blun-king-cli 9.1.597 → 9.1.600

package/standard-skills/translate-native/integrations/website_localization_cms_receiver_store.py

@@ -3,8 +3,11 @@
 
 The trusted host registers its current source and tombstone expectations. The
 receiver invokes this store only after transport and signature verification.
-Every callback rechecks the current binding inside one SQLite write transaction
-so a concurrent source change cannot publish or delete the wrong generation.
+The store retains and continuously rechecks that publisher signature together
+with the current binding, so restart or database tampering cannot silently
+authorize different content. Every write callback also rechecks the binding in
+one SQLite transaction so a concurrent source change cannot affect the wrong
+generation.
 """
 
 from __future__ import annotations
@@ -19,10 +22,13 @@ from contextlib import contextmanager
 from typing import Any, Callable, Iterator, Mapping
 
 
-SCHEMA_VERSION = 1
+SCHEMA_VERSION = 2
+LEGACY_SCHEMA_VERSION = 1
 MAX_JSON_BYTES = 4_000_000
 TOKEN = re.compile(r"^[A-Za-z0-9_.:-]{1,256}$")
 SHA256 = re.compile(r"^[0-9a-f]{64}$")
+SIGNATURE_VALUE = re.compile(r"^[A-Za-z0-9_.:/+=-]{1,4096}$")
+SIGNATURE_FIELDS = ("algorithm", "key_id", "signature")
 CONTENT_TYPES = {
     "headline", "cta", "marketing", "ui", "documentation", "seo", "legal",
     "commercial",
@@ -101,6 +107,31 @@ def _sha256(value: Any, *, field: str) -> str:
     return value
 
 
+def _message_signature(value: Any) -> dict[str, str]:
+    if isinstance(value, Mapping):
+        result = dict(value)
+    else:
+        missing = object()
+        result = {
+            field: getattr(value, field, missing)
+            for field in SIGNATURE_FIELDS
+        }
+        if any(item is missing for item in result.values()):
+            raise CMSReceiverStoreBlocked("publication signature is invalid")
+    if set(result) != set(SIGNATURE_FIELDS):
+        raise CMSReceiverStoreBlocked("publication signature is invalid")
+    if (
+        not isinstance(result["algorithm"], str)
+        or TOKEN.fullmatch(result["algorithm"]) is None
+        or not isinstance(result["key_id"], str)
+        or TOKEN.fullmatch(result["key_id"]) is None
+        or not isinstance(result["signature"], str)
+        or SIGNATURE_VALUE.fullmatch(result["signature"]) is None
+    ):
+        raise CMSReceiverStoreBlocked("publication signature is invalid")
+    return result
+
+
 def _sequence(value: Any) -> int:
     if isinstance(value, bool) or not isinstance(value, int) or value <= 0:
         raise CMSReceiverStoreBlocked("source_sequence is invalid")
@@ -216,13 +247,23 @@ class DurableCMSReceiverStore:
         self,
         connection: sqlite3.Connection,
         *,
+        release_evidence_validator: Callable[..., bool],
+        publication_signature_validator: Callable[
+            [bytes, Mapping[str, str]], bool
+        ],
         clock: Callable[[], float | int] = time.time,
     ):
         if not isinstance(connection, sqlite3.Connection) or connection.in_transaction:
             raise CMSReceiverStoreBlocked("connection must be an idle SQLite connection")
+        if not callable(release_evidence_validator):
+            raise CMSReceiverStoreBlocked("release evidence validator is required")
+        if not callable(publication_signature_validator):
+            raise CMSReceiverStoreBlocked("publication signature validator is required")
         if not callable(clock):
             raise CMSReceiverStoreBlocked("clock must be callable")
         self.connection = connection
+        self._release_evidence_validator = release_evidence_validator
+        self._publication_signature_validator = publication_signature_validator
         self.clock = clock
         self.connection.row_factory = sqlite3.Row
         self.connection.execute("PRAGMA foreign_keys = ON")
@@ -231,10 +272,12 @@ class DurableCMSReceiverStore:
         if int(self.connection.execute("PRAGMA secure_delete").fetchone()[0]) != 1:
             raise CMSReceiverStoreBlocked("secure deletion is unavailable")
         version = int(self.connection.execute("PRAGMA user_version").fetchone()[0])
-        if version not in {0, SCHEMA_VERSION}:
+        if version not in {0, LEGACY_SCHEMA_VERSION, SCHEMA_VERSION}:
             raise CMSReceiverStoreBlocked("unsupported CMS receiver store schema")
         if version == 0:
             self._create_schema()
+        elif version == LEGACY_SCHEMA_VERSION:
+            self._migrate_schema()
         self._verify_schema()
 
     def _create_schema(self) -> None:
@@ -282,6 +325,7 @@ class DurableCMSReceiverStore:
                     tombstone_payload_sha256 TEXT,
                     created_at REAL NOT NULL,
                     updated_at REAL NOT NULL,
+                    signature_json TEXT,
                     UNIQUE (site_id, source_id, source_sequence)
                 )
             """)
@@ -326,7 +370,24 @@ class DurableCMSReceiverStore:
             )
             self.connection.execute(f"PRAGMA user_version = {SCHEMA_VERSION}")
 
-    def _verify_schema(self) -> None:
+    def _migrate_schema(self) -> None:
+        with _transaction(self.connection):
+            self._verify_schema(
+                expected_version=LEGACY_SCHEMA_VERSION,
+                legacy=True,
+            )
+            self.connection.execute(
+                "ALTER TABLE cms_receiver_publications "
+                "ADD COLUMN signature_json TEXT"
+            )
+            self.connection.execute(f"PRAGMA user_version = {SCHEMA_VERSION}")
+
+    def _verify_schema(
+        self,
+        *,
+        expected_version: int = SCHEMA_VERSION,
+        legacy: bool = False,
+    ) -> None:
         if int(self.connection.execute("PRAGMA secure_delete").fetchone()[0]) != 1:
             raise CMSReceiverStoreBlocked("secure deletion was disabled")
         expected = {
@@ -342,7 +403,7 @@ class DurableCMSReceiverStore:
                 "source_sequence", "source_revision", "payload_json", "status",
                 "tombstone_delivery_id", "tombstone_payload_sha256", "created_at",
                 "updated_at",
-            ),
+            ) + (() if legacy else ("signature_json",)),
             "cms_receiver_localizations": (
                 "delivery_id", "locale", "target_text", "target_sha256",
                 "approval_id", "approval_expires_at", "release_evidence_json",
@@ -356,7 +417,7 @@ class DurableCMSReceiverStore:
             ),
         }
         version = int(self.connection.execute("PRAGMA user_version").fetchone()[0])
-        if version != SCHEMA_VERSION:
+        if version != expected_version:
             raise CMSReceiverStoreBlocked("CMS receiver store schema version is invalid")
         for table, columns in expected.items():
             actual = tuple(
@@ -408,8 +469,30 @@ class DurableCMSReceiverStore:
             raise CMSReceiverStoreBlocked("tombstone expectation hash is invalid")
         return result
 
+    def _verify_publication_signature(
+        self,
+        payload_json: str,
+        signature: Any,
+    ) -> dict[str, str]:
+        normalized = _message_signature(signature)
+        try:
+            valid = self._publication_signature_validator(
+                payload_json.encode("utf-8"), normalized,
+            ) is True
+        except Exception:
+            valid = False
+        if not valid:
+            raise CMSReceiverStoreBlocked(
+                "publication signature is no longer valid"
+            )
+        return normalized
+
     def _validate_publication_row(
-        self, row: sqlite3.Row,
+        self,
+        row: sqlite3.Row,
+        *,
+        require_current_authorization: bool = True,
+        now: float | int | None = None,
     ) -> dict[str, Any] | None:
         delivery_id = _token(row["delivery_id"], field="delivery_id")
         payload_sha256 = _sha256(row["payload_sha256"], field="payload_sha256")
@@ -426,6 +509,7 @@ class DurableCMSReceiverStore:
         if row["status"] in {"deleted", "superseded"}:
             if (
                 row["payload_json"] is not None
+                or row["signature_json"] is not None
                 or localizations
             ):
                 raise CMSReceiverStoreBlocked(
@@ -457,7 +541,8 @@ class DurableCMSReceiverStore:
             or row["tombstone_payload_sha256"] is not None
         ):
             raise CMSReceiverStoreBlocked("publication state is invalid")
-        payload = _decode_json(row["payload_json"], field="payload_json")
+        payload_json = row["payload_json"]
+        payload = _decode_json(payload_json, field="payload_json")
         if (
             not isinstance(payload, dict)
             or payload.get("delivery_id") != delivery_id
@@ -479,6 +564,15 @@ class DurableCMSReceiverStore:
             raise CMSReceiverStoreBlocked("stored locale bundle is incomplete")
         if len(localizations) != len(expected) or locales != sorted(set(locales)):
             raise CMSReceiverStoreBlocked("stored locale bundle is incomplete")
+        checked_at = (
+            _timestamp(self.clock() if now is None else now)
+            if require_current_authorization else None
+        )
+        if require_current_authorization:
+            signature = _decode_json(
+                row["signature_json"], field="signature_json",
+            )
+            self._verify_publication_signature(payload_json, signature)
         for stored, item in zip(localizations, expected):
             if not isinstance(item, dict):
                 raise CMSReceiverStoreBlocked("stored locale is invalid")
@@ -498,11 +592,29 @@ class DurableCMSReceiverStore:
                 != stored["target_sha256"]
             ):
                 raise CMSReceiverStoreBlocked("stored locale binding is invalid")
+            if require_current_authorization:
+                approval_expires_at = _timestamp(stored["approval_expires_at"])
+                try:
+                    evidence_valid = self._release_evidence_validator(
+                        evidence,
+                        locale=stored["locale"],
+                        target_sha256=stored["target_sha256"],
+                        approval_id=stored["approval_id"],
+                    ) is True
+                except Exception:
+                    evidence_valid = False
+                if approval_expires_at <= checked_at or not evidence_valid:
+                    raise CMSReceiverStoreBlocked(
+                        "stored release authorization is no longer current"
+                    )
         return payload
 
-    @staticmethod
     def _assert_publication_binding(
-        payload: Mapping[str, Any], expectation: Mapping[str, Any],
+        self,
+        payload: Mapping[str, Any],
+        expectation: Mapping[str, Any],
+        *,
+        now: float | int,
     ) -> None:
         for field in (
             "event_id", "site_id", "website_version", "plan_id", "source_id",
@@ -516,15 +628,49 @@ class DurableCMSReceiverStore:
         locales = tuple(item.get("locale") for item in localizations if isinstance(item, dict))
         if locales != expectation["required_locales"] or len(locales) != len(localizations):
             raise CMSReceiverStoreBlocked("publication locale set is no longer current")
+        checked_at = _timestamp(now)
         for item in localizations:
-            evidence = item.get("release_evidence")
+            evidence = item.get("release_evidence") if isinstance(item, Mapping) else None
+            commercial_quality = (
+                evidence.get("commercial_quality_profile")
+                if isinstance(evidence, dict)
+                else None
+            )
+            if expectation["content_type"] == "commercial":
+                quality_valid = (
+                    isinstance(commercial_quality, dict)
+                    and set(commercial_quality) == {"profile", "version", "sha256"}
+                    and commercial_quality.get("profile")
+                    == expectation["commercial_profile"]
+                    and isinstance(commercial_quality.get("version"), str)
+                    and TOKEN.fullmatch(commercial_quality["version"]) is not None
+                    and isinstance(commercial_quality.get("sha256"), str)
+                    and SHA256.fullmatch(commercial_quality["sha256"]) is not None
+                )
+            else:
+                quality_valid = commercial_quality is None
             if (
                 not isinstance(evidence, dict)
+                or _timestamp(item.get("approval_expires_at")) <= checked_at
                 or evidence.get("content_type") != expectation["content_type"]
                 or evidence.get("commercial_profile")
                 != expectation["commercial_profile"]
+                or not quality_valid
             ):
                 raise CMSReceiverStoreBlocked("publication scope is no longer current")
+            try:
+                evidence_valid = self._release_evidence_validator(
+                    evidence,
+                    locale=item.get("locale"),
+                    target_sha256=item.get("target_sha256"),
+                    approval_id=item.get("approval_id"),
+                ) is True
+            except Exception:
+                evidence_valid = False
+            if not evidence_valid:
+                raise CMSReceiverStoreBlocked(
+                    "publication release authorization is no longer current"
+                )
 
     def register_source(self, expectation: Any) -> Mapping[str, Any]:
         """Register or monotonically advance one trusted current source."""
@@ -623,6 +769,11 @@ class DurableCMSReceiverStore:
         delivery_id, payload_sha256, payload, payload_json = _verified(
             publication, kind="publication",
         )
+        signature = self._verify_publication_signature(
+            payload_json,
+            getattr(publication, "signature", None),
+        )
+        signature_json = _canonical_json(signature)
         now = _timestamp(self.clock())
         with _transaction(self.connection):
             self._verify_schema()
@@ -633,7 +784,7 @@ class DurableCMSReceiverStore:
             if row is None:
                 raise CMSReceiverStoreBlocked("source expectation is missing")
             current = self._source_from_row(row)
-            self._assert_publication_binding(payload, current)
+            self._assert_publication_binding(payload, current, now=now)
             existing = self.connection.execute(
                 "SELECT * FROM cms_receiver_publications WHERE delivery_id = ?",
                 (delivery_id,),
@@ -643,7 +794,7 @@ class DurableCMSReceiverStore:
                     existing["payload_sha256"] == payload_sha256
                     and existing["status"] == "active"
                     and row["active_delivery_id"] == delivery_id
-                    and self._validate_publication_row(existing) == payload
+                    and self._validate_publication_row(existing, now=now) == payload
                 ):
                     return {
                         "delivery_id": delivery_id,
@@ -672,12 +823,13 @@ class DurableCMSReceiverStore:
                         delivery_id, payload_sha256, site_id, source_id,
                         source_sequence, source_revision, payload_json, status,
                         tombstone_delivery_id, tombstone_payload_sha256,
-                        created_at, updated_at
-                    ) VALUES (?, ?, ?, ?, ?, ?, ?, 'active', NULL, NULL, ?, ?)
+                        created_at, updated_at, signature_json
+                    ) VALUES (?, ?, ?, ?, ?, ?, ?, 'active', NULL, NULL, ?, ?, ?)
                 """, (
                     delivery_id, payload_sha256, current["site_id"],
                     current["source_id"], current["source_sequence"],
                     current["source_revision"], payload_json, now, now,
+                    signature_json,
                 ))
                 for item in payload["localizations"]:
                     self.connection.execute("""
@@ -713,7 +865,8 @@ class DurableCMSReceiverStore:
                     )
                     changed = self.connection.execute("""
                         UPDATE cms_receiver_publications
-                        SET payload_json = NULL, updated_at = ?
+                        SET payload_json = NULL, signature_json = NULL,
+                            updated_at = ?
                         WHERE delivery_id = ? AND status = 'superseded'
                     """, (now, old_delivery_id)).rowcount
                 except sqlite3.Error as error:
@@ -758,10 +911,11 @@ class DurableCMSReceiverStore:
             or publication["source_id"] != source_id
         ):
             raise CMSReceiverStoreBlocked("active publication is invalid")
-        payload = self._validate_publication_row(publication)
+        now = _timestamp(self.clock())
+        payload = self._validate_publication_row(publication, now=now)
         if payload is None:
             raise CMSReceiverStoreBlocked("active publication was deleted")
-        self._assert_publication_binding(payload, expected)
+        self._assert_publication_binding(payload, expected, now=now)
         return payload
 
     def register_tombstone(self, expectation: Any) -> Mapping[str, Any]:
@@ -806,7 +960,9 @@ class DurableCMSReceiverStore:
                 or source["active_delivery_id"] != value["publication_delivery_id"]
             ):
                 raise CMSReceiverStoreBlocked("tombstone publication is not active")
-            payload = self._validate_publication_row(publication)
+            payload = self._validate_publication_row(
+                publication, require_current_authorization=False,
+            )
             if (
                 not isinstance(payload, dict)
                 or payload.get("event_id") != value["event_id"]
@@ -885,7 +1041,9 @@ class DurableCMSReceiverStore:
                     ).fetchone()
                     if (
                         publication is None
-                        or self._validate_publication_row(publication) is not None
+                        or self._validate_publication_row(
+                            publication, require_current_authorization=False,
+                        ) is not None
                         or publication["status"] != "deleted"
                         or publication["payload_sha256"]
                         != expected["publication_payload_sha256"]
@@ -923,7 +1081,9 @@ class DurableCMSReceiverStore:
                 != expected["publication_delivery_id"]
             ):
                 raise CMSReceiverStoreBlocked("tombstone publication changed")
-            if self._validate_publication_row(publication) is None:
+            if self._validate_publication_row(
+                publication, require_current_authorization=False,
+            ) is None:
                 raise CMSReceiverStoreBlocked("tombstone publication was deleted")
             self.connection.execute(
                 "DELETE FROM cms_receiver_localizations WHERE delivery_id = ?",
@@ -931,7 +1091,8 @@ class DurableCMSReceiverStore:
             )
             changed = self.connection.execute("""
                 UPDATE cms_receiver_publications
-                SET payload_json = NULL, status = 'deleted',
+                SET payload_json = NULL, signature_json = NULL,
+                    status = 'deleted',
                     tombstone_delivery_id = ?, tombstone_payload_sha256 = ?,
                     updated_at = ?
                 WHERE delivery_id = ? AND status = 'active'
@@ -974,6 +1135,7 @@ class DurableCMSReceiverStore:
         contract_sha256 = _sha256(
             getattr(probe, "contract_sha256", None), field="contract_sha256",
         )
+        now = _timestamp(self.clock())
         self._verify_schema()
         if self.connection.in_transaction:
             raise CMSReceiverStoreBlocked("health cannot join an external transaction")
@@ -1017,7 +1179,7 @@ class DurableCMSReceiverStore:
             "SELECT * FROM cms_receiver_publications ORDER BY delivery_id"
         ).fetchall()
         for publication in publications:
-            self._validate_publication_row(publication)
+            self._validate_publication_row(publication, now=now)
         tombstones = self.connection.execute(
             "SELECT * FROM cms_receiver_tombstones ORDER BY tombstone_id"
         ).fetchall()

package/standard-skills/translate-native/integrations/website_localization_cms_source_client.py

@@ -346,6 +346,9 @@ class CMSLocalizationSourceHTTPClient:
         expected_capabilities_sha256: str,
         authentication_headers: Callable[[Mapping[str, Any]], Mapping[str, str]],
         *,
+        expected_runtime_capabilities_sha256: str,
+        expected_commercial_rendering_registry_sha256: str,
+        expected_terminal_receiver_capabilities_sha256: str | None = None,
         transport: HTTPTransport | None = None,
         timeout: float | int = 30,
         allow_loopback_http: bool = False,
@@ -360,6 +363,29 @@ class CMSLocalizationSourceHTTPClient:
             raise ValueError("expected capability digest is invalid")
         if not callable(authentication_headers):
             raise TypeError("authentication_headers must be callable")
+        if (
+            not isinstance(expected_runtime_capabilities_sha256, str)
+            or SHA256.fullmatch(expected_runtime_capabilities_sha256) is None
+            or not isinstance(
+                expected_commercial_rendering_registry_sha256, str,
+            )
+            or SHA256.fullmatch(
+                expected_commercial_rendering_registry_sha256
+            ) is None
+        ):
+            raise ValueError("expected runtime capability binding is invalid")
+        if (
+            expected_terminal_receiver_capabilities_sha256 is not None
+            and (
+                not isinstance(
+                    expected_terminal_receiver_capabilities_sha256, str,
+                )
+                or SHA256.fullmatch(
+                    expected_terminal_receiver_capabilities_sha256
+                ) is None
+            )
+        ):
+            raise ValueError("expected terminal receiver capability is invalid")
         if (
             isinstance(timeout, bool)
             or not isinstance(timeout, (int, float))
@@ -368,6 +394,15 @@ class CMSLocalizationSourceHTTPClient:
         ):
             raise ValueError("timeout is outside the supported range")
         self.expected_capabilities_sha256 = expected_capabilities_sha256
+        self.expected_runtime_capabilities_sha256 = (
+            expected_runtime_capabilities_sha256
+        )
+        self.expected_commercial_rendering_registry_sha256 = (
+            expected_commercial_rendering_registry_sha256
+        )
+        self.expected_terminal_receiver_capabilities_sha256 = (
+            expected_terminal_receiver_capabilities_sha256
+        )
         self.authentication_headers = authentication_headers
         self.transport = URLTransport() if transport is None else transport
         if not callable(getattr(self.transport, "request", None)):
@@ -417,14 +452,31 @@ class CMSLocalizationSourceHTTPClient:
         except Exception:
             _fail("local_contract_invalid")
         if (
-            set(response) != {"schema", "capabilities"}
+            set(response) != {
+                "schema", "capabilities", "capability_binding",
+            }
             or response.get("schema") != _HTTP.CAPABILITIES_RESPONSE_SCHEMA
             or response.get("capabilities") != expected
             or expected.get("sha256") != self.expected_capabilities_sha256
         ):
             _fail("capabilities_binding")
+        self._verified_runtime_binding(response.get("capability_binding"))
         return response
 
+    def _verified_runtime_binding(self, value: Any) -> Mapping[str, Any]:
+        try:
+            binding = _HTTP._capability_binding_payload(value)
+        except Exception:
+            _fail("runtime_capability_binding")
+        if (
+            binding["capabilities_sha256"]
+            != self.expected_runtime_capabilities_sha256
+            or binding["commercial_rendering_registry_sha256"]
+            != self.expected_commercial_rendering_registry_sha256
+        ):
+            _fail("runtime_capability_binding")
+        return binding
+
     def _contract(self, operation: str) -> Mapping[str, Any]:
         capabilities = self.capabilities()["capabilities"]
         return capabilities["operations"][operation]
@@ -498,6 +550,7 @@ class CMSLocalizationSourceHTTPClient:
             != self.expected_capabilities_sha256
         ):
             _fail("enqueue_binding")
+        self._verified_runtime_binding(response.get("capability_binding"))
         return response
 
     def status(self, event_id: str, site_id: str) -> Mapping[str, Any]:
@@ -522,6 +575,7 @@ class CMSLocalizationSourceHTTPClient:
             != self.expected_capabilities_sha256
         ):
             _fail("status_binding")
+        self._verified_runtime_binding(response.get("capability_binding"))
         try:
             normalized = _HTTP._source_status_payload(
                 _PayloadView(response["status"]),
@@ -532,6 +586,11 @@ class CMSLocalizationSourceHTTPClient:
             _fail("status_binding")
         if normalized != response["status"]:
             _fail("status_binding")
+        if (
+            normalized["terminal_receiver_capabilities_sha256"]
+            != self.expected_terminal_receiver_capabilities_sha256
+        ):
+            _fail("status_binding")
         return response
 
     def health(self) -> Mapping[str, Any]:
@@ -547,6 +606,7 @@ class CMSLocalizationSourceHTTPClient:
             != self.expected_capabilities_sha256
         ):
             _fail("health_binding")
+        self._verified_runtime_binding(response.get("capability_binding"))
         try:
             normalized = _HTTP._health_payload(_PayloadView(response["health"]))
         except Exception:
@@ -554,6 +614,8 @@ class CMSLocalizationSourceHTTPClient:
         if (
             normalized != response["health"]
             or (result.status == 503) != (normalized["status"] == "blocked")
+            or normalized["terminal_receiver_capabilities_sha256"]
+            != self.expected_terminal_receiver_capabilities_sha256
         ):
             _fail("health_binding")
         return response
@@ -571,6 +633,7 @@ class CMSLocalizationSourceHTTPClient:
             != self.expected_capabilities_sha256
         ):
             _fail("readiness_binding")
+        self._verified_runtime_binding(response.get("capability_binding"))
         try:
             normalized = _HTTP._readiness_payload(response["readiness"])
         except Exception: