@gregiteen/ssss-cli 0.8.0 → 0.9.1

package/src/authorization.mjs

@@ -0,0 +1,62 @@
+/** Verified identity and fail-closed capability authorization contracts. */
+const PRINCIPAL_KINDS = new Set(['human', 'agent', 'service', 'system']);
+const ACTIONS = new Set(['create', 'replace', 'patch', 'append', 'event', 'delete', 'define', 'migrate']);
+const ASSURANCE = { unverified: 0, verified: 1, elevated: 2, hardware: 3 };
+
+export function validateVerifiedPrincipal(principal) {
+  const errors = [];
+  if (!principal || typeof principal !== 'object') errors.push('Verified principal is required.');
+  else {
+    if (typeof principal.id !== 'string' || !principal.id) errors.push('Principal id is required.');
+    if (!PRINCIPAL_KINDS.has(principal.kind)) errors.push(`Principal kind must be one of: ${[...PRINCIPAL_KINDS].join(', ')}.`);
+    if (!Array.isArray(principal.workspaceIds)) errors.push('Principal workspaceIds must be an array.');
+    if (!principal.authentication || typeof principal.authentication.provider !== 'string') {
+      errors.push('Authentication provenance is required.');
+    }
+  }
+  return { valid: errors.length === 0, errors };
+}
+
+export function requiredCapabilities(definition, action) {
+  if (!ACTIONS.has(action)) throw new Error(`Unknown authorization action '${action}'.`);
+  const declared = definition?.capabilities?.[action];
+  if (Array.isArray(declared) && declared.length) return declared;
+  const primitive = definition?.qualified_type || definition?.type || 'unknown';
+  return [`${primitive}:${action}`];
+}
+
+export function createCapabilityAuthorizer(options = {}) {
+  const policyFloors = options.policyFloors || {};
+  return async function authorize({ principal, workspaceId, definition, action, context = {} }) {
+    const principalValidation = validateVerifiedPrincipal(principal);
+    if (!principalValidation.valid) return { allowed: false, reason: principalValidation.errors.join(' ') };
+    if (principal.kind !== 'system' && !principal.workspaceIds.includes(workspaceId)) {
+      return { allowed: false, reason: `Principal '${principal.id}' is not scoped to workspace '${workspaceId}'.` };
+    }
+    const floorKey = definition?.qualified_type || definition?.primitive_id || definition?.type;
+    const required = new Set([
+      ...requiredCapabilities(definition, action),
+      ...(policyFloors[floorKey]?.[action] || []),
+      ...(context.policyFloor || []),
+    ]);
+    const granted = new Set(principal.capabilities || []);
+    if (principal.kind === 'system' && options.systemBypass !== false) return { allowed: true, required: [...required] };
+    const missing = [...required].filter((capability) =>
+      !granted.has(capability) && !granted.has('*:*') && !granted.has(`${capability.split(':')[0]}:*`));
+    if (missing.length) return { allowed: false, required: [...required], missing, reason: `Missing capabilities: ${missing.join(', ')}.` };
+    if (context.requiresHumanConfirmation && principal.kind !== 'human') {
+      return { allowed: false, required: [...required], reason: 'A verified human confirmation is required.' };
+    }
+    if (context.requiresHumanConfirmation && context.humanConfirmation !== true) {
+      return { allowed: false, required: [...required], reason: 'Explicit human confirmation is required.' };
+    }
+    if (context.requiredAssurance) {
+      const actual = ASSURANCE[principal.authentication.assurance] ?? -1;
+      const requiredAssurance = ASSURANCE[context.requiredAssurance] ?? Number.POSITIVE_INFINITY;
+      if (actual < requiredAssurance) {
+        return { allowed: false, required: [...required], reason: `Authentication step-up to '${context.requiredAssurance}' is required.` };
+      }
+    }
+    return { allowed: true, required: [...required] };
+  };
+}

package/src/bundle.mjs

@@ -197,6 +197,17 @@ export function exportBundle(vaultRoot, opts = {}) {
   }
 
   const files = canonicalFiles(kept);
+  const hash = contentHash(files);
+  const primitiveDeps = Object.keys(inventory).sort();
+  const migrationDeps = files
+    .map((file) => {
+      try {
+        const { data } = parseDocument(file.content);
+        return data.type === 'migration' ? (data.migration_id || data.slug || file.path) : null;
+      } catch { return null; }
+    })
+    .filter(Boolean)
+    .sort();
   const manifest = {
     name, description, version,
     exported_at: exportedAt,
@@ -204,10 +215,16 @@ export function exportBundle(vaultRoot, opts = {}) {
     required_extensions: requiredExtensions,
     export_profile: profile,
     primitive_inventory: inventory,
+    dependencies: {
+      primitives: primitiveDeps,
+      extensions: [...requiredExtensions].sort(),
+      migrations: migrationDeps,
+      integrity: { content_hash: hash, ssss_core_version: core.spec_version },
+    },
     provisioning: manifestProvisioning,
     parameters: manifestParameters,
     file_count: files.length,
-    provenance: { content_hash: contentHash(files), exporter },
+    provenance: { content_hash: hash, exporter },
   };
   // source_workspace_id is operator-identifying — only carried in a backup (§16.2).
   if (profile === 'backup' && sourceWorkspaceId) manifest.source_workspace_id = sourceWorkspaceId;
@@ -240,6 +257,25 @@ export function validateBundle(bundle, opts = {}) {
   if (!m.primitive_inventory || typeof m.primitive_inventory !== 'object' || Array.isArray(m.primitive_inventory)) {
     errors.push('manifest.primitive_inventory must be an object');
   }
+  if (m.dependencies !== undefined) {
+    if (!m.dependencies || typeof m.dependencies !== 'object' || Array.isArray(m.dependencies)) {
+      errors.push('manifest.dependencies must be an object');
+    } else {
+      for (const key of ['primitives', 'extensions', 'migrations']) {
+        if (!Array.isArray(m.dependencies[key])) errors.push(`manifest.dependencies.${key} must be an array`);
+      }
+      if (!m.dependencies.integrity || typeof m.dependencies.integrity !== 'object' || Array.isArray(m.dependencies.integrity)) {
+        errors.push('manifest.dependencies.integrity must be an object');
+      } else if (typeof m.dependencies.integrity.content_hash !== 'string' || !m.dependencies.integrity.content_hash.startsWith('sha256:')) {
+        errors.push('manifest.dependencies.integrity.content_hash must be a sha256 digest');
+      } else if (
+        m.provenance?.content_hash
+        && m.dependencies.integrity.content_hash !== m.provenance.content_hash
+      ) {
+        errors.push('manifest.dependencies.integrity.content_hash must match provenance.content_hash');
+      }
+    }
+  }
   for (const ext of requiredExtensions) {
     if (typeof ext !== 'string' || !ext) {
       errors.push('required extension ids must be non-empty strings');
@@ -429,7 +465,7 @@ export function provisionBundle(bundle, opts = {}) {
  * import(plan, target) → replay (§17.1). Runs each envelope through the engine
  * (§6.3). Idempotent: each envelope's idempotency_key makes a re-run a no-op.
  */
-export function importBundle(plan, vaultRoot, engine) {
+export async function importBundle(plan, vaultRoot, engine) {
   const dryRunFlags = new Set(plan.map((envelope) => !!envelope.dry_run));
   if (dryRunFlags.size > 1) {
     return {
@@ -457,7 +493,7 @@ export function importBundle(plan, vaultRoot, engine) {
   // Two-phase import: validate the complete plan with in-plan references first.
   // A single invalid document prevents every commit, eliminating partial bundle
   // installation and allowing dry-run to validate cross-file constraints.
-  const preflight = plan.map((envelope) => {
+  const preflight = await Promise.all(plan.map((envelope) => {
     const preflightKey = 'preflight-' + crypto.createHash('sha256')
       .update(`${envelope.workspace_id}:${envelope.idempotency_key}:${envelope.path}`)
       .digest('hex')
@@ -467,7 +503,7 @@ export function importBundle(plan, vaultRoot, engine) {
       vaultRoot,
       operationOptions
     );
-  });
+  }));
   if (!preflight.every((result) => result.success)) {
     return { ok: false, committed: 0, wouldCommit: 0, results: preflight };
   }
@@ -480,7 +516,7 @@ export function importBundle(plan, vaultRoot, engine) {
     };
   }
   const results = [];
-  for (const env of plan) results.push(engine.processOperation(env, vaultRoot, operationOptions));
+  for (const env of plan) results.push(await engine.processOperation(env, vaultRoot, operationOptions));
   const committed = results.filter((r) => r.success && !r.replay && !r.dry_run).length;
   return { ok: results.every((r) => r.success), committed, wouldCommit: 0, results };
 }