@saulwade/swl-ses 2.6.1 → 2.8.0

package/scripts/lib/evidence-verifier.js

@@ -0,0 +1,192 @@
+'use strict';
+
+/** Verifica evidencia firmada G0-G4 sin interpretar transiciones de la FSM. */
+
+const crypto = require('node:crypto');
+
+const { assertPrincipalCurrent, isVerifiedPrincipal } = require('./principal-verifier');
+const {
+  exactKeys, fail, freezeDeep, getContractValidators, plainObject,
+} = require('./policy-verifier-utils');
+const signed = require('./signed-envelope');
+
+const EVIDENCE = new WeakSet();
+const EVIDENCE_META = new WeakMap();
+const KINDS = new Set(['g0', 'g1', 'g2', 'g3', 'g4']);
+const SHA256 = /^[a-f0-9]{64}$/u;
+const GIT_HASH = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/u;
+const IDENTIFIER = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
+const REQUIREMENT = /^REQ-[0-9]{2}-[0-9]{2}$/u;
+const CLAIM_KEYS = [
+  'kind', 'schemaVersion', 'evidenceKind', 'principalDigest', 'phaseId', 'taskId',
+  'planDigest', 'baseHead', 'commandDigest', 'exitCode', 'testIds', 'sourceHashes',
+  'testHashes', 'coverage', 'timestamp', 'expiresAt', 'nonce',
+  'traceability',
+];
+const OPTION_KEYS = ['trustContext', 'dependencies', 'principal'];
+
+function sortedUnique(values, validate) {
+  return Array.isArray(values) && values.length > 0 && values.every(validate)
+    && values.every((value, index) => index === 0 || values[index - 1] < value);
+}
+
+function validateOptions(options) {
+  const contract = getContractValidators();
+  plainObject(options, 'EVIDENCE_OPTIONS_INVALID', 'opciones evidence');
+  exactKeys(options, OPTION_KEYS, 'EVIDENCE_OPTIONS_INVALID', 'opciones evidence');
+  if (!contract.isKernelDependencies(options.dependencies)) {
+    fail('EVIDENCE_OPTIONS_INVALID', 'dependencies inválidas');
+  }
+  if (!isVerifiedPrincipal(options.principal)) {
+    fail('EVIDENCE_PRINCIPAL_INVALID', 'principal inválido');
+  }
+}
+
+function validateCoverage(coverage) {
+  plainObject(coverage, 'EVIDENCE_INVALID', 'coverage');
+  exactKeys(coverage, ['lines', 'branches', 'functions'], 'EVIDENCE_INVALID', 'coverage');
+  if (Object.values(coverage).some((value) => (
+    !Number.isInteger(value) || value < 0 || value > 100
+  ))) fail('EVIDENCE_INVALID', 'coverage inválida');
+}
+
+function validateTraceability(claims) {
+  if (!Array.isArray(claims.traceability)) fail('EVIDENCE_INVALID', 'trazabilidad inválida');
+  const canonical = [];
+  for (const link of claims.traceability) {
+    plainObject(link, 'EVIDENCE_INVALID', 'vínculo de trazabilidad');
+    exactKeys(link, ['requirementId', 'taskId', 'commitHash', 'testId', 'evidenceHash'],
+      'EVIDENCE_INVALID', 'vínculo de trazabilidad');
+    if (!REQUIREMENT.test(link.requirementId) || !IDENTIFIER.test(link.taskId)
+        || !GIT_HASH.test(link.commitHash) || !IDENTIFIER.test(link.testId)
+        || !SHA256.test(link.evidenceHash)) {
+      fail('EVIDENCE_INVALID', 'vínculo de trazabilidad inválido');
+    }
+    const declaredHashes = new Set([...claims.sourceHashes, ...claims.testHashes]);
+    if (link.taskId !== claims.taskId || !claims.testIds.includes(link.testId)
+        || !declaredHashes.has(link.evidenceHash)) {
+      fail('EVIDENCE_INVALID', 'vínculo de trazabilidad incoherente');
+    }
+    canonical.push(signed.canonicalizarIJson(link));
+  }
+  if (new Set(canonical).size !== canonical.length
+      || canonical.some((value, index) => index > 0 && canonical[index - 1] >= value)
+      || (claims.evidenceKind === 'g4' && canonical.length === 0)
+      || (claims.evidenceKind !== 'g4' && canonical.length !== 0)) {
+    fail('EVIDENCE_INVALID', 'trazabilidad incompatible con gate');
+  }
+}
+
+function validateShape(claims) {
+  plainObject(claims, 'EVIDENCE_INVALID', 'claims evidence');
+  exactKeys(claims, CLAIM_KEYS, 'EVIDENCE_INVALID', 'claims evidence');
+  if (claims.kind !== 'gate-evidence' || claims.schemaVersion !== '1.0.0'
+      || !KINDS.has(claims.evidenceKind)) {
+    fail('EVIDENCE_INVALID', 'evidence futura o inválida');
+  }
+  for (const field of ['phaseId', 'taskId', 'nonce']) {
+    if (!IDENTIFIER.test(claims[field])) fail('EVIDENCE_INVALID', `${field} inválido`);
+  }
+  if (!SHA256.test(claims.principalDigest) || !SHA256.test(claims.planDigest)
+      || !SHA256.test(claims.commandDigest) || !GIT_HASH.test(claims.baseHead)
+      || !Number.isInteger(claims.exitCode)) {
+    fail('EVIDENCE_INVALID', 'digests o exit code inválidos');
+  }
+  if (!sortedUnique(claims.testIds, (value) => IDENTIFIER.test(value))
+      || !sortedUnique(claims.sourceHashes, (value) => SHA256.test(value))
+      || !sortedUnique(claims.testHashes, (value) => SHA256.test(value))) {
+    fail('EVIDENCE_INVALID', 'listas de evidencia inválidas');
+  }
+  validateCoverage(claims.coverage);
+  validateTraceability(claims);
+}
+
+function validateTimeAndBinding(claims, principal, now) {
+  if (claims.principalDigest !== principal.principalDigest) {
+    fail('EVIDENCE_BINDING_INVALID', 'evidence ligada a otro principal');
+  }
+  signed.validarTimestampIso(claims.timestamp, 'evidence timestamp');
+  signed.validarTimestampIso(claims.expiresAt, 'evidence expiresAt');
+  if (claims.timestamp > now || claims.expiresAt < now || claims.timestamp >= claims.expiresAt) {
+    fail('EVIDENCE_EXPIRED', 'evidence fuera de vigencia');
+  }
+}
+
+function detectKind(rawBytes) {
+  try {
+    const value = signed.parsearIJson(rawBytes);
+    plainObject(value, 'EVIDENCE_INVALID', 'envelope evidence');
+    const kind = value.claims?.evidenceKind;
+    if (!KINDS.has(kind)) fail('EVIDENCE_INVALID', 'evidence kind inválido');
+    return kind;
+  } catch (error) {
+    if (error.codigo === 'EVIDENCE_INVALID') throw error;
+    fail('EVIDENCE_INVALID', 'evidence raw inválida');
+  }
+}
+
+function createReceipt(envelope, options) {
+  const digestInput = {
+    issuer: envelope.issuer, subject: envelope.subject,
+    signerPublicKeyDigest: envelope.signerPublicKeyDigest,
+    trustEpoch: envelope.trustEpoch, trustDigest: envelope.trustDigest,
+    claims: envelope.claims,
+  };
+  const evidenceDigest = crypto.createHash('sha256')
+    .update(signed.canonicalizarIJson(digestInput), 'utf8').digest('hex');
+  const receipt = freezeDeep({
+    kind: 'verified-evidence', ...structuredClone(envelope.claims),
+    issuer: envelope.issuer, subject: envelope.subject,
+    keyId: envelope.keyId, rootKeyDigest: envelope.rootKeyDigest,
+    signerPublicKeyDigest: envelope.signerPublicKeyDigest,
+    trustEpoch: envelope.trustEpoch, trustDigest: envelope.trustDigest,
+    evidenceDigest,
+  });
+  EVIDENCE.add(receipt);
+  EVIDENCE_META.set(receipt, Object.freeze({
+    envelope, principal: options.principal,
+    integrityLedger: options.dependencies.integrityLedger,
+  }));
+  return receipt;
+}
+
+function assertEvidenceCurrent(evidence, authority) {
+  if (!EVIDENCE.has(evidence)) fail('EVIDENCE_INVALID', 'evidence no verificada');
+  const metadata = EVIDENCE_META.get(evidence);
+  if (!metadata.integrityLedger.isAuthorityReceipt(authority)) {
+    fail('EVIDENCE_AUTHORITY_INVALID', 'autoridad no verificada');
+  }
+  assertPrincipalCurrent(metadata.principal, authority);
+  signed.revalidarEnvelopeVerificado(metadata.envelope, authority.observedAt);
+  validateTimeAndBinding(evidence, metadata.principal, authority.observedAt);
+  return true;
+}
+
+function verifyEvidence(rawBytes, options) {
+  validateOptions(options);
+  const evidenceKind = detectKind(rawBytes);
+  const authority = options.dependencies.integrityLedger.readAuthority();
+  const envelope = signed.verificarEnvelope(rawBytes, {
+    trustContext: options.trustContext, expectedType: 'evidence',
+    requiredScope: `evidence:${evidenceKind}`, now: authority.observedAt,
+  });
+  if (envelope.trustEpoch !== authority.trustEpoch
+      || envelope.trustDigest !== authority.trustDigest
+      || envelope.rootKeyDigest !== authority.rootKeyDigest) {
+    fail('EVIDENCE_TRUST_INVALID', 'evidence ligada a trust distinto');
+  }
+  assertPrincipalCurrent(options.principal, authority);
+  validateShape(envelope.claims);
+  validateTimeAndBinding(envelope.claims, options.principal, authority.observedAt);
+  return createReceipt(envelope, options);
+}
+
+function isVerifiedEvidence(value) {
+  return EVIDENCE.has(value);
+}
+
+module.exports = {
+  assertEvidenceCurrent,
+  isVerifiedEvidence,
+  verifyEvidence,
+};