@synopackageland/cli 0.3.10 → 0.4.1

package/templates/native-go/backend/internal/helper/relaxed_identity.go

@@ -0,0 +1,252 @@
+package helper
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"slices"
+	"strings"
+	"time"
+	"unicode/utf8"
+)
+
+func validRelaxedIdentity(id RelaxedIdentity) bool {
+	return id.UID != 0 && id.Username != "" && len(id.Username) <= MaxSegmentBytes && utf8.ValidString(id.Username) && !strings.ContainsAny(id.Username, "\x00\r\n/\\")
+}
+func relaxedActorIdentity(a NativeActor) RelaxedIdentity {
+	return RelaxedIdentity{a.UID(), a.Username()}
+}
+func relaxedPrincipalIdentity(p Principal) RelaxedIdentity { return RelaxedIdentity{p.UID, p.Username} }
+func relaxedRelated(a, b RelaxedIdentity) bool             { return a.UID == b.UID || a.Username == b.Username }
+func (r *relaxedProvider) resolve(ctx context.Context, c SessionCarriers, now func() time.Time) (NativeActor, Code) {
+	if r == nil || r.authority == nil || now == nil || r.adapters.Sessions == nil || r.adapters.Accounts == nil || r.adapters.Groups == nil || r.adapters.App == nil {
+		return NativeActor{}, ErrUnavailable
+	}
+	ctx, cancel := context.WithTimeout(ctx, NativeProofFreshness)
+	defer cancel()
+	if code := nativeContextCode(ctx); code != "" {
+		return NativeActor{}, code
+	}
+	if c.Cookie == "" {
+		return NativeActor{}, ErrDenied
+	}
+	if c.ClientAddress == "" {
+		return NativeActor{}, ErrUnavailable
+	}
+	s, code := r.adapters.Sessions.ValidateRelaxedSession(ctx, c)
+	if code = nativeObservationCode(ctx, code); code != "" {
+		return NativeActor{}, code
+	}
+	if !validRelaxedIdentity(RelaxedIdentity{UID: 1, Username: s.Username}) {
+		return NativeActor{}, ErrDenied
+	}
+	if !s.CSRFVerified || r.adapters.AppPrivilegeID == "" {
+		return NativeActor{}, ErrUnsupported
+	}
+	if !allReferences(s.SessionRef) {
+		return NativeActor{}, ErrUnavailable
+	}
+	if !nativeFresh(s.CheckedAt, now()) {
+		return NativeActor{}, ErrStale
+	}
+	a, code := r.adapters.Accounts.LookupRelaxedAccount(ctx, s.Username)
+	if code = nativeObservationCode(ctx, code); code != "" {
+		if code == ErrDenied {
+			if cleanup := r.invalidateName(ctx, s.Username); cleanup != "" {
+				return NativeActor{}, cleanup
+			}
+		}
+		return NativeActor{}, code
+	}
+	if !nativeFresh(a.CheckedAt, now()) {
+		return NativeActor{}, ErrStale
+	}
+	if a.Kind != "local" {
+		return NativeActor{}, ErrUnsupported
+	}
+	if a.StateKnown && !a.Exists {
+		if code = r.invalidateName(ctx, s.Username); code != "" {
+			return NativeActor{}, code
+		}
+		return NativeActor{}, ErrDenied
+	}
+	if a.Identity.Username != s.Username {
+		if code = r.invalidateName(ctx, s.Username, a.Identity); code != "" {
+			return NativeActor{}, code
+		}
+		return NativeActor{}, ErrSuspended
+	}
+	if !a.StateKnown || !a.ExpiryKnown || !a.PasswordKnown || !a.PrimaryGIDKnown {
+		return NativeActor{}, ErrUnavailable
+	}
+	if !a.Exists || !a.Enabled || a.Expired || !a.PasswordUsable {
+		if code = r.invalidateName(ctx, s.Username, a.Identity); code != "" {
+			return NativeActor{}, code
+		}
+		return NativeActor{}, ErrDenied
+	}
+	if !validRelaxedIdentity(a.Identity) || a.PrimaryGID == 0 {
+		return NativeActor{}, ErrDenied
+	}
+	g, code := r.adapters.Groups.LookupRelaxedGroups(ctx, a)
+	if code = nativeObservationCode(ctx, code); code != "" {
+		return NativeActor{}, code
+	}
+	if !nativeFresh(g.CheckedAt, now()) {
+		return NativeActor{}, ErrStale
+	}
+	if g.Identity != a.Identity || g.PrimaryGID != a.PrimaryGID {
+		if code = r.invalidate(ctx, []RelaxedIdentity{a.Identity}); code != "" {
+			return NativeActor{}, code
+		}
+		return NativeActor{}, ErrSuspended
+	}
+	if g.Groups == nil || len(g.Groups) > 1024 || !g.Complete || !g.AdminKnown {
+		return NativeActor{}, ErrUnavailable
+	}
+	app, code := r.adapters.App.ValidateRelaxedApp(ctx, c, s, a, r.adapters.AppPrivilegeID)
+	if code = nativeObservationCode(ctx, code); code != "" {
+		if code == ErrDenied {
+			if cleanup := r.invalidate(ctx, []RelaxedIdentity{a.Identity}); cleanup != "" {
+				return NativeActor{}, cleanup
+			}
+		}
+		return NativeActor{}, code
+	}
+	if !nativeFresh(app.CheckedAt, now()) {
+		return NativeActor{}, ErrStale
+	}
+	if app.Identity != a.Identity || app.ClientAddress != c.ClientAddress || app.AppID != r.adapters.AppPrivilegeID || app.SessionRef != s.SessionRef {
+		return NativeActor{}, ErrDenied
+	}
+	if !app.Allowed {
+		// Conservative grant revocation also stops this caller's foreign-shared work.
+		if code = r.invalidate(ctx, []RelaxedIdentity{a.Identity}); code != "" {
+			return NativeActor{}, code
+		}
+		return NativeActor{}, ErrDenied
+	}
+	oldest := s.CheckedAt
+	for _, at := range []time.Time{a.CheckedAt, g.CheckedAt, app.CheckedAt} {
+		if at.Before(oldest) {
+			oldest = at
+		}
+	}
+	if !nativeFresh(oldest, now()) {
+		return NativeActor{}, ErrStale
+	}
+	principal, code := r.principal(ctx, a.Identity)
+	if code != "" {
+		return NativeActor{}, code
+	}
+	if !nativeFresh(oldest, now()) {
+		return NativeActor{}, ErrStale
+	}
+	groups := slices.Clone(g.Groups)
+	slices.Sort(groups)
+	groups = slices.Compact(groups)
+	return NativeActor{relaxed: r, account: LocalAccount{Principal: principal, Username: a.Identity.Username, Enabled: true, UID: a.Identity.UID, GID: a.PrimaryGID, Groups: groups, Admin: g.Admin, CheckedAt: oldest}, sessionRef: s.SessionRef, valid: true}, ""
+}
+func (r *relaxedProvider) principal(ctx context.Context, id RelaxedIdentity) (Principal, Code) {
+	a := r.authority
+	a.mu.Lock()
+	if r.blocked[id] {
+		a.mu.Unlock()
+		return Principal{}, ErrCleanupRequired
+	}
+	mismatches := map[RelaxedIdentity]bool{}
+	code := a.transaction(func(s *GrantStore) (bool, Code) {
+		for _, g := range s.Grants {
+			if g.State == GrantRevoked {
+				continue
+			}
+			for _, p := range []Principal{g.Owner, g.Issuer} {
+				if p.IdentityBasis != "uid-username" {
+					continue
+				}
+				before := relaxedPrincipalIdentity(p)
+				if before != id && relaxedRelated(before, id) {
+					mismatches[before] = true
+				}
+			}
+		}
+		return false, ""
+	})
+	if code != "" {
+		a.mu.Unlock()
+		return Principal{}, code
+	}
+	if len(mismatches) > 0 {
+		// Block the prospective identity too until every old grant has Q.
+		ids := make([]RelaxedIdentity, 0, len(mismatches))
+		for key := range mismatches {
+			ids = append(ids, key)
+		}
+		if code = r.invalidateLocked(ctx, ids, id); code != "" {
+			return Principal{}, code
+		}
+		return Principal{}, ErrSuspended
+	}
+	defer a.mu.Unlock()
+	if p, ok := r.principals[id]; ok {
+		return p, ""
+	}
+	if len(r.principals) >= MaxReplayEntries {
+		return Principal{}, ErrBusy
+	}
+	ref, code := randomGrantID()
+	if code != "" {
+		return Principal{}, code
+	}
+	// The digest is an index, never a session or birth proof. InstanceRef is a
+	// per-owner random generation rotated on observed invalidation/restart.
+	b, _ := json.Marshal(struct {
+		Basis    string
+		Identity RelaxedIdentity
+	}{"uid-username", id})
+	sum := sha256.Sum256(b)
+	p := Principal{Kind: "local", SubjectRef: hex.EncodeToString(sum[:]), InstanceRef: ref, IdentityBasis: "uid-username", UID: id.UID, Username: id.Username}
+	r.principals[id] = p
+	return p, ""
+}
+func (r *relaxedProvider) revalidate(ctx context.Context, c SessionCarriers, old NativeActor, now func() time.Time) (NativeActor, Code) {
+	if old.relaxed != r || old.managed != nil {
+		return NativeActor{}, ErrSuspended
+	}
+	current, code := r.resolve(ctx, c, now)
+	if code != "" {
+		return NativeActor{}, code
+	}
+	if relaxedActorIdentity(old) != relaxedActorIdentity(current) {
+		r.authority.mu.Lock()
+		if code = r.invalidateLocked(ctx, []RelaxedIdentity{relaxedActorIdentity(old)}, relaxedActorIdentity(current)); code != "" {
+			return NativeActor{}, code
+		}
+		return NativeActor{}, ErrSuspended
+	}
+	if old.Principal() != current.Principal() {
+		return NativeActor{}, ErrSuspended
+	}
+	if old.GID() != current.GID() || old.Admin() != current.Admin() || old.SessionRef() != current.SessionRef() || !slices.Equal(old.Groups(), current.Groups()) {
+		return NativeActor{}, ErrStale
+	}
+	return current, ""
+}
+func (a *GrantAuthority) relaxedActorLocked(actor NativeActor) Code {
+	if actor.relaxed == nil {
+		if a.native != nil && a.native.relaxed != nil {
+			return ErrDenied
+		}
+		return ""
+	}
+	if a.native == nil || a.native.relaxed != actor.relaxed || actor.managed != nil {
+		return ErrDenied
+	}
+	r := actor.relaxed
+	id := relaxedActorIdentity(actor)
+	if r.blocked[id] || r.principals[id] != actor.Principal() {
+		return ErrSuspended
+	}
+	return ""
+}

package/templates/native-go/backend/internal/helper/relaxed_identity_contract.go

@@ -0,0 +1,105 @@
+package helper
+
+import (
+	"context"
+	"time"
+)
+
+// S1R observations are root-only adapter results, never request shapes. Each
+// source must prove the current local identity, obey ctx, and use safe codes.
+// No DSM implementation is installed until the target-build research is proven.
+type RelaxedIdentity struct {
+	UID      uint32
+	Username string
+}
+
+type RelaxedSession struct {
+	Username     string // native validated name; UID comes from current local lookup
+	SessionRef   string // server-issued opaque binding; not SID or cookie hash
+	CSRFVerified bool
+	CheckedAt    time.Time
+}
+type RelaxedAccount struct {
+	Identity        RelaxedIdentity
+	Kind            string
+	Exists, Enabled bool
+	PrimaryGID      uint32
+	PrimaryGIDKnown bool
+	StateKnown      bool
+	ExpiryKnown     bool
+	Expired         bool
+	PasswordKnown   bool
+	PasswordUsable  bool
+	CheckedAt       time.Time
+}
+type RelaxedGroups struct {
+	Identity   RelaxedIdentity
+	Groups     []uint32 // nil means incomplete; explicit empty is complete
+	Complete   bool
+	PrimaryGID uint32
+	Admin      bool
+	AdminKnown bool
+	CheckedAt  time.Time
+}
+type RelaxedAppPermission struct {
+	Identity      RelaxedIdentity
+	AppID         string
+	ClientAddress string
+	SessionRef    string
+	Allowed       bool
+	CheckedAt     time.Time
+}
+
+type RelaxedSessionValidator interface {
+	ValidateRelaxedSession(context.Context, SessionCarriers) (RelaxedSession, Code)
+}
+type RelaxedAccountProvider interface {
+	LookupRelaxedAccount(context.Context, string) (RelaxedAccount, Code)
+}
+type RelaxedGroupProvider interface {
+	LookupRelaxedGroups(context.Context, RelaxedAccount) (RelaxedGroups, Code)
+}
+type RelaxedAppValidator interface {
+	ValidateRelaxedApp(context.Context, SessionCarriers, RelaxedSession, RelaxedAccount, string) (RelaxedAppPermission, Code)
+}
+
+type RelaxedAdapters struct {
+	// Trusted DSM registration binding; never inferred from package or window name.
+	AppPrivilegeID string
+	Sessions       RelaxedSessionValidator
+	Accounts       RelaxedAccountProvider
+	Groups         RelaxedGroupProvider
+	App            RelaxedAppValidator
+}
+
+// Nil adapters fail closed. A provider also needs the existing S3 ordering
+// owner before minting actors, so identity changes cannot bypass durable R/Q.
+func NewRelaxedNativeProvider(adapters RelaxedAdapters) *NativeProvider {
+	return &NativeProvider{relaxed: &relaxedProvider{adapters: adapters}, now: time.Now}
+}
+
+type relaxedProvider struct {
+	adapters   RelaxedAdapters
+	authority  *GrantAuthority
+	principals map[RelaxedIdentity]Principal
+	blocked    map[RelaxedIdentity]bool
+}
+
+// drainRelaxedIdentity must use the SAME owned S2 cohort, including the user's
+// operations on grants issued by others. Absence is cleanup-required, never Q.
+type relaxedIdentityCohort interface {
+	drainRelaxedIdentity(context.Context, RelaxedIdentity) Code
+}
+
+func (r *relaxedProvider) bind(a *GrantAuthority) Code {
+	if r == nil || a == nil || r.authority != nil {
+		return ErrUnavailable
+	}
+	if a.policy.Inventory.Protocol != DataProtocol || a.policy.Inventory.DataAccess != "relaxed" {
+		return ErrIncompatible
+	}
+	r.authority = a
+	r.principals = map[RelaxedIdentity]Principal{}
+	r.blocked = map[RelaxedIdentity]bool{}
+	return ""
+}