@mcp-audit-gateway/core 0.1.0 → 0.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.well-known/agent-governance.json +47 -0
- package/.well-known/security-insights-snippet.yml +9 -0
- package/CHANGELOG.md +32 -0
- package/dist/attestation/audit-log.d.ts +1 -0
- package/dist/attestation/audit-log.d.ts.map +1 -1
- package/dist/attestation/audit-log.js +19 -0
- package/dist/attestation/audit-log.js.map +1 -1
- package/dist/attestation/signer.d.ts.map +1 -1
- package/dist/attestation/signer.js +7 -0
- package/dist/attestation/signer.js.map +1 -1
- package/dist/attestation/signer.test.js +72 -0
- package/dist/attestation/signer.test.js.map +1 -1
- package/dist/index.d.ts +1 -1
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +1 -1
- package/dist/index.js.map +1 -1
- package/dist/policy/engine.d.ts +12 -1
- package/dist/policy/engine.d.ts.map +1 -1
- package/dist/policy/engine.js +26 -4
- package/dist/policy/engine.js.map +1 -1
- package/dist/policy/engine.test.js +42 -1
- package/dist/policy/engine.test.js.map +1 -1
- package/dist/proxy/gateway.d.ts.map +1 -1
- package/dist/proxy/gateway.js +5 -1
- package/dist/proxy/gateway.js.map +1 -1
- package/dist/types.d.ts +7 -0
- package/dist/types.d.ts.map +1 -1
- package/package.json +1 -1
- package/src/attestation/audit-log.ts +24 -1
- package/src/attestation/signer.test.ts +84 -0
- package/src/attestation/signer.ts +8 -1
- package/src/index.ts +1 -1
- package/src/policy/engine.test.ts +47 -1
- package/src/policy/engine.ts +38 -5
- package/src/proxy/gateway.ts +6 -1
- package/src/types.ts +8 -0
- package/test/vectors/README.md +44 -0
- package/test/vectors/canonicalization.json +582 -0
- package/test/vectors/generate.mjs +354 -0
- package/test/vectors/verify.mjs +273 -0
- package/test/vectors/verify.py +277 -0
|
@@ -0,0 +1,47 @@
|
|
|
1
|
+
{
|
|
2
|
+
"$schema": "https://ossf.github.io/security-insights/governance-declaration/v0.1",
|
|
3
|
+
"version": "0.1.0",
|
|
4
|
+
"framework": "mcp-audit-gateway",
|
|
5
|
+
"attestation": {
|
|
6
|
+
"predicate_type": "https://in-toto.io/attestation/ai-agent-action/v0.1",
|
|
7
|
+
"signing_algorithm": "ed25519",
|
|
8
|
+
"chain_algorithm": "sha256",
|
|
9
|
+
"tamper_evidence": "hash-chain",
|
|
10
|
+
"parties": [
|
|
11
|
+
{
|
|
12
|
+
"role": "witness",
|
|
13
|
+
"entity": "gateway",
|
|
14
|
+
"scope": [
|
|
15
|
+
"tool", "arguments", "result", "timing",
|
|
16
|
+
"principal", "namespace", "upstream",
|
|
17
|
+
"previousHash", "recordId", "method", "success"
|
|
18
|
+
]
|
|
19
|
+
},
|
|
20
|
+
{
|
|
21
|
+
"role": "asserter",
|
|
22
|
+
"entity": "policy-engine",
|
|
23
|
+
"scope": ["decisionContextDigest"]
|
|
24
|
+
}
|
|
25
|
+
]
|
|
26
|
+
},
|
|
27
|
+
"policy": {
|
|
28
|
+
"engine": "opa",
|
|
29
|
+
"bundle_digest_algorithm": "sha256",
|
|
30
|
+
"evaluation_record": true,
|
|
31
|
+
"human_approval_required": false
|
|
32
|
+
},
|
|
33
|
+
"observability": {
|
|
34
|
+
"otel_semconv": "mcp/v1.44.0",
|
|
35
|
+
"metrics": [
|
|
36
|
+
"mcp.client.operation.duration",
|
|
37
|
+
"mcp.server.operation.duration"
|
|
38
|
+
],
|
|
39
|
+
"traces": true,
|
|
40
|
+
"context_propagation": "w3c-traceparent"
|
|
41
|
+
},
|
|
42
|
+
"verification": {
|
|
43
|
+
"conformance_vectors": "https://github.com/elang2/mcp-audit-gateway/tree/main/test/vectors",
|
|
44
|
+
"cross_language": ["javascript", "python"],
|
|
45
|
+
"vector_count": 17
|
|
46
|
+
}
|
|
47
|
+
}
|
|
@@ -0,0 +1,9 @@
|
|
|
1
|
+
# Example security-insights.yml snippet demonstrating SIEP-171 integration
|
|
2
|
+
# This shows how governance-declaration works with a machine-readable target
|
|
3
|
+
|
|
4
|
+
repository:
|
|
5
|
+
url: https://github.com/elang2/mcp-audit-gateway
|
|
6
|
+
status: active
|
|
7
|
+
agent-assisted-production:
|
|
8
|
+
used: true
|
|
9
|
+
governance-declaration: https://github.com/elang2/mcp-audit-gateway/blob/main/.well-known/agent-governance.json
|
package/CHANGELOG.md
ADDED
|
@@ -0,0 +1,32 @@
|
|
|
1
|
+
# Changelog
|
|
2
|
+
|
|
3
|
+
## [0.2.0] - 2026-08-22
|
|
4
|
+
|
|
5
|
+
### Added
|
|
6
|
+
|
|
7
|
+
- Multi-party attribution: each audit record now declares which entity (gateway, policy-engine) witnessed or asserted which fields via the `parties` array
|
|
8
|
+
- `decisionContextDigest` field: SHA-256 digest of the policy evaluation context, linking audit records to specific policy decisions
|
|
9
|
+
- Conformance test vectors: 17 vectors covering canonicalization (8), hash chain (3), and party attribution (6)
|
|
10
|
+
- Cross-language verifiers: JavaScript (`test/vectors/verify.mjs`) and Python (`test/vectors/verify.py`) both pass all 17 vectors byte-identical
|
|
11
|
+
- `.well-known/agent-governance.json`: machine-readable governance declaration implementing the OpenSSF SIEP-171 pattern
|
|
12
|
+
- Edge-case vectors for party attribution: empty array vs null, scope ordering significance, chain continuity with parties
|
|
13
|
+
|
|
14
|
+
### Changed
|
|
15
|
+
|
|
16
|
+
- Canonical form now conditionally includes `decisionContextDigest` at position 10 and `parties` at the end when present
|
|
17
|
+
- Backward-compatible: records without these fields produce identical canonical hashes to v0.1.0
|
|
18
|
+
|
|
19
|
+
## [0.1.0] - 2026-08-16
|
|
20
|
+
|
|
21
|
+
### Added
|
|
22
|
+
|
|
23
|
+
- Initial release
|
|
24
|
+
- Transparent MCP proxy with `mcp-audit wrap` CLI
|
|
25
|
+
- HMAC-SHA256 and Ed25519 attestation signing
|
|
26
|
+
- SHA-256 hash-chained audit log (JSONL)
|
|
27
|
+
- Full gateway mode with multi-upstream routing and tool namespacing
|
|
28
|
+
- OPA-style policy engine with glob-based ACLs and per-principal rate limits
|
|
29
|
+
- OpenTelemetry traces and metrics export
|
|
30
|
+
- Chain verification CLI (`mcp-audit verify`)
|
|
31
|
+
- Live tail CLI (`mcp-audit tail`)
|
|
32
|
+
- Key generation CLI (`mcp-audit keygen`)
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../../src/attestation/audit-log.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,
|
|
1
|
+
{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../../src/attestation/audit-log.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAoB,MAAM,aAAa,CAAC;AACjE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAsB1C,wBAAgB,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAGtD;AAED,qBAAa,QAAQ;IAMjB,OAAO,CAAC,IAAI;IACZ,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,gBAAgB;IAP1B,OAAO,CAAC,WAAW,CAAK;IACxB,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,UAAU,CAAoC;gBAG5C,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,MAAM;IAG5B,MAAM,CACV,MAAM,EAAE,MAAM,EACd,IAAI,EAAE;QACJ,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,OAAO,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,qBAAqB,CAAC,EAAE,MAAM,CAAC;KAChC,GACA,OAAO,CAAC,WAAW,CAAC;YAaT,WAAW;YAqCX,MAAM;IAUd,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAmC5B"}
|
|
@@ -1,5 +1,23 @@
|
|
|
1
1
|
import { appendFile, stat, rename, open } from "node:fs/promises";
|
|
2
2
|
import { createHash, randomUUID } from "node:crypto";
|
|
3
|
+
const GATEWAY_WITNESSED_FIELDS = [
|
|
4
|
+
"id", "timestamp", "method", "toolName", "namespace",
|
|
5
|
+
"upstream", "principal", "durationMs", "success", "errorCode",
|
|
6
|
+
"previousHash",
|
|
7
|
+
];
|
|
8
|
+
function buildParties(hasDecisionContext) {
|
|
9
|
+
const parties = [
|
|
10
|
+
{ party: "gateway", role: "witness", scope: GATEWAY_WITNESSED_FIELDS },
|
|
11
|
+
];
|
|
12
|
+
if (hasDecisionContext) {
|
|
13
|
+
parties.push({
|
|
14
|
+
party: "policy-engine",
|
|
15
|
+
role: "asserter",
|
|
16
|
+
scope: ["decisionContextDigest"],
|
|
17
|
+
});
|
|
18
|
+
}
|
|
19
|
+
return parties;
|
|
20
|
+
}
|
|
3
21
|
export function hashRecord(record) {
|
|
4
22
|
const json = JSON.stringify(record);
|
|
5
23
|
return createHash("sha256").update(json).digest("hex");
|
|
@@ -35,6 +53,7 @@ export class AuditLog {
|
|
|
35
53
|
timestamp: new Date().toISOString(),
|
|
36
54
|
method,
|
|
37
55
|
...opts,
|
|
56
|
+
parties: buildParties(opts.decisionContextDigest != null),
|
|
38
57
|
previousHash: this.lastHash,
|
|
39
58
|
};
|
|
40
59
|
record.attestation = await this.signer.sign(record);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"audit-log.js","sourceRoot":"","sources":["../../src/attestation/audit-log.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIrD,MAAM,UAAU,UAAU,CAAC,MAAmB;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACpC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,OAAO,QAAQ;IAMT;IACA;IACA;IAPF,WAAW,GAAG,CAAC,CAAC;IAChB,QAAQ,GAAW,SAAS,CAAC;IAC7B,UAAU,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAEtD,YACU,IAAY,EACZ,MAAc,EACd,gBAAwB;QAFxB,SAAI,GAAJ,IAAI,CAAQ;QACZ,WAAM,GAAN,MAAM,CAAQ;QACd,qBAAgB,GAAhB,gBAAgB,CAAQ;IAC/B,CAAC;IAEJ,KAAK,CAAC,MAAM,CACV,MAAc,EACd,
|
|
1
|
+
{"version":3,"file":"audit-log.js","sourceRoot":"","sources":["../../src/attestation/audit-log.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIrD,MAAM,wBAAwB,GAAG;IAC/B,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW;IACpD,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW;IAC7D,cAAc;CACf,CAAC;AAEF,SAAS,YAAY,CAAC,kBAA2B;IAC/C,MAAM,OAAO,GAAuB;QAClC,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,wBAAwB,EAAE;KACvE,CAAC;IACF,IAAI,kBAAkB,EAAE,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,eAAe;YACtB,IAAI,EAAE,UAAU;YAChB,KAAK,EAAE,CAAC,uBAAuB,CAAC;SACjC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAmB;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACpC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,OAAO,QAAQ;IAMT;IACA;IACA;IAPF,WAAW,GAAG,CAAC,CAAC;IAChB,QAAQ,GAAW,SAAS,CAAC;IAC7B,UAAU,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAEtD,YACU,IAAY,EACZ,MAAc,EACd,gBAAwB;QAFxB,SAAI,GAAJ,IAAI,CAAQ;QACZ,WAAM,GAAN,MAAM,CAAQ;QACd,qBAAgB,GAAhB,gBAAgB,CAAQ;IAC/B,CAAC;IAEJ,KAAK,CAAC,MAAM,CACV,MAAc,EACd,IASC;QAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;gBAChD,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;oBACpD,OAAO,CAAC,MAAM,CAAC,CAAC;gBAClB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,CAAC,GAAG,CAAC,CAAC;gBACd,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,MAAc,EACd,IASC;QAED,MAAM,MAAM,GAAgB;YAC1B,EAAE,EAAE,UAAU,EAAE;YAChB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,MAAM;YACN,GAAG,IAAI;YACP,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,qBAAqB,IAAI,IAAI,CAAC;YACzD,YAAY,EAAE,IAAI,CAAC,QAAQ;SAC5B,CAAC;QAEF,MAAM,CAAC,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;QAE3C,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAE5C,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QAEnC,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC9C,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACtB,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,MAAM;QAClB,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QAClE,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YACrC,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;YACrB,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,CAAC;QACN,IAAI,CAAC;YACH,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC;QAE1B,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACxC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACnC,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,GAAG,QAAQ,CAAC,CAAC;gBACnD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACnC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACzC,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;oBAC3C,IAAI,CAAC;wBACH,MAAM,MAAM,GAAgB,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;wBACjD,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;wBACnC,OAAO;oBACT,CAAC;oBAAC,MAAM,CAAC;wBACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,yDAAyD,CAC1D,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;YACnB,CAAC;QACH,CAAC;IACH,CAAC;CACF"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"signer.d.ts","sourceRoot":"","sources":["../../src/attestation/signer.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAElE,MAAM,WAAW,MAAM;IACrB,IAAI,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAClE;AAED,qBAAa,UAAW,YAAW,MAAM;IACvC,OAAO,CAAC,MAAM,CAAS;gBAEX,MAAM,EAAE,MAAM;IAIpB,IAAI,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;IAO1C,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQtE,OAAO,CAAC,YAAY;CAGrB;AAED,qBAAa,aAAc,YAAW,MAAM;IAI9B,OAAO,CAAC,OAAO,CAAC;IAH5B,OAAO,CAAC,UAAU,CAA2B;IAC7C,OAAO,CAAC,SAAS,CAA2B;gBAExB,OAAO,CAAC,EAAE,MAAM,YAAA;IAE9B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAYrB,IAAI,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;IAQ1C,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQtE,YAAY,IAAI,UAAU,GAAG,IAAI;IAIjC,OAAO,CAAC,YAAY;CAGrB;
|
|
1
|
+
{"version":3,"file":"signer.d.ts","sourceRoot":"","sources":["../../src/attestation/signer.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAElE,MAAM,WAAW,MAAM;IACrB,IAAI,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAClE;AAED,qBAAa,UAAW,YAAW,MAAM;IACvC,OAAO,CAAC,MAAM,CAAS;gBAEX,MAAM,EAAE,MAAM;IAIpB,IAAI,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;IAO1C,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQtE,OAAO,CAAC,YAAY;CAGrB;AAED,qBAAa,aAAc,YAAW,MAAM;IAI9B,OAAO,CAAC,OAAO,CAAC;IAH5B,OAAO,CAAC,UAAU,CAA2B;IAC7C,OAAO,CAAC,SAAS,CAA2B;gBAExB,OAAO,CAAC,EAAE,MAAM,YAAA;IAE9B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAYrB,IAAI,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;IAQ1C,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQtE,YAAY,IAAI,UAAU,GAAG,IAAI;IAIjC,OAAO,CAAC,YAAY;CAGrB;AA0BD,wBAAgB,YAAY,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAS9D"}
|
|
@@ -78,6 +78,13 @@ function canonicalizeRecord(record) {
|
|
|
78
78
|
["errorCode", record.errorCode ?? null],
|
|
79
79
|
["previousHash", record.previousHash ?? null],
|
|
80
80
|
];
|
|
81
|
+
if (record.decisionContextDigest != null) {
|
|
82
|
+
ordered.splice(10, 0, ["decisionContextDigest", record.decisionContextDigest]);
|
|
83
|
+
}
|
|
84
|
+
if (record.parties != null) {
|
|
85
|
+
const insertAt = record.decisionContextDigest != null ? 12 : 11;
|
|
86
|
+
ordered.splice(insertAt, 0, ["parties", record.parties]);
|
|
87
|
+
}
|
|
81
88
|
return JSON.stringify(ordered);
|
|
82
89
|
}
|
|
83
90
|
export function createSigner(config) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"signer.js","sourceRoot":"","sources":["../../src/attestation/signer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAQvE,MAAM,OAAO,UAAU;IACb,MAAM,CAAS;IAEvB,YAAY,MAAc;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAmB;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAmB,EAAE,SAAiB;QACjD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACjD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACnD,IAAI,WAAW,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC7D,OAAO,eAAe,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACpD,CAAC;IAEO,YAAY,CAAC,MAAmB;QACtC,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,aAAa;IAIJ;IAHZ,UAAU,GAAsB,IAAI,CAAC;IACrC,SAAS,GAAsB,IAAI,CAAC;IAE5C,YAAoB,OAAgB;QAAhB,YAAO,GAAP,OAAO,CAAS;IAAG,CAAC;IAExC,KAAK,CAAC,IAAI;QACR,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;YACtD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC7C,IAAI,CAAC,UAAU,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAChD,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAmB;QAC5B,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,UAAW,CAAC,CAAC;QAC1D,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAmB,EAAE,SAAiB;QACjD,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACvC,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC1C,OAAO,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,SAAU,CAAC,CAAC;IACvD,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAEO,YAAY,CAAC,MAAmB;QACtC,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;CACF;AAED,SAAS,kBAAkB,CAAC,MAAmB;IAC7C,MAAM,OAAO,
|
|
1
|
+
{"version":3,"file":"signer.js","sourceRoot":"","sources":["../../src/attestation/signer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAQvE,MAAM,OAAO,UAAU;IACb,MAAM,CAAS;IAEvB,YAAY,MAAc;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAmB;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAmB,EAAE,SAAiB;QACjD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACjD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACnD,IAAI,WAAW,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC7D,OAAO,eAAe,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACpD,CAAC;IAEO,YAAY,CAAC,MAAmB;QACtC,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,aAAa;IAIJ;IAHZ,UAAU,GAAsB,IAAI,CAAC;IACrC,SAAS,GAAsB,IAAI,CAAC;IAE5C,YAAoB,OAAgB;QAAhB,YAAO,GAAP,OAAO,CAAS;IAAG,CAAC;IAExC,KAAK,CAAC,IAAI;QACR,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;YACtD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC7C,IAAI,CAAC,UAAU,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAChD,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAmB;QAC5B,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,UAAW,CAAC,CAAC;QAC1D,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAmB,EAAE,SAAiB;QACjD,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACvC,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC1C,OAAO,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,SAAU,CAAC,CAAC;IACvD,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAEO,YAAY,CAAC,MAAmB;QACtC,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;CACF;AAED,SAAS,kBAAkB,CAAC,MAAmB;IAC7C,MAAM,OAAO,GAA2D;QACtE,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QACjB,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC;QAC/B,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;QACzB,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC;QACrC,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC;QACvC,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC;QACrC,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC;QACvC,CAAC,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC;QACjC,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC;QAC3B,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC;QACvC,CAAC,cAAc,EAAE,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC;KAC9C,CAAC;IACF,IAAI,MAAM,CAAC,qBAAqB,IAAI,IAAI,EAAE,CAAC;QACzC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,uBAAuB,EAAE,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,qBAAqB,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAyB;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;IAC5D,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,aAAa,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAChE,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,IAAI,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC3C,CAAC"}
|
|
@@ -34,6 +34,78 @@ describe("HmacSigner", () => {
|
|
|
34
34
|
expect(valid).toBe(false);
|
|
35
35
|
});
|
|
36
36
|
});
|
|
37
|
+
describe("decisionContextDigest in signatures", () => {
|
|
38
|
+
const secret = "b".repeat(64);
|
|
39
|
+
const signer = new HmacSigner(secret);
|
|
40
|
+
const recordWithDigest = {
|
|
41
|
+
...mockRecord,
|
|
42
|
+
id: "test-uuid-002",
|
|
43
|
+
decisionContextDigest: "c".repeat(64),
|
|
44
|
+
};
|
|
45
|
+
it("includes digest in signature when present", async () => {
|
|
46
|
+
const sigWith = await signer.sign(recordWithDigest);
|
|
47
|
+
const sigWithout = await signer.sign(mockRecord);
|
|
48
|
+
expect(sigWith).not.toBe(sigWithout);
|
|
49
|
+
});
|
|
50
|
+
it("verifies record with digest", async () => {
|
|
51
|
+
const sig = await signer.sign(recordWithDigest);
|
|
52
|
+
const valid = await signer.verify(recordWithDigest, sig);
|
|
53
|
+
expect(valid).toBe(true);
|
|
54
|
+
});
|
|
55
|
+
it("rejects tampered digest", async () => {
|
|
56
|
+
const sig = await signer.sign(recordWithDigest);
|
|
57
|
+
const tampered = { ...recordWithDigest, decisionContextDigest: "d".repeat(64) };
|
|
58
|
+
const valid = await signer.verify(tampered, sig);
|
|
59
|
+
expect(valid).toBe(false);
|
|
60
|
+
});
|
|
61
|
+
it("old records without digest still verify", async () => {
|
|
62
|
+
const oldRecord = { ...mockRecord, id: "old-record-001" };
|
|
63
|
+
const sig = await signer.sign(oldRecord);
|
|
64
|
+
const valid = await signer.verify(oldRecord, sig);
|
|
65
|
+
expect(valid).toBe(true);
|
|
66
|
+
});
|
|
67
|
+
});
|
|
68
|
+
describe("parties in signatures", () => {
|
|
69
|
+
const secret = "c".repeat(64);
|
|
70
|
+
const signer = new HmacSigner(secret);
|
|
71
|
+
const recordWithParties = {
|
|
72
|
+
...mockRecord,
|
|
73
|
+
id: "test-uuid-parties-001",
|
|
74
|
+
parties: [
|
|
75
|
+
{ party: "gateway", role: "witness", scope: ["id", "timestamp", "method", "toolName", "namespace", "upstream", "principal", "durationMs", "success", "errorCode", "previousHash"] },
|
|
76
|
+
],
|
|
77
|
+
};
|
|
78
|
+
it("includes parties in signature when present", async () => {
|
|
79
|
+
const sigWith = await signer.sign(recordWithParties);
|
|
80
|
+
const sigWithout = await signer.sign(mockRecord);
|
|
81
|
+
expect(sigWith).not.toBe(sigWithout);
|
|
82
|
+
});
|
|
83
|
+
it("verifies record with parties", async () => {
|
|
84
|
+
const sig = await signer.sign(recordWithParties);
|
|
85
|
+
const valid = await signer.verify(recordWithParties, sig);
|
|
86
|
+
expect(valid).toBe(true);
|
|
87
|
+
});
|
|
88
|
+
it("rejects tampered parties", async () => {
|
|
89
|
+
const sig = await signer.sign(recordWithParties);
|
|
90
|
+
const tampered = { ...recordWithParties, parties: [{ party: "attacker", role: "asserter", scope: ["*"] }] };
|
|
91
|
+
const valid = await signer.verify(tampered, sig);
|
|
92
|
+
expect(valid).toBe(false);
|
|
93
|
+
});
|
|
94
|
+
it("handles both decisionContextDigest and parties together", async () => {
|
|
95
|
+
const dual = {
|
|
96
|
+
...recordWithParties,
|
|
97
|
+
id: "test-uuid-parties-002",
|
|
98
|
+
decisionContextDigest: "e".repeat(64),
|
|
99
|
+
parties: [
|
|
100
|
+
{ party: "gateway", role: "witness", scope: ["id", "timestamp", "method"] },
|
|
101
|
+
{ party: "policy-engine", role: "asserter", scope: ["decisionContextDigest"] },
|
|
102
|
+
],
|
|
103
|
+
};
|
|
104
|
+
const sig = await signer.sign(dual);
|
|
105
|
+
const valid = await signer.verify(dual, sig);
|
|
106
|
+
expect(valid).toBe(true);
|
|
107
|
+
});
|
|
108
|
+
});
|
|
37
109
|
describe("Ed25519Signer", () => {
|
|
38
110
|
it("signs and verifies a record", async () => {
|
|
39
111
|
const signer = new Ed25519Signer();
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"signer.test.js","sourceRoot":"","sources":["../../src/attestation/signer.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGxD,MAAM,UAAU,GAAgB;IAC9B,EAAE,EAAE,eAAe;IACnB,SAAS,EAAE,0BAA0B;IACrC,MAAM,EAAE,YAAY;IACpB,QAAQ,EAAE,kBAAkB;IAC5B,SAAS,EAAE,QAAQ;IACnB,QAAQ,EAAE,eAAe;IACzB,SAAS,EAAE,eAAe;IAC1B,UAAU,EAAE,GAAG;IACf,OAAO,EAAE,IAAI;CACd,CAAC;AAEF,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAEtC,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;QACxC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;QAC1C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACnD,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;QACzC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,EAAE,GAAG,UAAU,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACjD,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;QACzC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC;QACtE,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;QAC3C,MAAM,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QACnC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAEpB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAExC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACnD,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;QACzC,MAAM,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QACnC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAEpB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACjD,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QACnC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAEpB,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,CAAC,MAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
|
|
1
|
+
{"version":3,"file":"signer.test.js","sourceRoot":"","sources":["../../src/attestation/signer.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGxD,MAAM,UAAU,GAAgB;IAC9B,EAAE,EAAE,eAAe;IACnB,SAAS,EAAE,0BAA0B;IACrC,MAAM,EAAE,YAAY;IACpB,QAAQ,EAAE,kBAAkB;IAC5B,SAAS,EAAE,QAAQ;IACnB,QAAQ,EAAE,eAAe;IACzB,SAAS,EAAE,eAAe;IAC1B,UAAU,EAAE,GAAG;IACf,OAAO,EAAE,IAAI;CACd,CAAC;AAEF,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAEtC,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;QACxC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;QAC1C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACnD,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;QACzC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,EAAE,GAAG,UAAU,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACjD,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;QACzC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC;QACtE,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qCAAqC,EAAE,GAAG,EAAE;IACnD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAEtC,MAAM,gBAAgB,GAAgB;QACpC,GAAG,UAAU;QACb,EAAE,EAAE,eAAe;QACnB,qBAAqB,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;KACtC,CAAC;IAEF,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACpD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjD,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;QAC3C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;QACzD,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,KAAK,IAAI,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,EAAE,GAAG,gBAAgB,EAAE,qBAAqB,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;QAChF,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACjD,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,SAAS,GAAgB,EAAE,GAAG,UAAU,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC;QACvE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAClD,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAEtC,MAAM,iBAAiB,GAAgB;QACrC,GAAG,UAAU;QACb,EAAE,EAAE,uBAAuB;QAC3B,OAAO,EAAE;YACP,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,CAAC,EAAE;SACpL;KACF,CAAC;IAEF,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACrD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjD,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;QAC1D,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;QACxC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,EAAE,GAAG,iBAAiB,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,UAAmB,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;QACrH,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACjD,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,IAAI,GAAgB;YACxB,GAAG,iBAAiB;YACpB,EAAE,EAAE,uBAAuB;YAC3B,qBAAqB,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACrC,OAAO,EAAE;gBACP,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE;gBAC3E,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,uBAAuB,CAAC,EAAE;aAC/E;SACF,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;QAC3C,MAAM,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QACnC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAEpB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAExC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACnD,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;QACzC,MAAM,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QACnC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAEpB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACjD,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QACnC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAEpB,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,CAAC,MAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -2,7 +2,7 @@ export { Gateway, ToolCallError } from "./proxy/gateway.js";
|
|
|
2
2
|
export { runWrapProxy } from "./wrap/proxy.js";
|
|
3
3
|
export { McpServerAdapter } from "./proxy/mcp-server-adapter.js";
|
|
4
4
|
export { UpstreamManager } from "./proxy/upstream-manager.js";
|
|
5
|
-
export { PolicyEngine } from "./policy/engine.js";
|
|
5
|
+
export { PolicyEngine, computeDecisionContextDigest, type DecisionContext } from "./policy/engine.js";
|
|
6
6
|
export { AuditLog } from "./attestation/audit-log.js";
|
|
7
7
|
export { createSigner, HmacSigner, Ed25519Signer } from "./attestation/signer.js";
|
|
8
8
|
export { verifyAuditLog } from "./attestation/verify.js";
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,4BAA4B,EAAE,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACtG,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EACL,mBAAmB,EACnB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,cAAc,GACpB,MAAM,YAAY,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -2,7 +2,7 @@ export { Gateway, ToolCallError } from "./proxy/gateway.js";
|
|
|
2
2
|
export { runWrapProxy } from "./wrap/proxy.js";
|
|
3
3
|
export { McpServerAdapter } from "./proxy/mcp-server-adapter.js";
|
|
4
4
|
export { UpstreamManager } from "./proxy/upstream-manager.js";
|
|
5
|
-
export { PolicyEngine } from "./policy/engine.js";
|
|
5
|
+
export { PolicyEngine, computeDecisionContextDigest } from "./policy/engine.js";
|
|
6
6
|
export { AuditLog } from "./attestation/audit-log.js";
|
|
7
7
|
export { createSigner, HmacSigner, Ed25519Signer } from "./attestation/signer.js";
|
|
8
8
|
export { verifyAuditLog } from "./attestation/verify.js";
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,4BAA4B,EAAwB,MAAM,oBAAoB,CAAC;AACtG,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EACL,mBAAmB,GASpB,MAAM,YAAY,CAAC"}
|
package/dist/policy/engine.d.ts
CHANGED
|
@@ -7,12 +7,23 @@ export interface PolicyDecision {
|
|
|
7
7
|
maxPerHour?: number;
|
|
8
8
|
};
|
|
9
9
|
}
|
|
10
|
+
export interface DecisionContext {
|
|
11
|
+
principal: string | null;
|
|
12
|
+
toolName: string;
|
|
13
|
+
toolNamespace: string;
|
|
14
|
+
toolUpstream: string;
|
|
15
|
+
matchedRule: PolicyRule | null;
|
|
16
|
+
effect: "allow" | "deny";
|
|
17
|
+
}
|
|
18
|
+
export declare function computeDecisionContextDigest(ctx: DecisionContext): string;
|
|
10
19
|
export declare class PolicyEngine {
|
|
11
20
|
private defaultEffect;
|
|
12
21
|
private rules;
|
|
13
22
|
private rateLimitState;
|
|
14
23
|
constructor(defaultEffect: "allow" | "deny", rules: PolicyRule[]);
|
|
15
|
-
evaluate(principal: string | undefined, tool: ToolEntry): PolicyDecision
|
|
24
|
+
evaluate(principal: string | undefined, tool: ToolEntry): PolicyDecision & {
|
|
25
|
+
decisionContext: DecisionContext;
|
|
26
|
+
};
|
|
16
27
|
filterTools(principal: string | undefined, tools: ToolEntry[]): ToolEntry[];
|
|
17
28
|
recordInvocation(principal: string | undefined, tool: ToolEntry): void;
|
|
18
29
|
private ruleMatches;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/policy/engine.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/policy/engine.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAEzD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5D;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,UAAU,GAAG,IAAI,CAAC;IAC/B,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;CAC1B;AAED,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,CAWzE;AAOD,qBAAa,YAAY;IAOrB,OAAO,CAAC,aAAa;IACrB,OAAO,CAAC,KAAK;IAPf,OAAO,CAAC,cAAc,CAGpB;gBAGQ,aAAa,EAAE,OAAO,GAAG,MAAM,EAC/B,KAAK,EAAE,UAAU,EAAE;IAG7B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,SAAS,GAAG,cAAc,GAAG;QAAE,eAAe,EAAE,eAAe,CAAA;KAAE;IAuC/G,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,SAAS,EAAE;IAI3E,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,SAAS,GAAG,IAAI;IAKtE,OAAO,CAAC,WAAW;IA2BnB,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,SAAS;IA4BjB,OAAO,CAAC,cAAc;IAuBtB,OAAO,CAAC,gBAAgB;CAiBzB"}
|
package/dist/policy/engine.js
CHANGED
|
@@ -1,3 +1,16 @@
|
|
|
1
|
+
import { createHash } from "node:crypto";
|
|
2
|
+
export function computeDecisionContextDigest(ctx) {
|
|
3
|
+
const ordered = [
|
|
4
|
+
["principal", ctx.principal],
|
|
5
|
+
["toolName", ctx.toolName],
|
|
6
|
+
["toolNamespace", ctx.toolNamespace],
|
|
7
|
+
["toolUpstream", ctx.toolUpstream],
|
|
8
|
+
["matchedRule", ctx.matchedRule],
|
|
9
|
+
["effect", ctx.effect],
|
|
10
|
+
];
|
|
11
|
+
const canonical = JSON.stringify(ordered);
|
|
12
|
+
return createHash("sha256").update(canonical).digest("hex");
|
|
13
|
+
}
|
|
1
14
|
export class PolicyEngine {
|
|
2
15
|
defaultEffect;
|
|
3
16
|
rules;
|
|
@@ -17,20 +30,29 @@ export class PolicyEngine {
|
|
|
17
30
|
break;
|
|
18
31
|
}
|
|
19
32
|
}
|
|
33
|
+
const buildContext = (effect) => ({
|
|
34
|
+
principal: principal ?? null,
|
|
35
|
+
toolName: tool.name,
|
|
36
|
+
toolNamespace: tool.namespace,
|
|
37
|
+
toolUpstream: tool.upstream,
|
|
38
|
+
matchedRule,
|
|
39
|
+
effect,
|
|
40
|
+
});
|
|
20
41
|
if (!matchedRule) {
|
|
21
|
-
|
|
42
|
+
const allowed = this.defaultEffect === "allow";
|
|
43
|
+
return { allowed, decisionContext: buildContext(allowed ? "allow" : "deny") };
|
|
22
44
|
}
|
|
23
45
|
if (matchedRule.effect === "deny") {
|
|
24
|
-
return { allowed: false, reason: "denied by policy rule" };
|
|
46
|
+
return { allowed: false, reason: "denied by policy rule", decisionContext: buildContext("deny") };
|
|
25
47
|
}
|
|
26
48
|
if (matchedRule.rateLimit) {
|
|
27
49
|
const key = `${principal ?? "anonymous"}:${tool.name}`;
|
|
28
50
|
const rateLimited = this.checkRateLimit(key, matchedRule.rateLimit);
|
|
29
51
|
if (rateLimited) {
|
|
30
|
-
return { allowed: false, reason: "rate limit exceeded", rateLimit: matchedRule.rateLimit };
|
|
52
|
+
return { allowed: false, reason: "rate limit exceeded", rateLimit: matchedRule.rateLimit, decisionContext: buildContext("deny") };
|
|
31
53
|
}
|
|
32
54
|
}
|
|
33
|
-
return { allowed: true, rateLimit: matchedRule.rateLimit };
|
|
55
|
+
return { allowed: true, rateLimit: matchedRule.rateLimit, decisionContext: buildContext("allow") };
|
|
34
56
|
}
|
|
35
57
|
filterTools(principal, tools) {
|
|
36
58
|
return tools.filter((tool) => this.evaluate(principal, tool).allowed);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../src/policy/engine.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../src/policy/engine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAkBzC,MAAM,UAAU,4BAA4B,CAAC,GAAoB;IAC/D,MAAM,OAAO,GAAwB;QACnC,CAAC,WAAW,EAAE,GAAG,CAAC,SAAS,CAAC;QAC5B,CAAC,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC;QAC1B,CAAC,eAAe,EAAE,GAAG,CAAC,aAAa,CAAC;QACpC,CAAC,cAAc,EAAE,GAAG,CAAC,YAAY,CAAC;QAClC,CAAC,aAAa,EAAE,GAAG,CAAC,WAAW,CAAC;QAChC,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC;KACvB,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC1C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAOD,MAAM,OAAO,YAAY;IAOb;IACA;IAPF,cAAc,GAAmB;QACvC,YAAY,EAAE,IAAI,GAAG,EAAE;QACvB,UAAU,EAAE,IAAI,GAAG,EAAE;KACtB,CAAC;IAEF,YACU,aAA+B,EAC/B,KAAmB;QADnB,kBAAa,GAAb,aAAa,CAAkB;QAC/B,UAAK,GAAL,KAAK,CAAc;IAC1B,CAAC;IAEJ,QAAQ,CAAC,SAA6B,EAAE,IAAe;QACrD,IAAI,WAAW,GAAsB,IAAI,CAAC;QAE1C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC5C,WAAW,GAAG,IAAI,CAAC;gBACnB,MAAM;YACR,CAAC;QACH,CAAC;QAED,MAAM,YAAY,GAAG,CAAC,MAAwB,EAAmB,EAAE,CAAC,CAAC;YACnE,SAAS,EAAE,SAAS,IAAI,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,aAAa,EAAE,IAAI,CAAC,SAAS;YAC7B,YAAY,EAAE,IAAI,CAAC,QAAQ;YAC3B,WAAW;YACX,MAAM;SACP,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,KAAK,OAAO,CAAC;YAC/C,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QAChF,CAAC;QAED,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAClC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,eAAe,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;QACpG,CAAC;QAED,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,GAAG,SAAS,IAAI,WAAW,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACvD,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;YACpE,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,eAAe,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YACpI,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,eAAe,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;IACrG,CAAC;IAED,WAAW,CAAC,SAA6B,EAAE,KAAkB;QAC3D,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;IACxE,CAAC;IAED,gBAAgB,CAAC,SAA6B,EAAE,IAAe;QAC7D,MAAM,GAAG,GAAG,GAAG,SAAS,IAAI,WAAW,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACvD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAEO,WAAW,CACjB,IAAgB,EAChB,SAA6B,EAC7B,IAAe;QAEf,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBACnE,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC9C,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC;gBAC3C,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxD,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,cAAc,CAAC,KAAa,EAAE,QAAkB;QACtD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IACpE,CAAC;IAEO,SAAS,CAAC,OAAe,EAAE,KAAa;QAC9C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,OAAO,KAAK,KAAK,CAAC;QAErD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,GAAG,GAAG,CAAC,CAAC;QAEZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACtB,IAAI,IAAI,KAAK,EAAE;gBAAE,SAAS;YAE1B,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACZ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;oBAAE,OAAO,KAAK,CAAC;gBAC1C,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;YACpB,CAAC;iBAAM,IAAI,CAAC,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM;oBAAE,OAAO,KAAK,CAAC;gBACnD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACxC,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;gBAC/C,IAAI,WAAW,GAAG,GAAG;oBAAE,OAAO,KAAK,CAAC;YACtC,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBACrC,IAAI,GAAG,KAAK,CAAC,CAAC;oBAAE,OAAO,KAAK,CAAC;gBAC7B,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,cAAc,CACpB,GAAW,EACX,KAAqD;QAErD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,IAAI,KAAK,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACxD,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,GAAG,GAAG,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;gBACtE,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtD,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,GAAG,GAAG,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;gBACpE,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,gBAAgB,CAAC,GAAW;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;YACrC,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,MAAM,EAAE,CAAC,CAAC;QACjF,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;YACjC,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,SAAS,EAAE,CAAC,CAAC;QAClF,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,CAAC;IACH,CAAC;CACF"}
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { describe, it, expect } from "vitest";
|
|
2
|
-
import { PolicyEngine } from "./engine.js";
|
|
2
|
+
import { PolicyEngine, computeDecisionContextDigest } from "./engine.js";
|
|
3
3
|
const tool = (name, ns) => ({
|
|
4
4
|
name: `${ns}/${name}`,
|
|
5
5
|
originalName: name,
|
|
@@ -76,5 +76,46 @@ describe("PolicyEngine", () => {
|
|
|
76
76
|
expect(filtered.map((t) => t.originalName)).not.toContain("dangerous_delete");
|
|
77
77
|
});
|
|
78
78
|
});
|
|
79
|
+
describe("decisionContext", () => {
|
|
80
|
+
const engine = new PolicyEngine("allow", [
|
|
81
|
+
{ effect: "deny", principals: ["agent:readonly-*"], tools: ["*/write_*"] },
|
|
82
|
+
]);
|
|
83
|
+
it("returns decision context with evaluation", () => {
|
|
84
|
+
const t = tool("write_file", "fs");
|
|
85
|
+
const result = engine.evaluate("agent:readonly-bot", t);
|
|
86
|
+
expect(result.decisionContext).toBeDefined();
|
|
87
|
+
expect(result.decisionContext.principal).toBe("agent:readonly-bot");
|
|
88
|
+
expect(result.decisionContext.toolName).toBe("fs/write_file");
|
|
89
|
+
expect(result.decisionContext.toolNamespace).toBe("fs");
|
|
90
|
+
expect(result.decisionContext.effect).toBe("deny");
|
|
91
|
+
expect(result.decisionContext.matchedRule).toEqual({
|
|
92
|
+
effect: "deny",
|
|
93
|
+
principals: ["agent:readonly-*"],
|
|
94
|
+
tools: ["*/write_*"],
|
|
95
|
+
});
|
|
96
|
+
});
|
|
97
|
+
it("produces stable digest for same input", () => {
|
|
98
|
+
const t = tool("write_file", "fs");
|
|
99
|
+
const r1 = engine.evaluate("agent:readonly-bot", t);
|
|
100
|
+
const r2 = engine.evaluate("agent:readonly-bot", t);
|
|
101
|
+
const d1 = computeDecisionContextDigest(r1.decisionContext);
|
|
102
|
+
const d2 = computeDecisionContextDigest(r2.decisionContext);
|
|
103
|
+
expect(d1).toBe(d2);
|
|
104
|
+
expect(d1).toHaveLength(64);
|
|
105
|
+
});
|
|
106
|
+
it("produces different digest for different principal", () => {
|
|
107
|
+
const t = tool("read_data", "github");
|
|
108
|
+
const r1 = engine.evaluate("agent:alpha", t);
|
|
109
|
+
const r2 = engine.evaluate("agent:beta", t);
|
|
110
|
+
const d1 = computeDecisionContextDigest(r1.decisionContext);
|
|
111
|
+
const d2 = computeDecisionContextDigest(r2.decisionContext);
|
|
112
|
+
expect(d1).not.toBe(d2);
|
|
113
|
+
});
|
|
114
|
+
it("includes null principal when undefined", () => {
|
|
115
|
+
const t = tool("read_data", "github");
|
|
116
|
+
const result = engine.evaluate(undefined, t);
|
|
117
|
+
expect(result.decisionContext.principal).toBeNull();
|
|
118
|
+
});
|
|
119
|
+
});
|
|
79
120
|
});
|
|
80
121
|
//# sourceMappingURL=engine.test.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"engine.test.js","sourceRoot":"","sources":["../../src/policy/engine.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"engine.test.js","sourceRoot":"","sources":["../../src/policy/engine.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAC;AAGzE,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAU,EAAa,EAAE,CAAC,CAAC;IACrD,IAAI,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE;IACrB,YAAY,EAAE,IAAI;IAClB,SAAS,EAAE,EAAE;IACb,QAAQ,EAAE,GAAG,EAAE,SAAS;CACzB,CAAC,CAAC;AAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;QAC7B,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,OAAO,EAAE;YACvC,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,kBAAkB,CAAC,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE;YACxF,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,gBAAgB,CAAC,EAAE;SAC9C,CAAC,CAAC;QAEH,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;YAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC3E,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAChD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,oBAAoB,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;YACjF,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;YACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;YAC1E,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;YACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;YAC3E,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;QAC5B,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,EAAE;YACtC,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,iBAAiB,CAAC,EAAE,UAAU,EAAE,CAAC,QAAQ,CAAC,EAAE;SAC7E,CAAC,CAAC;QAEH,EAAE,CAAC,mBAAmB,EAAE,GAAG,EAAE;YAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC/E,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;YAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,kBAAkB,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;YAClF,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;YACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,kBAAkB,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC;YACrF,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;QAC7B,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;YACnC,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,OAAO,EAAE;gBACvC,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,EAAE;aAC/E,CAAC,CAAC;YAEH,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC9B,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAChC,MAAM,CAAC,gBAAgB,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YACxC,MAAM,CAAC,gBAAgB,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YACxC,MAAM,CAAC,gBAAgB,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAExC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YACjD,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;QAC3B,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,OAAO,EAAE;YACvC,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,eAAe,CAAC,EAAE;SAC5E,CAAC,CAAC;QAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;YACxC,MAAM,KAAK,GAAG;gBACZ,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC;gBACvB,IAAI,CAAC,kBAAkB,EAAE,IAAI,CAAC;gBAC9B,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC;aACzB,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;YAC5D,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACjC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAChF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;QAC/B,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,OAAO,EAAE;YACvC,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,kBAAkB,CAAC,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,EAAE;SAC3E,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAClD,MAAM,CAAC,GAAG,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC;YACxD,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC;YAC7C,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;YACpE,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC9D,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxD,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACnD,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC;gBACjD,MAAM,EAAE,MAAM;gBACd,UAAU,EAAE,CAAC,kBAAkB,CAAC;gBAChC,KAAK,EAAE,CAAC,WAAW,CAAC;aACrB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;YAC/C,MAAM,CAAC,GAAG,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;YACnC,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC;YACpD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC;YACpD,MAAM,EAAE,GAAG,4BAA4B,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC;YAC5D,MAAM,EAAE,GAAG,4BAA4B,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC;YAC5D,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACpB,MAAM,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;YAC3D,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YACtC,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;YAC7C,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;YAC5C,MAAM,EAAE,GAAG,4BAA4B,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC;YAC5D,MAAM,EAAE,GAAG,4BAA4B,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC;YAC5D,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAChD,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YACtC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;YAC7C,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC;QACtD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../../src/proxy/gateway.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,aAAa,EAEb,cAAc,EAEd,WAAW,EACZ,MAAM,aAAa,CAAC;AAQrB,qBAAa,OAAO;IASN,OAAO,CAAC,MAAM;IAR1B,OAAO,CAAC,WAAW,CAAqC;IACxD,OAAO,CAAC,cAAc,CAAC,CAA8B;IACrD,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAW;IAC3B,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,OAAO,CAAiB;IAChC,OAAO,CAAC,eAAe,CAAkB;gBAErB,MAAM,EAAE,aAAa;IAkBnC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAOb,eAAe;IAavB,eAAe,CACnB,SAAS,CAAC,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IA8B3D,eAAe,CACnB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,SAAS,CAAC,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3D,OAAO,CAAC;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,WAAW,CAAA;KAAE,CAAC;
|
|
1
|
+
{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../../src/proxy/gateway.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,aAAa,EAEb,cAAc,EAEd,WAAW,EACZ,MAAM,aAAa,CAAC;AAQrB,qBAAa,OAAO;IASN,OAAO,CAAC,MAAM;IAR1B,OAAO,CAAC,WAAW,CAAqC;IACxD,OAAO,CAAC,cAAc,CAAC,CAA8B;IACrD,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAW;IAC3B,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,OAAO,CAAiB;IAChC,OAAO,CAAC,eAAe,CAAkB;gBAErB,MAAM,EAAE,aAAa;IAkBnC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAOb,eAAe;IAavB,eAAe,CACnB,SAAS,CAAC,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IA8B3D,eAAe,CACnB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,SAAS,CAAC,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3D,OAAO,CAAC;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,WAAW,CAAA;KAAE,CAAC;IAmHzD,SAAS,IAAI;QACX,OAAO,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC;QAC7C,SAAS,EAAE,cAAc,EAAE,CAAC;QAC5B,SAAS,EAAE;YACT,cAAc,EAAE,MAAM,CAAC;YACvB,gBAAgB,EAAE,MAAM,CAAC;YACzB,iBAAiB,EAAE,MAAM,CAAC;YAC1B,oBAAoB,EAAE,MAAM,CAAC;YAC7B,UAAU,EAAE,MAAM,CAAC;SACpB,CAAC;KACH;IAoBD,iBAAiB,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAoB5C,qBAAqB,CACnB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,KAAK,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACvC,CAAC,GACD,IAAI;YA2BO,eAAe;IAkBvB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAGhC;AAED,qBAAa,aAAc,SAAQ,KAAK;IAE7B,IAAI,EAAE,MAAM;IAEZ,WAAW,EAAE,WAAW;gBAFxB,IAAI,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACR,WAAW,EAAE,WAAW;CAKlC"}
|
package/dist/proxy/gateway.js
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import { PolicyEngine } from "../policy/engine.js";
|
|
1
|
+
import { PolicyEngine, computeDecisionContextDigest } from "../policy/engine.js";
|
|
2
2
|
import { AuditLog } from "../attestation/audit-log.js";
|
|
3
3
|
import { createSigner } from "../attestation/signer.js";
|
|
4
4
|
import { GatewayTracer } from "../telemetry/tracer.js";
|
|
@@ -78,6 +78,7 @@ export class Gateway {
|
|
|
78
78
|
throw new ToolCallError(-32602, `Unknown tool: ${toolName}`, record);
|
|
79
79
|
}
|
|
80
80
|
const decision = this.policyEngine.evaluate(principal, tool);
|
|
81
|
+
const contextDigest = computeDecisionContextDigest(decision.decisionContext);
|
|
81
82
|
if (!decision.allowed) {
|
|
82
83
|
this.metrics.recordPolicyDenial({
|
|
83
84
|
principal: principal ?? "anonymous",
|
|
@@ -92,6 +93,7 @@ export class Gateway {
|
|
|
92
93
|
durationMs: Date.now() - startTime,
|
|
93
94
|
success: false,
|
|
94
95
|
errorCode: -32603,
|
|
96
|
+
decisionContextDigest: contextDigest,
|
|
95
97
|
});
|
|
96
98
|
throw new ToolCallError(-32603, decision.reason ?? "unauthorized", record);
|
|
97
99
|
}
|
|
@@ -119,6 +121,7 @@ export class Gateway {
|
|
|
119
121
|
principal,
|
|
120
122
|
durationMs,
|
|
121
123
|
success: true,
|
|
124
|
+
decisionContextDigest: contextDigest,
|
|
122
125
|
});
|
|
123
126
|
return { result, auditRecord: record };
|
|
124
127
|
}
|
|
@@ -146,6 +149,7 @@ export class Gateway {
|
|
|
146
149
|
durationMs,
|
|
147
150
|
success: false,
|
|
148
151
|
errorCode: -32603,
|
|
152
|
+
decisionContextDigest: contextDigest,
|
|
149
153
|
});
|
|
150
154
|
throw new ToolCallError(-32603, "Upstream server error", record);
|
|
151
155
|
}
|