infraweaver 0.1.0

package/src/mcp/terraform/eidas.ts

@@ -0,0 +1,134 @@
+/**
+ * §5.16 (first half) — the eIDAS assurance-level declaration.
+ *
+ * WHAT PROBLEM THIS SOLVES TODAY. The evidence bundle carries
+ * `signature: { algorithm: "ed25519", … }`, and a reader in a procurement or
+ * audit context can very reasonably over-read that as a legal seal. Under
+ * eIDAS (Reg. (EU) 910/2014 as amended by 2024/1183) an *electronic seal* is a
+ * defined legal instrument with three tiers, and ours is at the bottom one:
+ *
+ *   - **simple** — data attached to other data to ensure origin and integrity.
+ *     A raw Ed25519 signature over the bytes is exactly this, and no more.
+ *   - **advanced** (Art. 36) — additionally uniquely linked to, and capable of
+ *     identifying, the creating legal person, using seal-creation data that
+ *     person controls. That requires a certificate binding the key to an
+ *     identity; a bare public key in a JSON file binds it to nobody.
+ *   - **qualified** (Art. 35) — an advanced seal created by a qualified
+ *     seal-creation device with a **qualified certificate** from a QTSP on the
+ *     EU Trusted List. Only this tier gets the Art. 35(2) presumption of
+ *     integrity and correctness of origin.
+ *
+ * Art. 41's qualified electronic **time stamp** is a separate qualified service
+ * again, and is what gives a presumption about the *date and time*.
+ *
+ * SO THE BUNDLE SAYS SO, IN MACHINE-READABLE FORM. This block is not a
+ * disclaimer in prose that a parser skips — it is a field with a closed
+ * vocabulary, inside the signed bytes, that a buyer's tooling can assert on.
+ * Declaring a limit precisely is worth more than implying a capability we do
+ * not have, and this is the same correction the `suppressions` block made: the
+ * human-readable report and the signed artifact must not disagree about what a
+ * claim covers.
+ *
+ * ⚠️ WHAT IS DELIBERATELY NOT HERE. No ASiC-E container, no CAdES-LTA, no
+ * RFC 3161 timestamping, no QTSP integration. Those are the rest of §5.16 and
+ * they are blocked on a commercial and legal step — onboarding with a qualified
+ * trust service provider — that has not started. Building seal machinery we
+ * cannot exercise against a real QTSP would produce artifacts nobody can
+ * verify, and in an attestation product an unverifiable seal is worse than no
+ * seal. What this module does instead is make the CURRENT claim exact, and give
+ * the future qualified seal a schema slot to land in without a breaking change:
+ * `level` gains `"advanced"` / `"qualified"` and the optional fields fill in.
+ *
+ * Pure — no I/O, no ambient reads.
+ */
+import type { SignatureMetadata } from "#app/mcp/terraform/signing";
+
+/**
+ * The eIDAS electronic-seal tier this bundle's signature actually reaches.
+ * A closed vocabulary so a consumer can branch on it rather than parse prose.
+ *
+ * `"none"` is distinct from `"simple"` and is not a synonym for it: an unsigned
+ * bundle has no integrity protection at all, whereas a `"simple"` seal really
+ * does prove the bytes have not changed. Collapsing the two would understate a
+ * signed bundle and overstate an unsigned one.
+ */
+export type EidasSealLevel = "none" | "simple" | "advanced" | "qualified";
+
+export interface EidasSeal {
+  level: EidasSealLevel;
+  /** the precise claim this level supports. */
+  asserts: string;
+  /** the claim a reader might infer that this level does NOT support. Always
+   *  present — the whole point of the block is the second half. */
+  does_not_assert: string;
+  /**
+   * True only for `"qualified"`: whether Art. 35(2)'s presumption of integrity
+   * and of correctness of origin applies. Stated explicitly rather than left to
+   * be inferred from `level`, because that presumption is the entire commercial
+   * difference between the tiers.
+   */
+  eu_presumption: boolean;
+  /**
+   * The qualified trust service provider that issued the seal certificate, and
+   * its EU Trusted List entry. Absent until §5.16's QTSP onboarding completes —
+   * and its absence is itself the honest signal that no QTSP is involved.
+   */
+  qtsp?: { name: string; trusted_list_url: string };
+  /** Art. 41 qualified electronic time stamp, when one has been obtained.
+   *  Absent today: we apply no timestamp of any kind, qualified or not. */
+  timestamp?: { authority: string; obtained_at: string; token_path: string };
+}
+
+const SIMPLE_ASSERTS =
+  "these exact bytes were signed by the holder of the Ed25519 key whose public key and " +
+  "SHA-256 fingerprint are recorded in this bundle, so any modification is detectable — an " +
+  "electronic seal in the SIMPLE sense of eIDAS (Reg. (EU) 910/2014)";
+
+const SIMPLE_DOES_NOT_ASSERT =
+  "that the seal is ADVANCED (Art. 36) or QUALIFIED (Art. 35): the key is bound to no " +
+  "qualified certificate and no QTSP on an EU Trusted List, so the signature identifies a key " +
+  "rather than a legal person and carries NO Art. 35(2) presumption of integrity or of " +
+  "correctness of origin. It also carries no qualified time stamp (Art. 41), so the bundle's " +
+  "own `generated_at` is a claim by the signer, not independently attested time";
+
+const NONE_ASSERTS =
+  "nothing about origin or integrity — this bundle is unsigned";
+
+const NONE_DOES_NOT_ASSERT =
+  "any eIDAS seal level, including the simple one: with no signing key configured " +
+  "(INFRAWEAVER_SIGNING_KEY unset) the bytes carry no cryptographic protection at all and may have " +
+  "been altered after generation without detection";
+
+/**
+ * Declare the eIDAS assurance level for a bundle, from its signature metadata.
+ *
+ * Derived from what is actually present rather than configured, so the
+ * declaration cannot drift from reality: there is no input that makes an
+ * unsigned bundle claim a seal, and no way to assert `qualified` without the
+ * QTSP fields that do not yet exist.
+ */
+export function eidasSealFor(signature: SignatureMetadata | null): EidasSeal {
+  if (!signature) {
+    return {
+      level: "none",
+      asserts: NONE_ASSERTS,
+      does_not_assert: NONE_DOES_NOT_ASSERT,
+      eu_presumption: false,
+    };
+  }
+  return {
+    level: "simple",
+    asserts: SIMPLE_ASSERTS,
+    does_not_assert: SIMPLE_DOES_NOT_ASSERT,
+    eu_presumption: false,
+  };
+}
+
+/**
+ * Whether a level may claim the Art. 35(2) presumption. Only `"qualified"` may,
+ * and today nothing produces that level — this exists so the invariant is
+ * asserted in one place rather than re-derived when the QTSP work lands.
+ */
+export function grantsEuPresumption(level: EidasSealLevel): boolean {
+  return level === "qualified";
+}