+ created_at timestamptz NOT NULL DEFAULT clock_timestamp()
+);
+CREATE TABLE enterprise_auth.administration_events(
+ id bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+ account_id text NOT NULL,principal_key text CHECK(principal_key IS NULL OR principal_key ~ '^[0-9a-f]{64}$'),
+ actor text NOT NULL DEFAULT current_user,
+ action text NOT NULL CHECK(action IN('membership_enabled','membership_disabled','mapping_updated','company_registration_updated')),
+ source_alias text CHECK(source_alias IN('sharepoint','confluence')),
+ mapping_version bigint,registration_version bigint,registration_domain text CHECK(registration_domain IS NULL OR registration_domain ~ '^[0-9a-f]{64}$'),active boolean NOT NULL,
+ created_at timestamptz NOT NULL DEFAULT clock_timestamp(),
+ CHECK((action='mapping_updated')=(source_alias IS NOT NULL AND mapping_version IS NOT NULL)),
+ CHECK((action='company_registration_updated')=(principal_key IS NULL)),
+ CHECK((action='company_registration_updated')=(registration_version IS NOT NULL AND registration_domain IS NOT NULL))
+);
+CREATE TABLE enterprise_auth.sessions(
+ session_sha256 text PRIMARY KEY CHECK(session_sha256 ~ '^[0-9a-f]{64}$'),
+ account_id text NOT NULL,principal_key text NOT NULL,csrf_sha256 text NOT NULL,
+ nonce_ciphertext text NOT NULL,expires_at timestamptz NOT NULL,
+ created_at timestamptz NOT NULL DEFAULT clock_timestamp(),revoked_at timestamptz,
+ FOREIGN KEY(account_id,principal_key)REFERENCES enterprise_auth.memberships
+);
+CREATE INDEX enterprise_auth_sessions_owner ON enterprise_auth.sessions(account_id,principal_key,created_at);
+REVOKE ALL ON ALL TABLES IN SCHEMA enterprise_auth FROM PUBLIC;
+REVOKE ALL ON ALL SEQUENCES IN SCHEMA enterprise_auth FROM PUBLIC;

package/src/runtime/enterprise_auth_store.py

@@ -0,0 +1,241 @@
+"""Transactional, encrypted per-person source credentials and one-use OAuth state.
+
+DB transport and the encryption key are injected by an owned native deployment.
+No cloud key is generated or persisted here. API credentials are never logged.
+"""
+from contextlib import contextmanager
+from dataclasses import dataclass,field
+import hashlib
+import base64
+import hmac
+import json
+from pathlib import Path
+import re
+import secrets
+import uuid
+from cryptography.fernet import Fernet,InvalidToken
+from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives.kdf.hkdf import HKDF
+from psycopg.rows import dict_row
+from enterprise_identity import CompanyPrincipal
+from enterprise_sources import SourceDenied,SourceUnavailable,DelegatedAccess
+
+
+def digest(value):return hashlib.sha256(value.encode()).hexdigest()
+def opaque(value):
+    if not isinstance(value,str)or not 1<=len(value)<=160 or any(ord(c)<33 for c in value):raise SourceDenied('invalid_source_binding')
+    return value
+
+
+def secret_binding(value):
+    if not isinstance(value,str)or not re.fullmatch(r'[A-Za-z0-9_-]{32,160}',value):raise SourceDenied('invalid_oauth_browser_binding')
+    return value
+
+
+class CredentialBox:
+    def __init__(self,key):
+        self.box=Fernet(key)
+        self._fingerprint_key=HKDF(algorithm=hashes.SHA256(),length=32,salt=None,info=b'atmem-enterprise-private-fingerprint-v1').derive(base64.urlsafe_b64decode(key))
+    def fingerprint(self,context,value):
+        raw=json.dumps({'context':context,'value':value},sort_keys=True,separators=(',',':')).encode()
+        if len(raw)>2000000:raise SourceUnavailable('credential_material_too_large')
+        return hmac.new(self._fingerprint_key,raw,hashlib.sha256).hexdigest()
+    def seal(self,context,value):
+        raw=json.dumps({'context':context,'value':value},sort_keys=True,separators=(',',':')).encode()
+        if len(raw)>2000000:raise SourceUnavailable('credential_material_too_large')
+        return self.box.encrypt(raw).decode()
+    def open(self,context,ciphertext):
+        try:
+            raw=self.box.decrypt(ciphertext.encode());value=json.loads(raw)
+            if value['context']!=context or not isinstance(value['value'],dict):raise ValueError('Invalid context')
+            return value['value']
+        except (InvalidToken,ValueError,KeyError,TypeError,AttributeError):raise SourceDenied('credential_binding_invalid')from None
+
+
+@dataclass(frozen=True)
+class SourceMapping:
+    source_id: str
+    source_subject: str
+    version: int
+    attempt_sha256: str|None = field(default=None,repr=False,compare=False)
+
+
+@dataclass(frozen=True)
+class SourceWitness:
+    source_id: str
+    source_subject: str = field(repr=False)
+    mapping_version: int
+    consent_id: str = field(repr=False)
+
+
+class EnterpriseAuthStore:
+    def __init__(self,connect,key,*,company_domain=None):
+        if company_domain is not None and(not isinstance(company_domain,str)or not re.fullmatch('[0-9a-f]{64}',company_domain)):raise ValueError('Use the owned company authority domain')
+        self.connect=connect;self.box=CredentialBox(key);self.company_domain=company_domain
+
+    @contextmanager
+    def transaction(self):
+        with self.connect()as conn:
+            if conn.autocommit:raise ValueError('Credential operations require a transaction')
+            with conn.cursor(row_factory=dict_row)as cur:
+                cur.execute("SET LOCAL search_path=pg_catalog,enterprise_auth,pg_temp");cur.execute("SET LOCAL lock_timeout='3s'");cur.execute("SET LOCAL statement_timeout='10s'")
+                yield cur
+
+    def require_company(self,cur,account_id):
+        if self.company_domain is not None:
+            row=cur.execute('SELECT session_domain FROM enterprise_auth.company_bindings WHERE account_id=%s',(account_id,)).fetchone()
+            if not row or row['session_domain']!=self.company_domain:raise SourceDenied('company_registration_changed')
+
+    def _authorize(self,cur,principal,source_id=None):
+        if not isinstance(principal,CompanyPrincipal):raise SourceDenied('company_identity_required')
+        principal.require()
+        self.require_company(cur,principal.account_id)
+        membership=cur.execute('SELECT issuer,subject,active FROM enterprise_auth.memberships WHERE account_id=%s AND principal_key=%s',(principal.account_id,principal.key)).fetchone()
+        if not membership or not membership['active']or membership['issuer']!=principal.issuer or membership['subject']!=principal.subject:raise SourceDenied('company_membership_required')
+        if source_id is None:return None
+        opaque(source_id)
+        row=cur.execute('SELECT source_subject,version,active FROM enterprise_auth.source_mappings WHERE account_id=%s AND principal_key=%s AND source_id=%s',(principal.account_id,principal.key,source_id)).fetchone()
+        if not row or not row['active']:raise SourceDenied('source_mapping_required')
+        return SourceMapping(source_id,row['source_subject'],row['version'])
+
+    def authorize(self,principal):
+        with self.transaction()as cur:self._authorize(cur,principal)
+
+    def source_witness(self,principal,source_id):
+        with self.transaction()as cur:
+            mapping=self._authorize(cur,principal,source_id)
+            row=cur.execute('SELECT mapping_version,consent_id,status FROM enterprise_auth.connections WHERE account_id=%s AND principal_key=%s AND source_id=%s',(principal.account_id,principal.key,source_id)).fetchone()
+            # Refresh can rotate credential material without changing consent.
+            # Native adapters independently check the access token's lifetime and
+            # current source permissions; failed/uncertain reconnection is denied.
+            if not row or row['status']not in {'connected','refreshing'}or row['mapping_version']!=mapping.version:raise SourceDenied('source_consent_required')
+            return SourceWitness(source_id,mapping.source_subject,mapping.version,str(row['consent_id']))
+
+    def check_source_witness(self,principal,witness):
+        if not isinstance(witness,SourceWitness)or self.source_witness(principal,witness.source_id)!=witness:raise SourceDenied('source_connection_changed')
+
+    def context(self,principal,mapping,kind):return [kind,principal.account_id,principal.key,mapping.source_id,mapping.version]
+    def event(self,cur,principal,source_id,event):cur.execute('INSERT INTO enterprise_auth.events(account_id,principal_key,source_id,event)VALUES(%s,%s,%s,%s)',(principal.account_id,principal.key,source_id,event))
+
+    def begin(self,principal,source_id,browser_nonce,flow,state=None):
+        secret_binding(browser_nonce)
+        if not isinstance(flow,dict):raise ValueError('Supply a native OAuth flow object')
+        state=state or secrets.token_urlsafe(32);secret_binding(state)
+        with self.transaction()as cur:
+            mapping=self._authorize(cur,principal,source_id)
+            cur.execute('SELECT pg_advisory_xact_lock(hashtextextended(%s,0))',('enterprise-oauth-start:'+principal.account_id+':'+principal.key,))
+            # Bound abandoned attempts without deleting another person's state.
+            cur.execute("DELETE FROM enterprise_auth.attempts WHERE account_id=%s AND principal_key=%s AND expires_at<clock_timestamp()AND(consumed_at IS NULL OR consumed_at<clock_timestamp()-interval '1 minute')",(principal.account_id,principal.key))
+            count=cur.execute('SELECT count(*) AS n FROM enterprise_auth.attempts WHERE account_id=%s AND principal_key=%s AND consumed_at IS NULL',(principal.account_id,principal.key)).fetchone()['n']
+            if count>=5:raise SourceUnavailable('oauth_attempt_limit')
+            encrypted=self.box.seal(self.context(principal,mapping,'flow')+[digest(state)],flow)
+            cur.execute("INSERT INTO enterprise_auth.attempts(state_sha256,account_id,principal_key,source_id,mapping_version,browser_sha256,flow_ciphertext,expires_at)VALUES(%s,%s,%s,%s,%s,%s,%s,clock_timestamp()+interval '5 minutes')",(digest(state),principal.account_id,principal.key,source_id,mapping.version,digest(browser_nonce),encrypted))
+            self.event(cur,principal,source_id,'connect_started')
+        return state
+
+    def consume(self,principal,source_id,browser_nonce,state):
+        secret_binding(browser_nonce);secret_binding(state)
+        with self.transaction()as cur:
+            mapping=self._authorize(cur,principal,source_id)
+            row=cur.execute('UPDATE enterprise_auth.attempts SET consumed_at=clock_timestamp()WHERE state_sha256=%s AND account_id=%s AND principal_key=%s AND source_id=%s AND mapping_version=%s AND browser_sha256=%s AND consumed_at IS NULL AND expires_at>clock_timestamp() RETURNING flow_ciphertext',(digest(state),principal.account_id,principal.key,source_id,mapping.version,digest(browser_nonce))).fetchone()
+            if not row:raise SourceDenied('oauth_state_unavailable')
+            flow=self.box.open(self.context(principal,mapping,'flow')+[digest(state)],row['flow_ciphertext'])
+        # Commit consumption before any network exchange: uncertain code redemption
+        # requires a fresh consent flow, never a blind authorization-code replay.
+        return SourceMapping(mapping.source_id,mapping.source_subject,mapping.version,digest(state)),flow
+
+    def save(self,principal,mapping,material):
+        if not isinstance(material,dict):raise ValueError('Supply verified native credential material')
+        with self.transaction()as cur:
+            current=self._authorize(cur,principal,mapping.source_id)
+            if current!=mapping:raise SourceDenied('source_mapping_changed')
+            if not isinstance(mapping.attempt_sha256,str)or not re.fullmatch('[0-9a-f]{64}',mapping.attempt_sha256):raise SourceDenied('source_consent_unavailable')
+            self._connection_lock(cur,principal,mapping.source_id)
+            receipt=cur.execute("SELECT state_sha256 FROM enterprise_auth.attempts WHERE state_sha256=%s AND account_id=%s AND principal_key=%s AND source_id=%s AND mapping_version=%s AND consumed_at IS NOT NULL AND consumed_at>clock_timestamp()-interval '1 minute'AND completed_at IS NULL FOR UPDATE",(mapping.attempt_sha256,principal.account_id,principal.key,mapping.source_id,mapping.version)).fetchone()
+            if not receipt:raise SourceDenied('source_connection_changed')
+            consent_id=str(uuid.uuid4())
+            encrypted=self.box.seal(self.context(principal,mapping,'credential')+[consent_id],material)
+            cur.execute("INSERT INTO enterprise_auth.connections(account_id,principal_key,source_id,mapping_version,consent_id,revision,credential_ciphertext,status)VALUES(%s,%s,%s,%s,%s,1,%s,'connected')ON CONFLICT(account_id,principal_key,source_id)DO UPDATE SET mapping_version=EXCLUDED.mapping_version,consent_id=EXCLUDED.consent_id,revision=enterprise_auth.connections.revision+1,credential_ciphertext=EXCLUDED.credential_ciphertext,status='connected',updated_at=clock_timestamp()",(principal.account_id,principal.key,mapping.source_id,mapping.version,consent_id,encrypted))
+            cur.execute('UPDATE enterprise_auth.attempts SET completed_at=clock_timestamp()WHERE state_sha256=%s',(mapping.attempt_sha256,))
+            self.event(cur,principal,mapping.source_id,'connect_completed')
+
+    def _abandon(self,principal,source_id,revision):
+        with self.transaction()as cur:
+            row=cur.execute("UPDATE enterprise_auth.connections SET credential_ciphertext=NULL,status='needs_reconnect',updated_at=clock_timestamp()WHERE account_id=%s AND principal_key=%s AND source_id=%s AND revision=%s AND status='refreshing'RETURNING revision",(principal.account_id,principal.key,source_id,revision)).fetchone()
+            if row:self.event(cur,principal,source_id,'needs_reconnect')
+
+    def credentials(self,principal,source_id,refresh):
+        # Persist the refresh intent BEFORE HTTP. A crash leaves a durable fence,
+        # not an old token that another replica can silently reuse. No DB lock is
+        # held across the source request; revocation/disconnection can proceed.
+        stale=False
+        with self.transaction()as cur:
+            mapping=self._authorize(cur,principal,source_id)
+            row=cur.execute("SELECT mapping_version,consent_id,revision,credential_ciphertext,status,updated_at<clock_timestamp()-interval '1 minute' AS stale FROM enterprise_auth.connections WHERE account_id=%s AND principal_key=%s AND source_id=%s FOR UPDATE",(principal.account_id,principal.key,source_id)).fetchone()
+            if not row or row['mapping_version']!=mapping.version or row['status']not in {'connected','refreshing'}:raise SourceDenied('source_reconnection_required')
+            if row['status']=='refreshing':
+                if not row['stale']:raise SourceUnavailable('source_refresh_in_progress')
+                cur.execute("UPDATE enterprise_auth.connections SET credential_ciphertext=NULL,status='needs_reconnect',updated_at=clock_timestamp()WHERE account_id=%s AND principal_key=%s AND source_id=%s",(principal.account_id,principal.key,source_id))
+                self.event(cur,principal,source_id,'needs_reconnect');stale=True
+            else:
+                context=self.context(principal,mapping,'credential')+[str(row['consent_id'])];material=self.box.open(context,row['credential_ciphertext']);revision=row['revision']+1
+                cur.execute("UPDATE enterprise_auth.connections SET status='refreshing',revision=%s,updated_at=clock_timestamp()WHERE account_id=%s AND principal_key=%s AND source_id=%s",(revision,principal.account_id,principal.key,source_id))
+        if stale:raise SourceDenied('source_reconnection_required')
+        try:
+            updated,access=refresh(mapping,material)
+            if not isinstance(updated,dict)or not isinstance(access,DelegatedAccess)or access.source_subject!=mapping.source_subject:raise SourceDenied('source_refresh_identity_mismatch')
+            access.require(principal.key)
+            with self.transaction()as cur:
+                if self._authorize(cur,principal,source_id)!=mapping:raise SourceDenied('source_mapping_changed')
+                changed=cur.execute("UPDATE enterprise_auth.connections SET credential_ciphertext=%s,status='connected',revision=revision+1,updated_at=clock_timestamp()WHERE account_id=%s AND principal_key=%s AND source_id=%s AND revision=%s AND status='refreshing'RETURNING revision",(self.box.seal(context,updated),principal.account_id,principal.key,source_id,revision)).fetchone()
+                if not changed:raise SourceDenied('source_connection_changed')
+                self.event(cur,principal,source_id,'refresh_completed')
+        except Exception:
+            try:self._abandon(principal,source_id,revision)
+            except Exception:pass  # Durable refreshing fence already committed.
+            raise SourceDenied('source_reconnection_required')from None
+        return access
+
+    def connection_status(self,principal,source_id):
+        with self.transaction()as cur:
+            self._authorize(cur,principal)
+            mapping=cur.execute('SELECT version,active FROM enterprise_auth.source_mappings WHERE account_id=%s AND principal_key=%s AND source_id=%s',(principal.account_id,principal.key,source_id)).fetchone()
+            if not mapping or not mapping['active']:return 'needs_setup'
+            row=cur.execute('SELECT mapping_version,status FROM enterprise_auth.connections WHERE account_id=%s AND principal_key=%s AND source_id=%s',(principal.account_id,principal.key,source_id)).fetchone()
+            if not row or row['mapping_version']!=mapping['version']:return 'needs_reconnect'
+            return row['status']
+
+    def _connection_lock(self,cur,principal,source_id):
+        cur.execute('SELECT pg_advisory_xact_lock(hashtextextended(%s,0))',('enterprise-connection:'+principal.account_id+':'+principal.key+':'+source_id,))
+
+    def disconnect(self,principal,source_id):
+        with self.transaction()as cur:
+            self._authorize(cur,principal,source_id)
+            self._connection_lock(cur,principal,source_id)
+            cur.execute("UPDATE enterprise_auth.connections SET credential_ciphertext=NULL,status='revoked',revision=revision+1,updated_at=clock_timestamp()WHERE account_id=%s AND principal_key=%s AND source_id=%s",(principal.account_id,principal.key,source_id))
+            cur.execute('DELETE FROM enterprise_auth.attempts WHERE account_id=%s AND principal_key=%s AND source_id=%s',(principal.account_id,principal.key,source_id))
+            self.event(cur,principal,source_id,'disconnected')
+
+
+def initialize_auth_store(conn):
+    source=Path(__file__).with_name('enterprise_auth_schema.sql').read_bytes()
+    conn.execute(source.decode());conn.execute('INSERT INTO enterprise_auth.schema_version VALUES(1,%s)',(hashlib.sha256(source).hexdigest(),))
+
+
+def grant_auth_runtime(conn,role):
+    from psycopg import sql
+    if conn.autocommit or not isinstance(role,str)or not re.fullmatch(r'[A-Za-z0-9_.@-]{1,63}',role):raise ValueError('Use an owned nonadministrative broker role and transaction')
+    expected=hashlib.sha256(Path(__file__).with_name('enterprise_auth_schema.sql').read_bytes()).hexdigest()
+    if conn.execute('SELECT version,source_sha256 FROM enterprise_auth.schema_version').fetchone()!=(1,expected):raise ValueError('Review the owned exact schema before grants')
+    flags=conn.execute('SELECT rolsuper,rolcreatedb,rolcreaterole,rolreplication,rolbypassrls,rolcanlogin FROM pg_roles WHERE rolname=%s',(role,)).fetchone()
+    if not flags or any(flags[:5])or not flags[5]:raise ValueError('Use an existing nonadministrative broker login')
+    if conn.execute('SELECT has_schema_privilege(%s,%s,%s)',(role,'enterprise_auth','CREATE')).fetchone()[0]:raise ValueError('Broker must not own or create authentication schema objects')
+    for table in ['memberships','source_mappings','company_bindings','schema_version']:
+        if conn.execute('SELECT has_table_privilege(%s,%s,%s)',(role,'enterprise_auth.'+table,'INSERT,UPDATE,DELETE,TRUNCATE,TRIGGER,REFERENCES')).fetchone()[0]:raise ValueError('Broker must not inherit authority-table write privileges')
+    name=sql.Identifier(role)
+    conn.execute(sql.SQL('GRANT USAGE ON SCHEMA enterprise_auth TO {}').format(name))
+    conn.execute(sql.SQL('GRANT SELECT ON enterprise_auth.schema_version,enterprise_auth.memberships,enterprise_auth.source_mappings,enterprise_auth.company_bindings TO {}').format(name))
+    conn.execute(sql.SQL('GRANT SELECT,INSERT,UPDATE,DELETE ON enterprise_auth.attempts,enterprise_auth.sessions TO {}').format(name))
+    conn.execute(sql.SQL('GRANT SELECT,INSERT,UPDATE ON enterprise_auth.connections TO {}').format(name))
+    conn.execute(sql.SQL('GRANT INSERT ON enterprise_auth.events TO {}').format(name))
+    conn.execute(sql.SQL('GRANT USAGE ON ALL SEQUENCES IN SCHEMA enterprise_auth TO {}').format(name))

package/src/runtime/enterprise_aws_host_bootstrap.py

@@ -0,0 +1,120 @@
+"""New dedicated ECS host preparation; no client content or credentials accepted."""
+import base64
+import json
+import os
+from pathlib import Path
+import re
+import stat
+import subprocess
+import sys
+import uuid
+sys.path.insert(0,str(Path(__file__).resolve().parent))
+from enterprise_aws_host_probe import expected_policy,first_rule_matches
+
+
+def unique(pairs):
+    result={}
+    for key,value in pairs:
+        if key in result:raise ValueError('Ambiguous host configuration')
+        result[key]=value
+    return result
+
+
+def environment(raw):
+    values={}
+    for line in raw.splitlines():
+        if not line.strip()or line.lstrip().startswith('#'):continue
+        key,separator,value=line.partition('=')
+        if not separator or not re.fullmatch('[A-Z][A-Z0-9_]*',key)or key in values:raise ValueError('Invalid ECS environment')
+        values[key]=value
+    return values
+
+
+def required(expected):
+    expected=expected_policy(expected)
+    return {'ECS_CLUSTER':expected['clusterArn'],'ECS_ENABLE_TASK_IAM_ROLE':'true','ECS_ENABLE_TASK_IAM_ROLE_NETWORK_HOST':'false',
+            'ECS_ENGINE_TASK_CLEANUP_WAIT_DURATION':'1s','ECS_INSTANCE_ATTRIBUTES':json.dumps({'atmem-document-policy':expected['policySha256']},sort_keys=True,separators=(',',':'))}
+
+
+def read_optional(path):
+    try:return Path(path).read_text()
+    except FileNotFoundError:return ''
+
+
+def atomic(path,text):
+    path=Path(path);path.parent.mkdir(mode=0o755,parents=True,exist_ok=True)
+    parent=os.open(path.parent,os.O_RDONLY|os.O_DIRECTORY|os.O_NOFOLLOW);temporary='.atmem-'+uuid.uuid4().hex
+    try:
+        info=os.fstat(parent)
+        if info.st_uid!=os.geteuid()or stat.S_IMODE(info.st_mode)&0o022:raise ValueError('Unsafe host configuration directory')
+        try:
+            info=os.stat(path.name,dir_fd=parent,follow_symlinks=False)
+            if not stat.S_ISREG(info.st_mode)or info.st_uid!=os.geteuid():raise ValueError('Refuse unowned host configuration')
+        except FileNotFoundError:pass
+        fd=os.open(temporary,os.O_WRONLY|os.O_CREAT|os.O_EXCL|os.O_NOFOLLOW,0o600,dir_fd=parent)
+        with os.fdopen(fd,'w')as stream:stream.write(text);stream.flush();os.fsync(stream.fileno())
+        os.replace(temporary,path.name,src_dir_fd=parent,dst_dir_fd=parent);os.fsync(parent)
+    finally:
+        try:os.unlink(temporary,dir_fd=parent)
+        except FileNotFoundError:pass
+        os.close(parent)
+
+
+def prepare(expected,*,read=read_optional,write=atomic):
+    updates=required(expected);raw=read('/etc/ecs/ecs.config');existing=environment(raw)
+    if existing.get('ECS_CLUSTER')not in {None,'','default',updates['ECS_CLUSTER']}:raise ValueError('Do not adopt an existing ECS host')
+    attributes=json.loads(existing.get('ECS_INSTANCE_ATTRIBUTES','{}'),object_pairs_hook=unique)
+    if attributes not in [{},{'atmem-document-policy':expected['policySha256']}]:raise ValueError('Do not replace existing host ownership')
+    daemon=json.loads(read('/etc/docker/daemon.json')or'{}',object_pairs_hook=unique)
+    if not isinstance(daemon,dict):raise ValueError('Invalid native daemon configuration')
+    daemon.update({'log-driver':'none','live-restore':False});daemon.pop('log-opts',None)
+    lines=[];seen=set()
+    for line in raw.splitlines():
+        key=line.partition('=')[0]
+        if key in updates:lines.append(key+'='+updates[key]);seen.add(key)
+        else:lines.append(line)
+    lines += [key+'='+value for key,value in updates.items()if key not in seen]
+    write('/etc/docker/daemon.json',json.dumps(daemon,sort_keys=True,separators=(',',':'))+'\n')
+    write('/etc/ecs/ecs.config','\n'.join(lines)+'\n')
+
+
+def command(argv,*,absent=False):
+    if argv[0]=='/usr/bin/docker':argv=[argv[0],'--host','unix:///var/run/docker.sock',*argv[1:]]
+    result=subprocess.run(argv,stdin=subprocess.DEVNULL,stdout=subprocess.PIPE,stderr=subprocess.DEVNULL,timeout=4,
+        env={'PATH':'/usr/sbin:/usr/bin:/sbin:/bin','LANG':'C'})
+    if absent and result.returncode==1:return None
+    if result.returncode or len(result.stdout)>32768:raise ValueError('Native host preparation failed')
+    return result.stdout.decode().strip()
+
+
+def guard(expected,*,read=read_optional,run=command):
+    updates=required(expected);values=environment(read('/etc/ecs/ecs.config'))
+    if any(values.get(key)!=value for key,value in updates.items()):raise ValueError('ECS configuration not prepared')
+    daemon=json.loads(read('/etc/docker/daemon.json'),object_pairs_hook=unique)
+    if daemon.get('log-driver')!='none'or daemon.get('live-restore',False)is not False or daemon.get('bridge','docker0')!='docker0':raise ValueError('Unsafe prepared daemon')
+    for field,value in [('LoggingDriver','none'),('LiveRestoreEnabled',False)]:
+        if json.loads(run(['/usr/bin/docker','info','--format','{{json .'+field+'}}']))!=value:raise ValueError('Running daemon differs from prepared policy')
+    options=json.loads(run(['/usr/bin/docker','info','--format','{{json .SecurityOptions}}']))
+    if 'name=seccomp,profile=builtin'not in options:raise ValueError('Native seccomp is not active')
+    bridge=json.loads(run(['/usr/bin/docker','network','inspect','bridge','--format','{{json .Options}}']))
+    if bridge.get('com.docker.network.bridge.name')!='docker0':raise ValueError('Default bridge changed')
+    for tool,destination in [('/usr/sbin/iptables','169.254.169.254/32'),('/usr/sbin/ip6tables','fd00:ec2::254/128')]:
+        if run([tool,'-w','2','-S','DOCKER-USER'],absent=True)is None:run([tool,'-w','2','-N','DOCKER-USER'])
+        for chain,rule in [('DOCKER-USER',['-i','docker0','-d',destination,'-j','DROP']),('FORWARD',['-j','DOCKER-USER'])]:
+            for _ in range(4):
+                if run([tool,'-w','2','-D',chain,*rule],absent=True)is None:break
+            run([tool,'-w','2','-I',chain,'1',*rule])
+        if not first_rule_matches(run([tool,'-w','2','-S','DOCKER-USER']),'DOCKER-USER',{'-i':'docker0','-d':destination,'-j':'DROP'}):raise ValueError('Metadata rule installation failed')
+        if not first_rule_matches(run([tool,'-w','2','-S','FORWARD']),'FORWARD',{'-j':'DOCKER-USER'}):raise ValueError('Metadata forwarding hook installation failed')
+
+
+def main():
+    try:
+        if os.geteuid()!=0 or len(sys.argv)!=3 or sys.argv[1]not in {'prepare','guard'}or len(sys.argv[2])>4096:raise ValueError()
+        expected=json.loads(base64.b64decode(sys.argv[2],validate=True),object_pairs_hook=unique)
+        (prepare if sys.argv[1]=='prepare'else guard)(expected)
+        print(json.dumps({'status':'ok','phase':sys.argv[1]}))
+    except Exception:raise SystemExit(2)from None
+
+
+if __name__=='__main__':main()