@miller-tech/uap 1.106.0 → 1.108.0

package/src/policies/enforcers/adr_guard.py

@@ -0,0 +1,189 @@
+#!/usr/bin/env python3
+"""adr-guard enforcer — generic ADR-driven tool-call gate.
+
+Reads machine-readable rule blocks from every ADR under `docs/adr/` and
+enforces them on Write/Edit tool calls. This lets us express architectural
+and security invariants once — in the ADR itself — and have them enforced
+automatically by UAP agents.
+
+Rule block format (embedded inside an ADR as an HTML comment):
+
+    <!-- uap-rules
+    - id: ADR-0007-FE-NO-BEARER
+      scope:
+        include: ["apps/web/", "apps/cms/", "apps/marketing/"]
+        exclude: ["/tests/", ".test.", ".spec.", "/node_modules/"]
+        ext: [".js", ".ts", ".jsx", ".tsx"]
+      forbid: 'Authorization.*Bearer'
+      message: "FE must not set Authorization: Bearer. See ADR-0007."
+    - id: ADR-0006-PIPELINE-ONLY
+      scope:
+        include: ["infra/"]
+        exclude: ["infra/archive/"]
+      require: '^#\\s*managed-by:\\s*terraform'
+      message: "Infra files must declare terraform ownership. See ADR-0006."
+    -->
+
+Fields:
+    id        — unique rule ID (prefix with ADR number)
+    scope.*   — path filters (include prefixes, exclude substrings, ext list)
+    forbid    — regex that MUST NOT match the written content
+    require   — regex that MUST match (at least one hit) when writing into scope
+    message   — explanation shown when blocked
+    on_tools  — optional list of tool names (default: Write, Edit, MultiEdit)
+
+The parser caches rules by ADR-file mtime so rebuilds are cheap.
+"""
+from __future__ import annotations
+
+import os
+import re
+import sys
+from pathlib import Path
+from typing import Any
+
+sys.path.insert(0, str(Path(__file__).parent))
+from _common import emit, parse_cli, repo_root  # noqa: E402
+
+try:
+    import yaml  # type: ignore
+except ImportError:  # pragma: no cover
+    yaml = None
+
+
+RULE_BLOCK_RE = re.compile(
+    r"<!--\s*uap-rules\s*\n(.*?)\n\s*-->", re.DOTALL | re.IGNORECASE
+)
+
+
+def _parse_adr_rules(adr_dir: Path) -> list[dict[str, Any]]:
+    """Extract all uap-rules blocks from ADR files."""
+    if not adr_dir.is_dir() or yaml is None:
+        return []
+    rules: list[dict[str, Any]] = []
+    for f in sorted(adr_dir.glob("*.md")):
+        try:
+            text = f.read_text(encoding="utf-8", errors="ignore")
+        except OSError:
+            continue
+        for m in RULE_BLOCK_RE.finditer(text):
+            body = m.group(1)
+            try:
+                parsed = yaml.safe_load(body)
+            except yaml.YAMLError:
+                continue
+            if not isinstance(parsed, list):
+                continue
+            for r in parsed:
+                if not isinstance(r, dict):
+                    continue
+                r["_adr"] = f.name
+                rules.append(r)
+    return rules
+
+
+def _extract_write_target(op: str, args: dict[str, Any]) -> tuple[str, str] | None:
+    tool = op.lower()
+    if tool == "write":
+        return args.get("file_path") or "", args.get("content") or ""
+    if tool == "edit":
+        return args.get("file_path") or "", args.get("new_string") or ""
+    if tool == "multiedit":
+        fp = args.get("file_path") or ""
+        edits = args.get("edits") or []
+        content = "\n".join(
+            e.get("new_string", "") for e in edits if isinstance(e, dict)
+        )
+        return fp, content
+    if tool == "notebookedit":
+        return args.get("notebook_path") or "", args.get("new_source") or ""
+    return None
+
+
+def _path_matches_scope(path: str, scope: dict[str, Any] | None) -> bool:
+    if not scope:
+        return True
+    includes = scope.get("include") or [""]
+    excludes = scope.get("exclude") or []
+    exts = scope.get("ext")
+    if not any(inc == "" or inc in path for inc in includes):
+        return False
+    for exc in excludes:
+        if exc and exc in path:
+            return False
+    if exts:
+        if not any(path.endswith(e) for e in exts):
+            return False
+    return True
+
+
+def _normalize_path(file_path: str) -> str:
+    norm = file_path.replace("\\", "/")
+    for top in (
+        "apps/", "infra/", "services/", "docs/", "scripts/", ".github/",
+        ".semgrep/", ".policy-tools/", ".claude/", "observability/",
+    ):
+        idx = norm.find(top)
+        if idx >= 0:
+            return norm[idx:]
+    return norm
+
+
+def main() -> None:
+    op, args = parse_cli()
+    target = _extract_write_target(op, args)
+    if target is None:
+        emit(True, "not a write/edit operation")
+    file_path, content = target
+    if not file_path:
+        emit(True, "no file path in args")
+
+    root = repo_root()
+    rules = _parse_adr_rules(root / "docs" / "adr")
+    if not rules:
+        emit(True, "no ADR rules active")
+
+    norm = _normalize_path(file_path)
+    tool = op if op else ""
+
+    violations: list[str] = []
+    for rule in rules:
+        on_tools = rule.get("on_tools") or ["Write", "Edit", "MultiEdit"]
+        if tool and tool not in on_tools:
+            continue
+        if not _path_matches_scope(norm, rule.get("scope")):
+            continue
+
+        forbid = rule.get("forbid")
+        if forbid:
+            try:
+                if re.search(forbid, content):
+                    msg = rule.get("message") or f"ADR rule {rule.get('id','?')}"
+                    violations.append(
+                        f"[{rule.get('id','adr-rule')} from {rule.get('_adr')}] {msg}"
+                    )
+            except re.error:
+                continue
+
+        require = rule.get("require")
+        if require:
+            try:
+                if not re.search(require, content):
+                    msg = rule.get("message") or f"ADR rule {rule.get('id','?')}"
+                    violations.append(
+                        f"[{rule.get('id','adr-rule')} from {rule.get('_adr')}] (required pattern missing) {msg}"
+                    )
+            except re.error:
+                continue
+
+    if violations:
+        emit(
+            False,
+            "adr-guard: " + " | ".join(violations),
+            violations=violations,
+        )
+    emit(True, "no ADR rule violations in write")
+
+
+if __name__ == "__main__":
+    main()

package/src/policies/enforcers/bearer_lockdown.py

@@ -0,0 +1,298 @@
+#!/usr/bin/env python3
+"""bearer-lockdown enforcer — UAP gate for ADR-0007 cookie-only frontend.
+
+Blocks Write/Edit tool calls that would reintroduce any of the seven
+ADR-0007 invariants. Mirrors scripts/bearer-lockdown-scan.sh but runs at
+tool-call time so agents are prevented from writing the regression in
+the first place, not merely caught at CI time.
+
+Invariants enforced (details in docs/adr/ADR-0007-cookie-only-frontend.md):
+    FE-NO-BEARER           Frontend code must not set Authorization: Bearer.
+    FE-NO-STORAGE          No token keys in localStorage / sessionStorage.
+    PROXY-NO-BYPASS        No --skip-jwt-bearer-tokens=true on oauth2-proxy.
+    BACKEND-NO-CLIENT-AUTH Backend must not read client Authorization header.
+    AUTH-ME-OPAQUE         /auth/me must emit user_ref, not raw user_id.
+    NO-COMMITTED-JWT       No RS256 JWT (>100 chars) anywhere.
+
+The ISTIO-DENY-ALIVE invariant is runtime-only (Kyverno + alerts) since
+tool-level detection would require reasoning about the whole cluster state.
+"""
+from __future__ import annotations
+
+import re
+import sys
+from pathlib import Path
+from typing import Any
+
+sys.path.insert(0, str(Path(__file__).parent))
+from _common import emit, parse_cli  # noqa: E402
+
+# --------------------------------------------------------------------------
+# Rule definitions. Each rule has:
+#   - id: short code (matches scanner/semgrep IDs)
+#   - path_include: list of glob prefixes the file must match
+#   - path_exclude: list of glob substrings that veto the rule
+#   - pattern: compiled regex matched against the written content
+#   - message: explanation shown to the agent when blocked
+# --------------------------------------------------------------------------
+RULES: list[dict[str, Any]] = [
+    {
+        "id": "BL-001",
+        "invariant": "FE-NO-BEARER",
+        "path_include": ("apps/web/", "apps/cms/", "apps/marketing/"),
+        "path_exclude": (
+            "/tests/",
+            "/test/",
+            ".test.",
+            ".spec.",
+            "/node_modules/",
+            "/dist/",
+        ),
+        "ext": (".js", ".ts", ".jsx", ".tsx", ".mjs", ".cjs"),
+        # Match Authorization followed by Bearer on the same line, with
+        # optional quoting/colon/equals between them. False positives on
+        # JS comments in scoped paths are rare and easy to rephrase — the
+        # scanner + semgrep catch the same, so redundancy is fine.
+        "pattern": re.compile(
+            r"Authorization[\"']?\s*[:=]\s*[\"'`]?Bearer\b",
+        ),
+        "message": (
+            "ADR-0007 FE-NO-BEARER: frontend code must not set "
+            "`Authorization: Bearer`. Auth rides on the httpOnly "
+            "`_oauth2_proxy` cookie only. See "
+            "docs/adr/ADR-0007-cookie-only-frontend.md."
+        ),
+    },
+    {
+        "id": "BL-002",
+        "invariant": "FE-NO-STORAGE",
+        "path_include": ("apps/web/", "apps/cms/", "apps/marketing/"),
+        "path_exclude": (
+            "/tests/",
+            "/test/",
+            ".test.",
+            ".spec.",
+            "/node_modules/",
+        ),
+        "ext": (".js", ".ts", ".jsx", ".tsx", ".mjs", ".cjs"),
+        "pattern": re.compile(
+            r"(local|session)Storage\.setItem\s*\(\s*[\"'](access_token|refresh_token|id_token|auth_token|authToken|bearer_token)[\"']",
+        ),
+        "message": (
+            "ADR-0007 FE-NO-STORAGE: token-like keys must not be written to "
+            "localStorage/sessionStorage (XSS-reachable). Auth is cookie-only. "
+            "See docs/adr/ADR-0007-cookie-only-frontend.md."
+        ),
+    },
+    {
+        "id": "BL-003",
+        "invariant": "PROXY-NO-BYPASS",
+        "path_include": ("infra/",),
+        "path_exclude": (
+            "infra/archive/",
+            "infra/k8s/archive/",
+            # Policy files that reference the forbidden flag to enforce it.
+            "infra/policies/rego/bearer_lockdown.rego",
+            "infra/k8s/kyverno/",
+            "infra/k8s/istio/authz-policy-deny-client-bearer.yaml",
+        ),
+        "ext": None,  # any extension
+        "pattern": re.compile(r"--skip-jwt-bearer-tokens=true"),
+        "message": (
+            "ADR-0007 PROXY-NO-BYPASS: oauth2-proxy must not carry "
+            "`--skip-jwt-bearer-tokens=true`. It lets a client-held Bearer "
+            "substitute for the session cookie. See "
+            "docs/adr/ADR-0007-cookie-only-frontend.md."
+        ),
+    },
+    {
+        "id": "BL-006",
+        "invariant": "BACKEND-NO-CLIENT-AUTH",
+        "path_include": ("apps/api/",),
+        "path_exclude": ("apps/api/tests/",),
+        "ext": (".hpp", ".cpp", ".h"),
+        "pattern": re.compile(
+            r'get_header_value\s*\(\s*"authorization"\s*\)',
+        ),
+        "message": (
+            "ADR-0007 BACKEND-NO-CLIENT-AUTH: the backend must not read the "
+            "client `Authorization` header. JWT is resolved from proxy-set "
+            "headers (`X-Forwarded-Access-Token` or "
+            "`x-auth-request-access-token`) only. See "
+            "docs/adr/ADR-0007-cookie-only-frontend.md."
+        ),
+    },
+    {
+        "id": "BL-007",
+        "invariant": "AUTH-ME-OPAQUE",
+        "path_include": ("apps/api/src/handlers/auth_handler.cpp",),
+        "path_exclude": (),
+        "ext": None,
+        "pattern": re.compile(r'response\s*\[\s*"user_id"\s*\]\s*='),
+        "message": (
+            "ADR-0007 AUTH-ME-OPAQUE: /auth/me must return `user_ref` "
+            "(opaque HMAC of user_id), not the raw Zitadel `user_id`. See "
+            "apps/api/include/pay2u/utils/token.hpp::deriveUserRef and "
+            "docs/adr/ADR-0007-cookie-only-frontend.md."
+        ),
+    },
+    {
+        "id": "BL-004",
+        "invariant": "NO-COMMITTED-JWT",
+        "path_include": ("",),  # any path
+        "path_exclude": (
+            "scripts/bearer-lockdown-scan.sh",
+            ".gitleaks.toml",
+            ".semgrep/",
+            "docs/adr/",
+            ".policy-tools/bearer_lockdown.py",
+        ),
+        "ext": None,
+        # Require >=100 chars after header to skip truncated doc examples.
+        "pattern": re.compile(r"eyJhbGciOiJSUzI1NiI[A-Za-z0-9_-]{100,}"),
+        "message": (
+            "ADR-0007 NO-COMMITTED-JWT: RS256 JWT detected in content. "
+            "Tokens must never be committed to the repository — they are "
+            "real credentials with long TTLs. See "
+            "docs/adr/ADR-0007-cookie-only-frontend.md."
+        ),
+    },
+    {
+        # Frontend must not READ the upstream-bound auth headers from any
+        # Response. They are stripped at the gateway egress, but blocking
+        # the read at write-time prevents code that would silently break
+        # once the strip lands (or worse, ship before it lands).
+        "id": "BL-008",
+        "invariant": "XAUTH-FE-NO-READ",
+        "path_include": ("apps/web/", "apps/cms/", "apps/marketing/"),
+        "path_exclude": (
+            "/tests/",
+            "/test/",
+            ".test.",
+            ".spec.",
+            "/node_modules/",
+            "/dist/",
+        ),
+        "ext": (".js", ".ts", ".jsx", ".tsx", ".mjs", ".cjs"),
+        # Match any reference to one of the forbidden header names in
+        # string-literal form. Case-insensitive — HTTP header names are.
+        "pattern": re.compile(
+            r"""['"](?i:x-auth-request-(?:email|preferred-username|user|access-token|groups|jti)|x-forwarded-access-token)['"]""",
+        ),
+        "message": (
+            "ADR-0007 XAUTH-FE-NO-READ: frontend code must not reference "
+            "upstream-bound auth headers (`x-auth-request-*`, "
+            "`x-forwarded-access-token`). They are stripped at the "
+            "gateway egress and exist only between oauth2-proxy and the "
+            "backend API. See "
+            "infra/k8s/istio/envoyfilter-strip-auth-egress-headers.yaml "
+            "and docs/adr/ADR-0007-cookie-only-frontend.md."
+        ),
+    },
+    {
+        # Backend must not EMIT (set as response header) any of the
+        # forbidden auth-bound names. Defence-in-depth against a future
+        # handler accidentally echoing an upstream header back to the caller.
+        "id": "BL-009",
+        "invariant": "XAUTH-BE-NO-EMIT",
+        "path_include": ("apps/api/",),
+        "path_exclude": ("apps/api/tests/",),
+        "ext": (".hpp", ".cpp", ".h"),
+        # Match `set_header("authorization", ...)`,
+        # `set_header("x-auth-request-...", ...)`, etc. Case-insensitive.
+        "pattern": re.compile(
+            r"""set_header\s*\(\s*['"](?i:authorization|x-auth-request-(?:email|preferred-username|user|access-token|groups|jti)|x-forwarded-access-token|x-access-token|x-id-token)['"]""",
+        ),
+        "message": (
+            "ADR-0007 XAUTH-BE-NO-EMIT: backend handlers must not write "
+            "auth-bound headers (`Authorization`, `x-auth-request-*`, "
+            "`x-forwarded-access-token`, `x-access-token`, `x-id-token`) "
+            "into responses. The gateway strips them as a safety net but "
+            "this rule prevents the source from ever being introduced. "
+            "See docs/adr/ADR-0007-cookie-only-frontend.md."
+        ),
+    },
+]
+
+
+def _extract_write_target(op: str, args: dict[str, Any]) -> tuple[str, str] | None:
+    """Return (file_path, content) if this call writes/edits a file, else None."""
+    tool = op.lower()
+    if tool == "write":
+        fp = args.get("file_path") or ""
+        content = args.get("content") or ""
+        return fp, content
+    if tool == "edit":
+        fp = args.get("file_path") or ""
+        # For Edit, only the new_string is the newly-introduced content.
+        new = args.get("new_string") or ""
+        return fp, new
+    if tool == "multiedit":
+        fp = args.get("file_path") or ""
+        edits = args.get("edits") or []
+        content = "\n".join(e.get("new_string", "") for e in edits if isinstance(e, dict))
+        return fp, content
+    if tool == "notebookedit":
+        fp = args.get("notebook_path") or ""
+        content = args.get("new_source") or ""
+        return fp, content
+    return None
+
+
+def _path_matches(path: str, includes: tuple[str, ...], excludes: tuple[str, ...]) -> bool:
+    """True if path is under any include prefix and not under any exclude."""
+    # "" in includes means match any path.
+    if not any(inc == "" or inc in path for inc in includes):
+        return False
+    for exc in excludes:
+        if exc and exc in path:
+            return False
+    return True
+
+
+def _ext_ok(path: str, exts: tuple[str, ...] | None) -> bool:
+    if exts is None:
+        return True
+    return any(path.endswith(e) for e in exts)
+
+
+def main() -> None:
+    op, args = parse_cli()
+    target = _extract_write_target(op, args)
+    if target is None:
+        emit(True, "not a write/edit operation")
+    file_path, content = target
+    if not file_path:
+        emit(True, "no file path in args")
+
+    # Normalize: strip leading ./ or absolute prefix to repo-relative form.
+    norm = file_path.replace("\\", "/")
+    # Drop a leading absolute path portion up to the first known top-level dir.
+    for top in ("apps/", "infra/", "services/", "docs/", "scripts/", ".github/",
+                ".semgrep/", ".policy-tools/", ".claude/", "observability/"):
+        idx = norm.find(top)
+        if idx >= 0:
+            norm = norm[idx:]
+            break
+
+    violations: list[str] = []
+    for rule in RULES:
+        if not _path_matches(norm, rule["path_include"], rule["path_exclude"]):
+            continue
+        if not _ext_ok(norm, rule["ext"]):
+            continue
+        if rule["pattern"].search(content):
+            violations.append(f"[{rule['id']}] {rule['message']}")
+
+    if violations:
+        emit(
+            False,
+            "bearer-lockdown: " + " | ".join(violations),
+            violations=[v for v in violations],
+            adr="docs/adr/ADR-0007-cookie-only-frontend.md",
+        )
+    emit(True, "no bearer-lockdown violations in write")
+
+
+if __name__ == "__main__":
+    main()

package/src/policies/enforcers/local_build_before_push.py

@@ -0,0 +1,125 @@
+#!/usr/bin/env python3
+"""local-build-before-push enforcer.
+
+Blocks `git push` / `gh pr create` / `gh pr merge` when the local branch
+contains C++ API source changes that have not been verified by a local
+Docker `--target builder` compile. The policy exists because the project's
+"compilation check via Docker" CI workflow takes ~50 min from scratch and
+~10-20 min cached, while running the same Dockerfile locally takes ~2-5 min
+cached. The pentest-remediation saga (2026-05-20) burned several CI cycles
+on a jwt-cpp v0.7.0 API mismatch and a sequence of wrong-audience IaC pins
+that local builds would have caught immediately.
+
+The pass marker is `.uap/local-build-pass.txt`, written by
+`scripts/uap-local-build.sh` after a successful Docker builder-stage build.
+The marker contains the verified HEAD SHA; this enforcer allows the push
+only when the current HEAD matches.
+
+Bypass: set `UAP_SKIP_LOCAL_BUILD=1` (the override should be justified in
+the commit message — there are legitimate cases like remote-only secrets).
+"""
+from __future__ import annotations
+
+import os
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).parent))
+from _common import emit, parse_cli, repo_root, run  # noqa: E402
+
+MARKER = ".uap/local-build-pass.txt"
+
+# A push that only touches files outside these prefixes does not need the
+# local C++ compile gate. Adjust if more code paths gain expensive builds.
+BUILDABLE_PREFIXES = (
+    "apps/api/src/",
+    "apps/api/include/",
+    "apps/api/CMakeLists.txt",
+    "apps/api/Dockerfile",
+    "apps/api/Dockerfile.optimized",
+    "apps/api/Dockerfile.test",
+    "apps/api/Dockerfile.ubuntu",
+)
+
+# Bash command substrings that trigger the gate. Kept narrow to avoid
+# false-positives on unrelated git commands.
+PUSH_TRIGGERS = (
+    "git push",
+    "gh pr create",
+    "gh pr merge",
+)
+
+
+def _wants_gate(cmd_lower: str) -> bool:
+    return any(trigger in cmd_lower for trigger in PUSH_TRIGGERS)
+
+
+def _changed_files(root: Path) -> list[str]:
+    """Files changed on the current branch vs origin/main."""
+    # Make sure we have an origin/main ref to compare against; if not,
+    # fall back to comparing against HEAD~10 or HEAD itself.
+    rc, _, _ = run(["git", "show-ref", "--verify", "--quiet",
+                    "refs/remotes/origin/main"], cwd=root)
+    base = "origin/main" if rc == 0 else "HEAD~10"
+    rc, out, _ = run(["git", "diff", "--name-only", f"{base}..HEAD"], cwd=root)
+    if rc != 0:
+        return []
+    return [line for line in out.splitlines() if line]
+
+
+def main() -> None:
+    op, args = parse_cli()
+    cmd = (args.get("command") or args.get("cmd") or "").strip()
+    if not cmd or op.lower() != "bash":
+        emit(True, "not a Bash command")
+
+    cmd_lower = cmd.lower()
+    if not _wants_gate(cmd_lower):
+        emit(True, "not a push/PR-create/PR-merge command")
+
+    if os.environ.get("UAP_SKIP_LOCAL_BUILD") == "1":
+        emit(True, "UAP_SKIP_LOCAL_BUILD=1 override (justify in commit msg)")
+
+    root = repo_root()
+
+    changed = _changed_files(root)
+    needs_build = any(
+        f.startswith(p) for f in changed for p in BUILDABLE_PREFIXES
+    )
+    if not needs_build:
+        emit(True, "no buildable C++ API source changes — gate not required")
+
+    rc, head_sha, _ = run(["git", "rev-parse", "HEAD"], cwd=root)
+    head_sha = head_sha.strip()
+    if not head_sha:
+        emit(True, "could not resolve HEAD (allowing)")
+
+    marker_path = root / MARKER
+    if marker_path.exists():
+        try:
+            marker_text = marker_path.read_text()
+        except OSError:
+            marker_text = ""
+        if head_sha in marker_text:
+            emit(True, f"local-build-pass marker matches HEAD={head_sha[:10]}")
+
+    short_changed = ", ".join(sorted({
+        next((p for p in BUILDABLE_PREFIXES if f.startswith(p)), f)
+        for f in changed
+    }))[:200]
+
+    emit(
+        False,
+        "local-build-before-push: apps/api/ source changed "
+        f"({short_changed}) but no local-build-pass marker found for "
+        f"HEAD={head_sha[:10]}. Run the same Docker compile gate that CI "
+        "uses locally:\n"
+        "  bash scripts/uap-local-build.sh\n"
+        "Cached build takes ~2-5 min; CI takes ~10-50 min. If local build "
+        "is genuinely not feasible (e.g. cluster-only secret), set "
+        "UAP_SKIP_LOCAL_BUILD=1 and justify in the commit message.",
+    )
+
+
+if __name__ == "__main__":
+    main()