@passioncode-ai/fabric-agent-adapter 0.21.0 → 0.23.0

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_delegation.py

@@ -309,7 +309,7 @@ def _key_for(jwks: Dict[str, Any], kid: str) -> Dict[str, Any]:
         return {"problem": "unusable-key"}
     if is_small_order_key(raw):
         return {"problem": "small-order-key"}  # refused before any verification (DEC-0045, CT-29)
-    return {"key": raw}
+    return {"key": raw, "x": jwk["x"]}
 
 
 def _has_keys(jwks: Any) -> bool:
@@ -331,7 +331,7 @@ def _authentic(token: Any, jwks: Dict[str, Any], typ: str) -> Dict[str, Any]:
         return {"problem": found["problem"], "issuer": found["problem"] != "unknown-key"}
     if len(compact["signature"]) != 64 or not ed25519_verify(found["key"], compact["signing_input"], compact["signature"]):
         return {"problem": "bad-signature"}
-    return {"compact": compact, "kid": kid}
+    return {"compact": compact, "kid": kid, "x": found["x"]}
 
 
 def chain_depth(act: Any) -> float:
@@ -432,30 +432,58 @@ def _approval_shape(payload: Dict[str, Any]) -> bool:
     return payload.get("method") in ("prompt", "operator-channel")  # DEC-0045: `device` is removed
 
 
-def _estate_problem(estate: Any, jwks: Dict[str, Any], kid: str, now: float) -> Optional[Tuple[str, str]]:
-    """DL-14 with DEC-0055: a verifier that reads the estate record trusts a kid only while a current revision certifies
-    it for a machine and does not revoke it. `estate` is a revision the caller verified (fabric_estate.
-    verify_estate_record) or a callable returning the current one; None skips the rule. (refusal kind, detail) or None."""
+#: ECMAScript's time range in seconds (±8.64e15 ms): a NumericDate outside it is no instant a Date can hold.
+MAX_CLOCK_SECONDS = 8.64e12
+
+
+def _readable_clock(now: Any) -> bool:
+    """A clock the time rows can compare: a finite number of seconds within a Date's range (DEC-0060). NaN or text
+    would make every time row false and let an expired token through."""
+    if not isinstance(now, (int, float)) or isinstance(now, bool):
+        return False
+    try:
+        return math.isfinite(now) and abs(now) <= MAX_CLOCK_SECONDS
+    except OverflowError:
+        return False
+
+
+def _estate_problem(estate: Any, kid: str, x: str, now: float, applied: Any = None,
+                    revocations: Any = None) -> Optional[Tuple[str, str]]:
+    """DL-14 row 4a (DEC-0055, DEC-0060), right after the signature: when the callee reads the estate record, the
+    token's kid and the published key must be certified by that revision. `estate` is a revision the caller verified
+    (fabric_estate.verify_estate_record) and its machine applied, or a callable returning it; None skips the rule (a
+    callable returning None is an unreadable source). `applied` is the highest revision the machine applied
+    (`{"revision", "digest"?}`); `revocations` the revocation delta's entries applied since (a list or a callable). A
+    source that raises is unreadable, never a pass. Returns ("token" | "issuer", detail) or None."""
     if estate is None:
         return None
     try:
         record = estate() if callable(estate) else estate
-    except Exception:  # an unreadable record certifies nothing; it is never a pass
+        extra = revocations() if callable(revocations) else revocations
+    except Exception:
         return ("issuer", "estate-unreadable")
     import fabric_estate  # beside this file; imported here, since fabric_estate imports this module
-    jwk = next((k for k in jwks["keys"] if isinstance(k, dict) and k.get("kid") == kid), {})
-    if not fabric_estate.hub_key_certified(record, kid, jwk.get("x"), now):
-        return ("token", "kid-not-certified")
-    return None
+    verdict = fabric_estate.hub_key_certified(record, kid, x, now, applied,
+                                              fabric_estate._MISSING if extra is None else extra)
+    if verdict["certified"]:
+        return None
+    # The clock was refused before row 1, so a verdict here is the token's or the trust source's.
+    return ("token" if verdict["fault"] == "token" else "issuer", verdict["detail"])
 
 
 def verify_delegation(token: Any, *, audience: str, jwks: Any, now: float, capability: str, effect: str,
-                      issuer: Optional[str], read_only: bool = False, estate: Any = None) -> Dict[str, Any]:
+                      issuer: Optional[str], read_only: bool = False, estate: Any = None,
+                      estate_applied: Any = None, estate_revocations: Any = None) -> Dict[str, Any]:
     """DL-13, in its fixed order: nothing about a token is believed before its signature is.
     `now` is seconds since the epoch. Returns {ok: True, claims, principal, caller, chain, kid} or a refusal
     {ok: False, code, detail[, data]} whose detail is a short machine word, never the token. `issuer` is required.
     With `estate` (a verified estate revision, or a callable returning the current one), the token's kid must be one
-    the revision certifies for a machine (DL-14, DEC-0055)."""
+    the revision certifies for a machine (DL-14, DEC-0055, DEC-0060); `estate_applied` is the highest revision the
+    machine applied and `estate_revocations` the revocation delta's entries since. A clock that is not a number of
+    seconds is refused `unknown-state` `no-clock` before row 1."""
+    # Before row 1: every time row compares against the clock, and a comparison with NaN is always false.
+    if not _readable_clock(now):
+        return _refuse("unknown-state", "no-clock")
     if not _is_string(issuer):
         return _refuse("issuer-unavailable", "no-trusted-issuer")
     if not _has_keys(jwks):
@@ -463,7 +491,7 @@ def verify_delegation(token: Any, *, audience: str, jwks: Any, now: float, capab
     checked = _authentic(token, jwks, DELEGATION_TYP)
     if "problem" in checked:
         return _refuse("issuer-unavailable" if checked.get("issuer") else "unauthenticated", checked["problem"])
-    uncertified = _estate_problem(estate, jwks, checked["kid"], now)
+    uncertified = _estate_problem(estate, checked["kid"], checked["x"], now, estate_applied, estate_revocations)
     if uncertified:
         return _refuse("issuer-unavailable" if uncertified[0] == "issuer" else "unauthenticated", uncertified[1])
     claims = checked["compact"]["payload"]
@@ -565,13 +593,16 @@ UNSAFE_NO_JTI_STORE = _NoReplayProtection()
 
 
 def verify_approval(approval: Optional[str], *, audience: str, jwks: Any, now: float, action_digest: str,
-                    jti_store: Any, issuer: Optional[str], estate: Any = None) -> Dict[str, Any]:
+                    jti_store: Any, issuer: Optional[str], estate: Any = None, estate_applied: Any = None,
+                    estate_revocations: Any = None) -> Dict[str, Any]:
     """DL-18: a missing approval is approval-required carrying the action digest; any fault of the document is
     approval-invalid; a second use is approval-reused. The jti is consumed last."""
     if approval is None or approval == "":
         return _refuse("approval-required", "no-approval", {"actionDigest": action_digest})
     if jti_store is None or not callable(getattr(jti_store, "consume", None)):
         return _refuse("unknown-state", "no-jti-store")
+    if not _readable_clock(now):
+        return _refuse("unknown-state", "no-clock")
     if not _is_string(issuer):
         return _refuse("issuer-unavailable", "no-trusted-issuer")
     if not _has_keys(jwks):
@@ -579,7 +610,7 @@ def verify_approval(approval: Optional[str], *, audience: str, jwks: Any, now: f
     checked = _authentic(approval, jwks, APPROVAL_TYP)
     if "problem" in checked:
         return _refuse("issuer-unavailable" if checked.get("issuer") else "approval-invalid", checked["problem"])
-    uncertified = _estate_problem(estate, jwks, checked["kid"], now)
+    uncertified = _estate_problem(estate, checked["kid"], checked["x"], now, estate_applied, estate_revocations)
     if uncertified:
         return _refuse("issuer-unavailable" if uncertified[0] == "issuer" else "approval-invalid", uncertified[1])
     claims = checked["compact"]["payload"]
@@ -820,7 +851,8 @@ TIERS = ("T0", "T1", "T2")
 
 
 def delegation_gate(*, audience: str, jwks: Any, effects: Mapping[str, str], issuer: str,
-                    read_only: bool = False, clock: Callable[[], float] = time.time, estate: Any = None) -> Callable[..., Dict[str, Any]]:
+                    read_only: bool = False, clock: Callable[[], float] = time.time, estate: Any = None,
+                    estate_applied: Any = None, estate_revocations: Any = None) -> Callable[..., Dict[str, Any]]:
     """A check for one tools/call: `gate(tool, headers, tier="T2")` answers the accepted delegation or a DL-19
     refusal. `effects` maps each tool to its declared effect class (its manifest entry); a tool with none is
     refused rather than guessed. `jwks` is a JwksCache or a key set; `issuer` (auth.delegation.issuer) is required.
@@ -830,7 +862,8 @@ def delegation_gate(*, audience: str, jwks: Any, effects: Mapping[str, str], iss
     relayed from off the machine. A T0 or T1 caller is never required to present a token: with none, the call
     passes with no delegation ({ok: True, tier, principal: None, ...}). A present token is verified at every tier
     and refused when invalid. Unknown tiers count as T2. `estate` (a callable returning the current verified estate
-    revision) makes the gate trust only kids that revision certifies (DL-14, DEC-0055)."""
+    revision) makes the gate trust only kids that revision certifies (DL-14, DEC-0055, DEC-0060); `estate_applied` and
+    `estate_revocations` pass the applied mark and the revocation delta's entries through."""
     if not _is_string(issuer):
         raise ValueError("the gate needs the issuer it trusts (auth.delegation.issuer)")
 
@@ -845,7 +878,8 @@ def delegation_gate(*, audience: str, jwks: Any, effects: Mapping[str, str], iss
             return _refuse("unauthenticated", "no-token")
         keys = jwks.get(_kid_of(carried["token"])) if isinstance(jwks, JwksCache) else jwks
         verdict = verify_delegation(carried["token"], audience=audience, jwks=keys, now=clock(), capability=tool,
-                                    effect=effect, issuer=issuer, read_only=read_only, estate=estate)
+                                    effect=effect, issuer=issuer, read_only=read_only, estate=estate,
+                                    estate_applied=estate_applied, estate_revocations=estate_revocations)
         if verdict["ok"]:
             verdict["tier"] = tier if tier in TIERS else "T2"
         return verdict

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_estate.py

@@ -36,6 +36,9 @@ import fabric_secrets as _secrets  # noqa: E402 - beside this file: the contract
 ESTATE_RECORD_SCHEMA = "estate-record/1"
 ESTATE_CHALLENGE_TYPE = "estate-revision/1"
 MAX_VALIDITY_SECONDS = 30 * 24 * 60 * 60
+#: How far ahead of the verifier's clock a signed `issuedAt` may be before it is `not-yet-valid` (DEC-0066): the one
+#: skew of the relay family's and the estate record's times (`CLOCK_SKEW_SECONDS` in the contract's `src/rfc3339.ts`).
+CLOCK_SKEW_SECONDS = 60
 ASSERTION_ALGORITHMS = ("ES256", "EdDSA")
 FLAGS = {"UP": 0x01, "UV": 0x04, "BE": 0x08, "BS": 0x10, "AT": 0x40, "ED": 0x80}
 _MISSING = object()
@@ -479,6 +482,37 @@ def _clock(at: Any) -> float:
     return math.nan
 
 
+_LABEL = "[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?"
+#: `sign.` and at least two more labels, lower case: a signing RP ID is never a bare `sign.<tld>` (DEC-0063).
+_SIGNING_RP = re.compile(r"sign(?:\.%s){2,}" % _LABEL, re.ASCII)
+_HTTPS_HOST = re.compile(r"https://([a-z0-9.-]{1,253})", re.ASCII)
+
+
+def is_signing_rp_id(rp_id: Any) -> bool:
+    """Whether an RP ID is a dedicated signing RP (v4 §7, DEC-0063): first label `sign`, then the organization's or
+    PassionCode's domain, lower case. A credential under any other RP ID is a sign-in credential and never signs."""
+    return isinstance(rp_id, str) and len(rp_id) <= 253 and _SIGNING_RP.fullmatch(rp_id) is not None
+
+
+def origin_within(origin: Any, rp_id: str) -> bool:
+    """Whether a pinned origin may run a signing ceremony for ``rp_id``: `https://`, no port, no path, its host the RP
+    ID or a subdomain of it, lower case. Related origins are never used for signing."""
+    match = _HTTPS_HOST.fullmatch(origin) if isinstance(origin, str) else None
+    return match is not None and (match.group(1) == rp_id or match.group(1).endswith("." + rp_id))
+
+
+def _signing_credential(credential: Any, path: str, flag) -> None:
+    """FAC-SEM-092 on one signing credential: a signing RP ID, and every pinned origin within it."""
+    value = credential if isinstance(credential, dict) else {}
+    if not is_signing_rp_id(_get(value, "rpId")):
+        flag("%s/rpId" % path, "a passkey signs only under a dedicated signing RP, sign.<domain>, never under the RP ID it signs in with")
+        return
+    origins = _get(value, "origins")
+    for index, origin in enumerate(origins if isinstance(origins, list) else []):
+        if not origin_within(origin, value["rpId"]):
+            flag("%s/origins/%d" % (path, index), "a signing ceremony runs only on %s or a host under it, over https without a port" % value["rpId"])
+
+
 def _revocation_key(entry: Dict[str, Any]) -> str:
     return "%s %s" % (_s(entry, "kind"), _s(entry, "ref"))
 
@@ -548,6 +582,11 @@ def verify_estate_record(record: Any, *, at: Any, parent: Any = _MISSING, author
     credential = {"credentialId": _s(authority, "credentialId"), "alg": _s(authority, "alg"),
                   "publicKey": authority["publicKey"] if isinstance(_get(authority, "publicKey"), dict) else {},
                   "rpId": _s(authority, "rpId"), "origins": [o for o in origins if isinstance(o, str)] if isinstance(origins, list) else []}
+    # DEC-0063: the estate passkey is a signing credential. An RP ID that is not sign.<domain> is wrong-rp before the
+    # assertion is read; an origin outside the RP ID is not pinned, so a ceremony that ran there is wrong-origin.
+    if not is_signing_rp_id(_get(authority, "rpId")):
+        return {"ok": False, "problem": "wrong-rp"}
+    credential["origins"] = [o for o in credential["origins"] if origin_within(o, credential["rpId"])]
     assertion = verify_assertion(signature, credential, estate_challenge(digest))
     if not assertion["ok"]:
         return {"ok": False, "problem": assertion["problem"]}
@@ -557,7 +596,8 @@ def verify_estate_record(record: Any, *, at: Any, parent: Any = _MISSING, author
     if (not math.isfinite(issued_at) or not math.isfinite(valid_until) or valid_until <= issued_at
             or valid_until - issued_at > MAX_VALIDITY_SECONDS * 1000):
         return {"ok": False, "problem": "too-long-lived"}
-    if now < issued_at:
+    # A revision issued a moment ahead of this clock is admitted within the skew every relay time allows (DEC-0066).
+    if now < issued_at - CLOCK_SKEW_SECONDS * 1000:
         return {"ok": False, "problem": "not-yet-valid"}
     if now > valid_until:
         return {"ok": False, "problem": "expired"}
@@ -580,23 +620,72 @@ def placement_trust(record: Dict[str, Any], machine_id: str, agent_ref: str) ->
     return {"publisher": [k for k in _list(_get(record, "publisherKeys")) if _same(_get(k, "kid"), _get(placement, "publisherKid"))]}
 
 
-def hub_key_certified(record: Any, kid: str, x: str, at: Any) -> bool:
-    """DL-14 with DEC-0055: a delegation verifier that reads the estate record trusts a token's `kid` only while a
-    current revision certifies it for a machine and does not revoke it. ``record`` is a revision the caller verified
-    (verify_estate_record); ``x`` is the key the published key set gives for ``kid``; ``at`` is the clock."""
+#: v4 §7, Freshness: an estate revision's window is at most 30 days (DEC-0055 item 2).
+_MAX_WINDOW_MS = MAX_VALIDITY_SECONDS * 1000
+
+
+def _refused(fault: str, detail: str) -> Dict[str, Any]:
+    return {"certified": False, "fault": fault, "detail": detail}
+
+
+def _revision_number(value: Any) -> bool:
+    return _safe_integer(value) and value >= 1
+
+
+def hub_key_certified(record: Any, kid: Any, x: Any, at: Any, applied: Any = None,
+                      extra_revocations: Any = _MISSING) -> Dict[str, Any]:
+    """DL-14 (DEC-0055, DEC-0060): whether ``record`` certifies the delegation key ``kid`` with the published key's ``x``
+    at ``at`` (an aware datetime or epoch seconds), for a verifier whose machine applied ``applied``
+    (``{"revision", "digest"?}``). ``extra_revocations`` are the revocation delta's entries applied since the revision
+    (DEC-0054). The contract's ``hubKeyCertified``, in its order; never raises. Answers ``{"certified": True, "machine",
+    "revision"}`` or ``{"certified": False, "fault": "token"|"estate"|"clock", "detail"}`` with detail
+    ``kid-not-certified`` (the token's fault), ``estate-unreadable``, ``estate-outside-window``, ``estate-rolled-back``,
+    ``estate-forked`` (the trust source's) or ``no-clock``."""
     now = _clock(at)
-    if not isinstance(record, dict) or not math.isfinite(now):
-        return False
+    if math.isnan(now):
+        return _refused("clock", "no-clock")
+    if (not isinstance(record, dict) or not _revision_number(_get(record, "revision"))
+            or not isinstance(_get(record, "digest"), str) or not isinstance(_get(record, "machines"), list)):
+        return _refused("estate", "estate-unreadable")
+    revocations = _get(record, "revocations")
+    if revocations is not _MISSING and not isinstance(revocations, list):
+        return _refused("estate", "estate-unreadable")
+    if extra_revocations is not _MISSING and not isinstance(extra_revocations, list):
+        return _refused("estate", "estate-unreadable")
     issued_at, valid_until = estate_time(_get(record, "issuedAt")), estate_time(_get(record, "validUntil"))
-    if not (math.isfinite(issued_at) and math.isfinite(valid_until) and issued_at <= now <= valid_until):
-        return False
-    revoked = {_revocation_key(e) for e in _list(_get(record, "revocations"))}
-    for machine in _list(_get(record, "machines")):
-        hub = _get(machine, "hubKey")
-        if (isinstance(hub, dict) and _same(_get(hub, "kid"), kid) and _same(_get(hub, "x"), x)
-                and "hub-key %s" % kid not in revoked and "machine %s" % _s(machine, "id") not in revoked):
-            return True
-    return False
+    # A window that is not a time, not positive or longer than 30 days is no window: NaN fails every comparison below.
+    if math.isnan(issued_at) or math.isnan(valid_until) or valid_until <= issued_at or valid_until - issued_at > _MAX_WINDOW_MS:
+        return _refused("estate", "estate-unreadable")
+    if applied is not None:
+        if (not isinstance(applied, dict) or not _revision_number(_get(applied, "revision"))
+                or (_get(applied, "digest") is not _MISSING and not isinstance(_get(applied, "digest"), str))):
+            return _refused("estate", "estate-unreadable")
+        # An older revision may still be inside its window and list a key the applied one revokes (a rollback).
+        if record["revision"] < applied["revision"]:
+            return _refused("estate", "estate-rolled-back")
+        if (record["revision"] == applied["revision"] and _get(applied, "digest") is not _MISSING
+                and record["digest"] != applied["digest"]):
+            return _refused("estate", "estate-forked")
+    # The window verify_estate_record admits the revision in: from 60 s before issuedAt to validUntil (DEC-0066).
+    if now < issued_at - CLOCK_SKEW_SECONDS * 1000 or now > valid_until:
+        return _refused("estate", "estate-outside-window")
+
+    entries = list(revocations if isinstance(revocations, list) else []) + list(extra_revocations if isinstance(extra_revocations, list) else [])
+
+    def revokes(kind: str, ref: Any) -> bool:  # a ref is compared exactly, never as a string conversion
+        return any(isinstance(e, dict) and _same(_get(e, "kind"), kind) and _same(_get(e, "ref"), ref) for e in entries)
+
+    if not isinstance(kid, str) or revokes("hub-key", kid):
+        return _refused("token", "kid-not-certified")
+    holders = [m for m in record["machines"] if isinstance(m, dict) and isinstance(_get(m, "hubKey"), dict) and _same(_get(m["hubKey"], "kid"), kid)]
+    if len(holders) != 1:  # two machines under one kid break FAC-SEM-073; such a revision certifies neither
+        return _refused("token", "kid-not-certified")
+    machine = holders[0]
+    if not isinstance(x, str) or not _same(_get(machine["hubKey"], "x"), x):  # a missing x never equals a missing x
+        return _refused("token", "kid-not-certified")
+    if revokes("machine", _get(machine, "id")):
+        return _refused("token", "kid-not-certified")
+    return {"certified": True, "machine": _s(machine, "id"), "revision": record["revision"]}
 
 
 # --- FAC-SEM-072…076 ------------------------------------------------------------------------------------------------
@@ -773,6 +862,8 @@ def _record_findings(value: Dict[str, Any]) -> List[Dict[str, str]]:
     _placements(value, _finding(findings, "FAC-SEM-074"))
     _secret_references(value, _finding(findings, "FAC-SEM-075"))
     _grants_and_revocations(value, _finding(findings, "FAC-SEM-076"))
+    for index, authority in enumerate(_list(_get(value, "authorities"))):  # FAC-SEM-092 (DEC-0063)
+        _signing_credential(authority, "/authorities/%d" % index, _finding(findings, "FAC-SEM-092"))
     return findings