@consiliency/agent-board-schema 1.3.0 → 1.5.0

package/migrations/20260718000100_agent_board_send_authz_config.sql

@@ -0,0 +1,172 @@
+-- MBSENDAUTHZ SL-0 (preamble): shared send-authz enforcement config + telemetry.
+--
+-- Additive, dormant. Creates the single-writer shared objects that SL-1/SL-2/SL-3
+-- consume:
+--   * agent_board.fleet_send_enforcement_flags  — per-sender-fleet-scope mode flag
+--     (absent row => fail_open_preserved, i.e. current behavior unchanged).
+--   * agent_board.nonfleet_sender_allowlist     — legitimate non-fleet system flows,
+--     consulted only under deny mode. Structure is code; population is operational.
+--   * agent_board.send_authz_telemetry (+ recorder) — per-call authz telemetry with
+--     the frozen EF-vs-host origin discriminator that MBDELEG's host-bypass drain
+--     gate reads.
+--   * agent_board._resolve_send_fleet_scope / _send_fleet_scope_mode — the fleet
+--     scope resolver + flag-mode lookup.
+--
+-- No send-path behavior changes here: these objects are only wired into the send
+-- path by SL-1 (bypass telemetry) and SL-2 (non-fleet default-deny). schema_version
+-- is intentionally NOT bumped (phase is dormant/additive).
+
+-- 1. fleet_send_enforcement_flags (IF-0-MBSENDAUTHZ-2) -----------------------
+-- Board-native (agent_board.*), deliberately NOT public.app_settings. Absent row
+-- for a scope => fail_open_preserved (preserves current behavior for that scope).
+create table if not exists agent_board.fleet_send_enforcement_flags (
+  scope_key text primary key,
+  mode text not null default 'fail_open_preserved'
+    check (mode in ('fail_open_preserved', 'observe', 'deny')),
+  updated_at timestamptz not null default now()
+);
+
+comment on table agent_board.fleet_send_enforcement_flags is
+  'Per-sender-fleet-scope send enforcement mode. Absent row => fail_open_preserved (current behavior). observe => allow + record would_be_deny; deny => deny non-allowlisted non-fleet senders. Operator-managed (service_role).';
+
+alter table agent_board.fleet_send_enforcement_flags enable row level security;
+grant select, insert, update, delete on agent_board.fleet_send_enforcement_flags to service_role;
+
+-- 2. nonfleet_sender_allowlist (IF-0-MBSENDAUTHZ-6) --------------------------
+-- Enumerates legitimate non-fleet system flows; consulted only under deny mode.
+-- Structure is code; population is operational (derived from the observe pass).
+create table if not exists agent_board.nonfleet_sender_allowlist (
+  agent_id uuid primary key references agent_board.agents(id) on delete cascade,
+  reason text not null,
+  created_at timestamptz not null default now()
+);
+
+comment on table agent_board.nonfleet_sender_allowlist is
+  'Tight allowlist of legitimate non-fleet system senders. Consulted only under deny mode: a non-fleet sender is admitted iff it has a row here. Population is operational (derived from the observe pass).';
+
+alter table agent_board.nonfleet_sender_allowlist enable row level security;
+grant select, insert, update, delete on agent_board.nonfleet_sender_allowlist to service_role;
+
+-- 3. send_authz_telemetry (IF-0-MBSENDAUTHZ-5) ------------------------------
+-- Per-call authz telemetry. origin is the frozen EF-vs-host discriminator that
+-- MBDELEG's "zero host-originated service_role" drain gate reads.
+create table if not exists agent_board.send_authz_telemetry (
+  id uuid primary key default gen_random_uuid(),
+  kind text not null check (kind in ('service_role_bypass', 'would_be_deny')),
+  origin text not null check (origin in ('ef', 'host', 'unknown')),
+  actor_agent_id uuid,
+  board_id uuid,
+  operation text,
+  scope_key text,
+  denial_class text,
+  metadata jsonb not null default '{}'::jsonb,
+  recorded_at timestamptz not null default now()
+);
+
+comment on table agent_board.send_authz_telemetry is
+  'Per-call send authorization telemetry. kind=service_role_bypass (a service_role guarded-bypass send) or would_be_deny (a non-fleet send that deny mode would have blocked). origin (ef|host|unknown) is the frozen host-vs-EF discriminator MBDELEG drains against.';
+
+create index if not exists idx_agent_board_send_authz_telemetry_kind_origin
+  on agent_board.send_authz_telemetry(kind, origin, recorded_at desc);
+
+alter table agent_board.send_authz_telemetry enable row level security;
+grant select, insert on agent_board.send_authz_telemetry to service_role;
+
+create or replace function agent_board._record_send_authz_telemetry(
+  p_kind text,
+  p_origin text,
+  p_actor_agent_id uuid,
+  p_board_id uuid,
+  p_operation text,
+  p_scope_key text,
+  p_denial_class text,
+  p_metadata jsonb default '{}'::jsonb
+)
+returns uuid
+language plpgsql
+security definer
+set search_path = agent_board, public
+as $$
+declare
+  v_id uuid;
+begin
+  if not agent_board._is_service_role() then
+    raise exception 'send authz telemetry recording requires service role' using errcode = '42501';
+  end if;
+  insert into agent_board.send_authz_telemetry(
+    kind, origin, actor_agent_id, board_id, operation, scope_key, denial_class, metadata
+  ) values (
+    p_kind,
+    case when p_origin in ('ef', 'host') then p_origin else 'unknown' end,
+    p_actor_agent_id,
+    p_board_id,
+    p_operation,
+    p_scope_key,
+    p_denial_class,
+    coalesce(p_metadata, '{}'::jsonb)
+  ) returning id into v_id;
+  return v_id;
+end;
+$$;
+
+comment on function agent_board._record_send_authz_telemetry(text, text, uuid, uuid, text, text, text, jsonb) is
+  'Service_role-only recorder for send_authz_telemetry. Normalizes origin to ef|host|unknown. Called internally by the send RPCs (bypass) and the fleet policy (would_be_deny).';
+
+revoke all on function agent_board._record_send_authz_telemetry(text, text, uuid, uuid, text, text, text, jsonb) from public, anon, authenticated;
+grant execute on function agent_board._record_send_authz_telemetry(text, text, uuid, uuid, text, text, text, jsonb) to service_role;
+
+-- 4. fleet scope resolver + flag-mode lookup (IF-0-MBSENDAUTHZ-3) ------------
+-- Trust-domain-derived scope where the sender is fleet-resolvable (mirrors the
+-- active-machine resolution in evaluate_signed_write_fleet_policy), else the single
+-- catch-all 'nonfleet' bucket (the v_machine_id is null population).
+create or replace function agent_board._resolve_send_fleet_scope(
+  p_actor uuid
+)
+returns text
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select coalesce(
+    (select 'fleet:' || ftd.slug
+       from agent_board.fleet_machine_agents fma
+       join agent_board.fleet_machines fm on fm.id = fma.machine_id
+       join agent_board.fleet_trust_domains ftd on ftd.id = fm.trust_domain_id
+      where fma.agent_id = p_actor
+        and fma.lifecycle_state = 'active'
+        and fm.lifecycle_state = 'active'
+      order by fma.updated_at desc
+      limit 1),
+    'nonfleet'
+  )
+$$;
+
+comment on function agent_board._resolve_send_fleet_scope(uuid) is
+  'Resolves a sender to its trust-domain-derived fleet scope key, or the catch-all ''nonfleet'' bucket when the sender has no active fleet machine.';
+
+revoke all on function agent_board._resolve_send_fleet_scope(uuid) from public, anon, authenticated;
+grant execute on function agent_board._resolve_send_fleet_scope(uuid) to service_role;
+
+create or replace function agent_board._send_fleet_scope_mode(
+  p_scope_key text
+)
+returns text
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select coalesce(
+    (select mode
+       from agent_board.fleet_send_enforcement_flags
+      where scope_key = p_scope_key),
+    'fail_open_preserved'
+  )
+$$;
+
+comment on function agent_board._send_fleet_scope_mode(text) is
+  'Resolves the enforcement mode for a sender-fleet-scope key, defaulting to fail_open_preserved when no flag row exists.';
+
+revoke all on function agent_board._send_fleet_scope_mode(text) from public, anon, authenticated;
+grant execute on function agent_board._send_fleet_scope_mode(text) to service_role;