blun-king-cli 9.1.597 → 9.1.600

package/standard-skills/translate-native/integrations/website_localization_cms_client.py

@@ -192,6 +192,14 @@ def _valid_sha256(value: Any, *, optional: bool = False) -> bool:
     )
 
 
+def _capability_pin(value: Any, name: str) -> str | None:
+    if value is None:
+        return None
+    if not isinstance(value, str) or SHA256.fullmatch(value) is None:
+        raise ValueError(f"{name} must be a lowercase SHA-256 digest")
+    return value
+
+
 def _valid_nonnegative_number(value: Any) -> bool:
     return (
         not isinstance(value, bool)
@@ -357,6 +365,8 @@ class CMSLocalizationHTTPClient:
         allow_loopback_http: bool = False,
         clock: Callable[[], float | int] = time.time,
         request_id_factory: Callable[[], str] | None = None,
+        capabilities_sha256: str | None = None,
+        commercial_rendering_registry_sha256: str | None = None,
     ):
         if not isinstance(allow_loopback_http, bool):
             raise TypeError("allow_loopback_http must be boolean")
@@ -380,6 +390,14 @@ class CMSLocalizationHTTPClient:
             raise TypeError("transport must provide post")
         self.timeout = float(timeout)
         self.clock = clock
+        self._capabilities_sha256 = _capability_pin(
+            capabilities_sha256,
+            "capabilities_sha256",
+        )
+        self._commercial_rendering_registry_sha256 = _capability_pin(
+            commercial_rendering_registry_sha256,
+            "commercial_rendering_registry_sha256",
+        )
         self.request_id_factory = (
             (lambda: secrets.token_hex(16))
             if request_id_factory is None else request_id_factory
@@ -387,6 +405,16 @@ class CMSLocalizationHTTPClient:
         if not callable(self.request_id_factory):
             raise TypeError("request_id_factory must be callable")
 
+    @property
+    def capabilities_sha256(self) -> str | None:
+        """Return the constructor-fixed complete capability deployment pin."""
+        return self._capabilities_sha256
+
+    @property
+    def commercial_rendering_registry_sha256(self) -> str | None:
+        """Return the constructor-fixed commercial rendering registry pin."""
+        return self._commercial_rendering_registry_sha256
+
     def submit_change(self, change: Mapping[str, Any]) -> Mapping[str, Any]:
         request = _copy_request(
             change, schema=_CMS.CHANGE_SCHEMA, code="change_invalid",
@@ -520,6 +548,25 @@ class CMSLocalizationHTTPClient:
             or not self._valid_capabilities(response)
         ):
             raise CMSClientFailed("response_binding", retryable=True)
+        capabilities = response["capabilities"]
+        if (
+            self.capabilities_sha256 is not None
+            and capabilities["sha256"] != self.capabilities_sha256
+        ):
+            raise CMSClientFailed(
+                "capabilities_pin_mismatch",
+                retryable=False,
+            )
+        registry = capabilities["commercial_rendering_registry"]
+        if (
+            self.commercial_rendering_registry_sha256 is not None
+            and registry["sha256"]
+            != self.commercial_rendering_registry_sha256
+        ):
+            raise CMSClientFailed(
+                "commercial_rendering_registry_pin_mismatch",
+                retryable=False,
+            )
         return response
 
     def _read_request(
@@ -827,6 +874,42 @@ class CMSLocalizationHTTPClient:
         digest = unsigned_capabilities.pop("sha256", None)
         unsigned_contract = dict(contract)
         contract_digest = unsigned_contract.pop("sha256", None)
+        commercial = capabilities.get("commercial_profile")
+        rendering_registry = capabilities.get("commercial_rendering_registry")
+        expected_locales = []
+        try:
+            for profile in _CMS._PLANNER.EU_OFFICIAL_LOCALES:
+                commercial_quality = (
+                    _CMS._PLANNER.commercial_quality_profile_for(profile.locale)
+                )
+                expected_locales.append({
+                    "locale": profile.locale,
+                    "eu_code": profile.eu_code,
+                    "language": profile.language,
+                    "native_name": profile.native_name,
+                    "script": profile.script,
+                    "direction": profile.direction,
+                    "quality_profile_version": profile.quality_profile_version,
+                    "quality_profile_sha256": profile.quality_profile_sha256,
+                    "commercial_quality_profile_version": (
+                        commercial_quality["version"]
+                    ),
+                    "commercial_quality_profile_sha256": (
+                        commercial_quality["sha256"]
+                    ),
+                })
+            expected_commercial = _CMS._COMMERCIAL.public_profile(
+                _CMS._PLANNER.COMMERCIAL_PROFILE,
+            )
+            expected_rendering_registry = (
+                _CMS._PLANNER.commercial_rendering_registry()
+            )
+            expected_publication_http = (
+                _CMS.WebsiteLocalizationCMSBridge
+                ._publication_http_capabilities()
+            )
+        except Exception:
+            return False
         if (
             not isinstance(digest, str)
             or SHA256.fullmatch(digest) is None
@@ -846,6 +929,39 @@ class CMSLocalizationHTTPClient:
             or contract.get("schema") != _API.API_CAPABILITIES_SCHEMA
             or contract.get("api_schema") != _API.API_SCHEMA
             or contract.get("error_schema") != _API.API_SCHEMA
+            or set(capabilities) != {
+                "schema", "change_schema", "cancellation_schema",
+                "tombstone_schema", "publication_schema",
+                "tombstone_delivery_schema", "plan_schema", "job_schema",
+                "eu_language_source", "default_target_policy",
+                "content_types", "quality_passes", "commercial_profile",
+                "commercial_rendering_registry", "publication_http",
+                "locales", "sha256",
+            }
+            or capabilities.get("schema") != _CMS.CAPABILITIES_SCHEMA
+            or capabilities.get("change_schema") != _CMS.CHANGE_SCHEMA
+            or capabilities.get("cancellation_schema")
+            != _CMS.CANCELLATION_SCHEMA
+            or capabilities.get("tombstone_schema") != _CMS.TOMBSTONE_SCHEMA
+            or capabilities.get("publication_schema")
+            != _CMS.PUBLICATION_SCHEMA
+            or capabilities.get("tombstone_delivery_schema")
+            != _CMS.TOMBSTONE_DELIVERY_SCHEMA
+            or capabilities.get("plan_schema") != _CMS._PLANNER.SCHEMA
+            or capabilities.get("job_schema") != _CMS._PLANNER.JOB_SCHEMA
+            or capabilities.get("eu_language_source")
+            != _CMS._PLANNER.EU_LANGUAGE_SOURCE
+            or capabilities.get("default_target_policy")
+            != _CMS._DEFAULT_TARGET_POLICY
+            or capabilities.get("content_types")
+            != sorted(_CMS._PLANNER.CONTENT_TYPES)
+            or capabilities.get("quality_passes")
+            != list(_CMS._PLANNER.QUALITY_PASSES)
+            or commercial != expected_commercial
+            or rendering_registry != expected_rendering_registry
+            or capabilities.get("publication_http")
+            != expected_publication_http
+            or capabilities.get("locales") != expected_locales
         ):
             return False
         operations = contract.get("operations")

package/standard-skills/translate-native/integrations/website_localization_cms_receiver.py

@@ -156,6 +156,27 @@ class HealthChecker(Protocol):
     def __call__(self, probe: VerifiedHealthProbe) -> Mapping[str, Any]: ...
 
 
+def release_evidence_is_current(
+    value: Any,
+    *,
+    locale: Any,
+    target_sha256: Any,
+    approval_id: Any,
+    require_current_locale_quality: bool = True,
+) -> bool:
+    """Apply the same current release contract at ingress and durable reads."""
+
+    return _CMS._valid_release_evidence(
+        value,
+        locale=locale,
+        target_sha256=target_sha256,
+        approval_id=approval_id,
+        require_current_locale_quality=(
+            require_current_locale_quality
+        ),
+    )
+
+
 class PublicationExpectationResolver(Protocol):
     def __call__(
         self, publication: VerifiedPublication,
@@ -302,6 +323,30 @@ def _signature(value: Any) -> Any:
     )
 
 
+def message_signature_is_valid(
+    payload: Any,
+    signature: Any,
+    authority: Any,
+) -> bool:
+    """Verify one canonical message without trusting stored signature fields."""
+
+    if (
+        not isinstance(payload, bytes)
+        or not payload
+        or not callable(getattr(authority, "verify", None))
+    ):
+        return False
+    try:
+        normalized = (
+            signature
+            if isinstance(signature, _CMS.CMSMessageSignature)
+            else _signature(signature)
+        )
+        return authority.verify(payload, normalized) is True
+    except Exception:
+        return False
+
+
 def _timestamp(value: Any) -> float:
     if isinstance(value, bool) or not isinstance(value, (int, float)):
         raise CMSReceiverBlocked(
@@ -365,11 +410,12 @@ def _verify_publication(value: Any, payload_sha256: str, *, now: float) -> bytes
             or not isinstance(approval_id, str)
             or TOKEN.fullmatch(approval_id) is None
             or _timestamp(item.get("approval_expires_at")) <= now
-            or not _CMS._valid_release_evidence(
+            or not release_evidence_is_current(
                 item.get("release_evidence"),
                 locale=locale,
                 target_sha256=target_sha256,
                 approval_id=approval_id,
+                require_current_locale_quality=False,
             )
         ):
             raise CMSReceiverBlocked(
@@ -466,9 +512,57 @@ def _verify_expectation(
         )
     for item in localizations:
         evidence = item["release_evidence"]
+        try:
+            profile = _CMS._PLANNER.quality_profile_for(item["locale"])
+            if (
+                not isinstance(profile, dict)
+                or profile.get("locale") != item["locale"]
+                or not isinstance(profile.get("version"), str)
+                or TOKEN.fullmatch(profile["version"]) is None
+                or not isinstance(profile.get("sha256"), str)
+                or SHA256.fullmatch(profile["sha256"]) is None
+            ):
+                raise ValueError("quality profile is invalid")
+        except Exception:
+            raise CMSReceiverBlocked(
+                "receiver.release_scope", retryable=False, http_status=409,
+            ) from None
+        expected_quality = {
+            "locale": profile["locale"],
+            "version": profile["version"],
+            "sha256": profile["sha256"],
+        }
+        expected_commercial_quality = None
+        if expectation.content_type == "commercial":
+            try:
+                profile = _CMS._PLANNER.commercial_quality_profile_for(
+                    item["locale"],
+                )
+                if (
+                    not isinstance(profile, dict)
+                    or not isinstance(profile.get("commercial_profile"), str)
+                    or TOKEN.fullmatch(profile["commercial_profile"]) is None
+                    or not isinstance(profile.get("version"), str)
+                    or TOKEN.fullmatch(profile["version"]) is None
+                    or not isinstance(profile.get("sha256"), str)
+                    or SHA256.fullmatch(profile["sha256"]) is None
+                ):
+                    raise ValueError("commercial quality profile is invalid")
+            except Exception:
+                raise CMSReceiverBlocked(
+                    "receiver.release_scope", retryable=False, http_status=409,
+                ) from None
+            expected_commercial_quality = {
+                "profile": profile["commercial_profile"],
+                "version": profile["version"],
+                "sha256": profile["sha256"],
+            }
         if (
             evidence["content_type"] != expectation.content_type
+            or evidence["quality_profile"] != expected_quality
             or evidence["commercial_profile"] != expectation.commercial_profile
+            or evidence["commercial_quality_profile"]
+            != expected_commercial_quality
         ):
             raise CMSReceiverBlocked(
                 "receiver.release_scope", retryable=False, http_status=409,
@@ -630,11 +724,9 @@ def _verify_publication_transport(
             "receiver.framing_invalid", retryable=False, http_status=400,
         )
     signature = _signature(envelope.get("signature"))
-    try:
-        verified = publication_authority.verify(payload_bytes, signature) is True
-    except Exception:
-        verified = False
-    if not verified:
+    if not message_signature_is_valid(
+        payload_bytes, signature, publication_authority,
+    ):
         raise CMSReceiverBlocked(
             "receiver.signature_invalid", retryable=False, http_status=401,
         )
@@ -706,11 +798,9 @@ def _verify_tombstone_transport(
             "receiver.framing_invalid", retryable=False, http_status=400,
         )
     signature = _signature(envelope.get("signature"))
-    try:
-        verified = publication_authority.verify(payload_bytes, signature) is True
-    except Exception:
-        verified = False
-    if not verified:
+    if not message_signature_is_valid(
+        payload_bytes, signature, publication_authority,
+    ):
         raise CMSReceiverBlocked(
             "receiver.signature_invalid", retryable=False, http_status=401,
         )

package/standard-skills/translate-native/integrations/website_localization_cms_receiver_runtime.py

@@ -380,7 +380,18 @@ def open_durable_cms_receiver(
             "CMS receiver database could not be opened"
         ) from error
     try:
-        store = _STORE.DurableCMSReceiverStore(connection, clock=clock)
+        store = _STORE.DurableCMSReceiverStore(
+            connection,
+            release_evidence_validator=(
+                _RECEIVER.release_evidence_is_current
+            ),
+            publication_signature_validator=lambda payload, signature: (
+                _RECEIVER.message_signature_is_valid(
+                    payload, signature, publication_authority,
+                )
+            ),
+            clock=clock,
+        )
         database_guard()
         synchronized_store = _SynchronizedStore(
             connection, store, database_guard,