@govplane/runtime-sdk 0.2.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +365 -0
- package/dist/index.cjs +1080 -0
- package/dist/index.cjs.map +1 -0
- package/dist/index.d.cts +413 -0
- package/dist/index.d.ts +413 -0
- package/dist/index.js +1054 -0
- package/dist/index.js.map +1 -0
- package/docs/operations/Govplane_Incident_Playbook.md +318 -0
- package/docs/operations/Govplane_Runtime_Incident_Controls.md +101 -0
- package/docs/security/Govplane_Threat_Model.md +137 -0
- package/package.json +40 -0
|
@@ -0,0 +1,137 @@
|
|
|
1
|
+
# Govplane Runtime SDK – Threat Model & Security Guarantees
|
|
2
|
+
|
|
3
|
+
---
|
|
4
|
+
|
|
5
|
+
## 1. Scope & Assumptions
|
|
6
|
+
|
|
7
|
+
### In scope
|
|
8
|
+
- Backend services (APIs, workers, jobs, gateways)
|
|
9
|
+
- Node.js environments (≥18)
|
|
10
|
+
- Runtime bundles generados por Govplane Control Plane
|
|
11
|
+
- Runtime keys con permisos **read-only**
|
|
12
|
+
|
|
13
|
+
### Out of scope
|
|
14
|
+
- Browsers / client-side execution
|
|
15
|
+
- Policy authoring
|
|
16
|
+
- Runtime bundle generation
|
|
17
|
+
- Handling of PII
|
|
18
|
+
|
|
19
|
+
---
|
|
20
|
+
|
|
21
|
+
## 2. Trust Boundaries
|
|
22
|
+
|
|
23
|
+
```
|
|
24
|
+
Govplane Control Plane
|
|
25
|
+
└─ Runtime Bundle (immutable)
|
|
26
|
+
└─ Runtime API (read-only)
|
|
27
|
+
└─ Runtime SDK
|
|
28
|
+
└─ Policy Engine (local)
|
|
29
|
+
```
|
|
30
|
+
|
|
31
|
+
➡️ No inbound arrows into the SDK
|
|
32
|
+
➡️ The SDK never exposes HTTP endpoints
|
|
33
|
+
|
|
34
|
+
---
|
|
35
|
+
|
|
36
|
+
## 3. Attack Surface
|
|
37
|
+
|
|
38
|
+
| Vector | Status |
|
|
39
|
+
|------|--------|
|
|
40
|
+
| Inbound HTTP | ❌ None |
|
|
41
|
+
| Middleware hooks | ❌ None |
|
|
42
|
+
| Dynamic code execution | ❌ None |
|
|
43
|
+
| Runtime DSL parsing | ❌ None |
|
|
44
|
+
| eval / Function | ❌ None |
|
|
45
|
+
| PII handling | ❌ None |
|
|
46
|
+
|
|
47
|
+
---
|
|
48
|
+
|
|
49
|
+
## 4. Runtime Key Security
|
|
50
|
+
|
|
51
|
+
- Read-only
|
|
52
|
+
- Scoped by org / project / env
|
|
53
|
+
- Cannot modify policies
|
|
54
|
+
- Cannot trigger side effects
|
|
55
|
+
|
|
56
|
+
---
|
|
57
|
+
|
|
58
|
+
## 5. Policy Evaluation Guarantees
|
|
59
|
+
|
|
60
|
+
- Deterministic decisions
|
|
61
|
+
- Deny-by-default
|
|
62
|
+
- Immutable bundles
|
|
63
|
+
|
|
64
|
+
---
|
|
65
|
+
|
|
66
|
+
## 6. Precedence Rules
|
|
67
|
+
|
|
68
|
+
1. kill_switch
|
|
69
|
+
2. deny
|
|
70
|
+
3. throttle (most restrictive)
|
|
71
|
+
4. allow
|
|
72
|
+
5. default → deny
|
|
73
|
+
|
|
74
|
+
---
|
|
75
|
+
|
|
76
|
+
## 7. Context Security (PII Protection)
|
|
77
|
+
|
|
78
|
+
- Explicit allowlist
|
|
79
|
+
- Hard limits
|
|
80
|
+
- Unknown keys rejected
|
|
81
|
+
|
|
82
|
+
---
|
|
83
|
+
|
|
84
|
+
## 8. Decision Trace Safety
|
|
85
|
+
|
|
86
|
+
Trace MAY include:
|
|
87
|
+
- policyKey
|
|
88
|
+
- ruleId
|
|
89
|
+
- effect type
|
|
90
|
+
|
|
91
|
+
Trace NEVER includes:
|
|
92
|
+
- context values
|
|
93
|
+
- rule bodies
|
|
94
|
+
- PII
|
|
95
|
+
|
|
96
|
+
---
|
|
97
|
+
|
|
98
|
+
## 9. Failure Scenarios
|
|
99
|
+
|
|
100
|
+
- Runtime unavailable → cached bundle
|
|
101
|
+
- Missing bundle → deny
|
|
102
|
+
- Polling failure → backoff + degraded
|
|
103
|
+
|
|
104
|
+
---
|
|
105
|
+
|
|
106
|
+
## 10. DDoS & Abuse
|
|
107
|
+
|
|
108
|
+
- No network I/O per request
|
|
109
|
+
- In-memory evaluation
|
|
110
|
+
- Deterministic enforcement
|
|
111
|
+
|
|
112
|
+
---
|
|
113
|
+
|
|
114
|
+
## 11. Non-Goals
|
|
115
|
+
|
|
116
|
+
- No middleware
|
|
117
|
+
- No auth
|
|
118
|
+
- No persistence
|
|
119
|
+
- No remote execution
|
|
120
|
+
|
|
121
|
+
---
|
|
122
|
+
|
|
123
|
+
## 12. Security Summary
|
|
124
|
+
|
|
125
|
+
Safe for:
|
|
126
|
+
- APIs
|
|
127
|
+
- Gateways
|
|
128
|
+
- Workers
|
|
129
|
+
- Critical paths
|
|
130
|
+
|
|
131
|
+
---
|
|
132
|
+
|
|
133
|
+
## 13. Responsible Usage
|
|
134
|
+
|
|
135
|
+
- Treat keys as secrets
|
|
136
|
+
- Explicit context mapping
|
|
137
|
+
- Sampling traces only
|
package/package.json
ADDED
|
@@ -0,0 +1,40 @@
|
|
|
1
|
+
{
|
|
2
|
+
"name": "@govplane/runtime-sdk",
|
|
3
|
+
"version": "0.2.4",
|
|
4
|
+
"description": "Govplane Runtime SDK (Node/TS) with ETag caching + polling",
|
|
5
|
+
"license": "MIT",
|
|
6
|
+
"type": "module",
|
|
7
|
+
"main": "./dist/index.cjs",
|
|
8
|
+
"module": "./dist/index.js",
|
|
9
|
+
"types": "./dist/index.d.ts",
|
|
10
|
+
"exports": {
|
|
11
|
+
".": {
|
|
12
|
+
"types": "./dist/index.d.ts",
|
|
13
|
+
"import": "./dist/index.js",
|
|
14
|
+
"require": "./dist/index.cjs"
|
|
15
|
+
}
|
|
16
|
+
},
|
|
17
|
+
"files": [
|
|
18
|
+
"dist",
|
|
19
|
+
"docs",
|
|
20
|
+
"README.md"
|
|
21
|
+
],
|
|
22
|
+
"scripts": {
|
|
23
|
+
"build": "tsup",
|
|
24
|
+
"dev": "tsup --watch",
|
|
25
|
+
"test": "jest"
|
|
26
|
+
},
|
|
27
|
+
"devDependencies": {
|
|
28
|
+
"@jest/types": "^29.6.3",
|
|
29
|
+
"@types/jest": "^30.0.0",
|
|
30
|
+
"@types/node": "^25.0.3",
|
|
31
|
+
"jest": "^29.7.0",
|
|
32
|
+
"ts-jest": "^29.4.6",
|
|
33
|
+
"ts-node": "^10.9.2",
|
|
34
|
+
"tsup": "^8.2.4",
|
|
35
|
+
"typescript": "^5.6.3"
|
|
36
|
+
},
|
|
37
|
+
"dependencies": {
|
|
38
|
+
"undici": "^7.18.2"
|
|
39
|
+
}
|
|
40
|
+
}
|