authzloom 1.0.1__tar.gz

authzloom-1.0.1/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 AuthzLoom contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

authzloom-1.0.1/PKG-INFO

@@ -0,0 +1,185 @@
+Metadata-Version: 2.4
+Name: authzloom
+Version: 1.0.1
+Summary: Local-first authorization matrix testing with redacted readback evidence
+License: MIT
+Keywords: authorization,security-testing,mcp,burp-suite,graphql
+Classifier: Development Status :: 4 - Beta
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Provides-Extra: yaml
+Requires-Dist: PyYAML>=6.0.2; extra == "yaml"
+Provides-Extra: cdp
+Requires-Dist: playwright>=1.55; extra == "cdp"
+Provides-Extra: dev
+Requires-Dist: pytest>=8.4; extra == "dev"
+Dynamic: license-file
+
+# AuthzLoom
+
+I built AuthzLoom to make authorization testing easier to repeat and easier to
+review. You describe the identities, controlled objects and operation you want
+to test. AuthzLoom builds the matrix, runs it within the limits you set and
+keeps redacted evidence of what happened.
+
+It works with REST and GraphQL and can be used from the command line, through
+MCP, through its local HTTP API or with the optional Burp Suite extension.
+
+AuthzLoom does not decide whether something is a vulnerability and it does not
+assign severity. It collects evidence. The final judgment stays with the
+person reviewing the result.
+
+## What it protects
+
+Authorization testing can change data, so I designed the tool around explicit
+limits:
+
+- Every scenario defines its allowed hosts, methods, request budget and rate.
+- Every request goes through the same policy validation, including identity
+  probes.
+- An operation that changes state must have a readback step.
+- Cleanup runs after a mutation may have been sent, even when the case fails or
+  is cancelled.
+- Direct connections are limited to local labs and never follow redirects.
+- Traffic to anything outside the local machine must use a Burp or CDP session
+  controlled by the operator.
+- Live credentials do not belong in scenario files. Burp keeps the original
+  request and gives Python an opaque `cap_*` handle instead.
+- Local runs stay local. Exported capsules are redacted and never contain raw
+  Burp capture bytes.
+
+Only use AuthzLoom on systems you own or have explicit permission to test.
+
+## Installation
+
+You need Python 3.11 or newer.
+
+On Windows:
+
+```powershell
+git clone <repository-url> authzloom
+cd authzloom
+powershell -ExecutionPolicy Bypass -File ./setup-env.ps1 -Dev
+```
+
+If you already manage your own Python environment:
+
+```bash
+python -m pip install -e '.[dev]'
+```
+
+The optional dependency groups are `yaml`, `cdp` and `dev`.
+
+## Try it from the command line
+
+The included example expects a synthetic service on `127.0.0.1:8877`.
+Validation and planning are offline. Running the scenario requires the local
+lab service.
+
+```powershell
+./.venv/Scripts/authzloom.exe init ./scenario.json
+./.venv/Scripts/authzloom.exe validate ./examples/rest.json
+./.venv/Scripts/authzloom.exe plan ./examples/rest.json --explain
+./.venv/Scripts/authzloom.exe run ./examples/rest.json
+./.venv/Scripts/authzloom.exe status
+./.venv/Scripts/authzloom.exe export <RUN_ID> --output capsule.redacted.json
+./.venv/Scripts/authzloom.exe schema > schemas/scenario.v1.json
+```
+
+There is also a GraphQL example in `examples/graphql.json`. To see structured
+logs without secrets, set `AUTHZLOOM_LOG=1`.
+
+You can run the module directly too:
+
+```powershell
+./.venv/Scripts/python.exe -m authzloom.cli --help
+```
+
+## Using AuthzLoom with an AI client
+
+AuthzLoom includes an MCP server:
+
+```powershell
+./.venv/Scripts/authzloom.exe mcp
+```
+
+For an installed registry package, the canonical package launcher is:
+
+```bash
+uvx authzloom mcp
+```
+
+`authzloom-mcp` remains available as a compatibility entry point, but catalogs
+and managed launchers should identify the `authzloom` package and invoke the
+`mcp` subcommand.
+
+MCP communicates over standard input and output. If you start it by hand, it
+will appear to wait silently. That is expected. Normally, your MCP client
+starts and controls the process:
+
+```json
+{
+  "mcpServers": {
+    "authzloom": {
+      "command": "C:/absolute/path/authzloom/.venv/Scripts/python.exe",
+      "args": ["-m", "authzloom.cli", "mcp"],
+      "env": {
+        "AUTHZLOOM_DATA_DIR": "C:/absolute/path/authzloom/.authzloom"
+      }
+    }
+  }
+}
+```
+
+The available tools are `authzloom_ingest`, `authzloom_plan`,
+`authzloom_run`, `authzloom_status` and `authzloom_export`. Always plan a
+scenario before running it.
+
+## Using the Burp extension
+
+Burp Suite is not included. Point `BURP_JAR` to your local Burp installation,
+build the extension and start the launcher:
+
+```powershell
+$env:BURP_JAR = 'C:\path\to\burpsuite.jar'
+powershell -ExecutionPolicy Bypass -File ./burp-extension/build.ps1
+powershell -ExecutionPolicy Bypass -File ./start-authzloom-burp.ps1
+```
+
+Load `burp-extension/build/authzloom-burp.jar` through Burp's extension
+settings if it is not already loaded.
+
+The launcher creates a temporary shared token, starts the local API on
+`127.0.0.1:8891` and opens Burp. The extension runs its replay bridge on
+`127.0.0.1:8892` and adds **Send to AuthzLoom** to Burp's context menu.
+
+When you send a request to AuthzLoom, the live bytes stay inside Burp. Python
+receives the host, method, path and an opaque handle. During replay, only an
+allowlisted overlay is applied. Authorization and Cookie headers remain under
+Burp's control.
+
+The local API provides `GET /health`, `GET /ready` and `GET /version`.
+`/status` accepts `limit` and `offset`. It only binds to loopback.
+
+## Development
+
+Run the complete local check before submitting a change:
+
+```powershell
+powershell -ExecutionPolicy Bypass -File ./verify-integration.ps1
+```
+
+Please keep the public repository independent. Private paths, client
+configuration, target evidence, credentials and generated run data should
+never be committed.
+
+## License
+
+AuthzLoom is available under the MIT License. See [LICENSE](LICENSE).

authzloom-1.0.1/README.md

@@ -0,0 +1,161 @@
+# AuthzLoom
+
+I built AuthzLoom to make authorization testing easier to repeat and easier to
+review. You describe the identities, controlled objects and operation you want
+to test. AuthzLoom builds the matrix, runs it within the limits you set and
+keeps redacted evidence of what happened.
+
+It works with REST and GraphQL and can be used from the command line, through
+MCP, through its local HTTP API or with the optional Burp Suite extension.
+
+AuthzLoom does not decide whether something is a vulnerability and it does not
+assign severity. It collects evidence. The final judgment stays with the
+person reviewing the result.
+
+## What it protects
+
+Authorization testing can change data, so I designed the tool around explicit
+limits:
+
+- Every scenario defines its allowed hosts, methods, request budget and rate.
+- Every request goes through the same policy validation, including identity
+  probes.
+- An operation that changes state must have a readback step.
+- Cleanup runs after a mutation may have been sent, even when the case fails or
+  is cancelled.
+- Direct connections are limited to local labs and never follow redirects.
+- Traffic to anything outside the local machine must use a Burp or CDP session
+  controlled by the operator.
+- Live credentials do not belong in scenario files. Burp keeps the original
+  request and gives Python an opaque `cap_*` handle instead.
+- Local runs stay local. Exported capsules are redacted and never contain raw
+  Burp capture bytes.
+
+Only use AuthzLoom on systems you own or have explicit permission to test.
+
+## Installation
+
+You need Python 3.11 or newer.
+
+On Windows:
+
+```powershell
+git clone <repository-url> authzloom
+cd authzloom
+powershell -ExecutionPolicy Bypass -File ./setup-env.ps1 -Dev
+```
+
+If you already manage your own Python environment:
+
+```bash
+python -m pip install -e '.[dev]'
+```
+
+The optional dependency groups are `yaml`, `cdp` and `dev`.
+
+## Try it from the command line
+
+The included example expects a synthetic service on `127.0.0.1:8877`.
+Validation and planning are offline. Running the scenario requires the local
+lab service.
+
+```powershell
+./.venv/Scripts/authzloom.exe init ./scenario.json
+./.venv/Scripts/authzloom.exe validate ./examples/rest.json
+./.venv/Scripts/authzloom.exe plan ./examples/rest.json --explain
+./.venv/Scripts/authzloom.exe run ./examples/rest.json
+./.venv/Scripts/authzloom.exe status
+./.venv/Scripts/authzloom.exe export <RUN_ID> --output capsule.redacted.json
+./.venv/Scripts/authzloom.exe schema > schemas/scenario.v1.json
+```
+
+There is also a GraphQL example in `examples/graphql.json`. To see structured
+logs without secrets, set `AUTHZLOOM_LOG=1`.
+
+You can run the module directly too:
+
+```powershell
+./.venv/Scripts/python.exe -m authzloom.cli --help
+```
+
+## Using AuthzLoom with an AI client
+
+AuthzLoom includes an MCP server:
+
+```powershell
+./.venv/Scripts/authzloom.exe mcp
+```
+
+For an installed registry package, the canonical package launcher is:
+
+```bash
+uvx authzloom mcp
+```
+
+`authzloom-mcp` remains available as a compatibility entry point, but catalogs
+and managed launchers should identify the `authzloom` package and invoke the
+`mcp` subcommand.
+
+MCP communicates over standard input and output. If you start it by hand, it
+will appear to wait silently. That is expected. Normally, your MCP client
+starts and controls the process:
+
+```json
+{
+  "mcpServers": {
+    "authzloom": {
+      "command": "C:/absolute/path/authzloom/.venv/Scripts/python.exe",
+      "args": ["-m", "authzloom.cli", "mcp"],
+      "env": {
+        "AUTHZLOOM_DATA_DIR": "C:/absolute/path/authzloom/.authzloom"
+      }
+    }
+  }
+}
+```
+
+The available tools are `authzloom_ingest`, `authzloom_plan`,
+`authzloom_run`, `authzloom_status` and `authzloom_export`. Always plan a
+scenario before running it.
+
+## Using the Burp extension
+
+Burp Suite is not included. Point `BURP_JAR` to your local Burp installation,
+build the extension and start the launcher:
+
+```powershell
+$env:BURP_JAR = 'C:\path\to\burpsuite.jar'
+powershell -ExecutionPolicy Bypass -File ./burp-extension/build.ps1
+powershell -ExecutionPolicy Bypass -File ./start-authzloom-burp.ps1
+```
+
+Load `burp-extension/build/authzloom-burp.jar` through Burp's extension
+settings if it is not already loaded.
+
+The launcher creates a temporary shared token, starts the local API on
+`127.0.0.1:8891` and opens Burp. The extension runs its replay bridge on
+`127.0.0.1:8892` and adds **Send to AuthzLoom** to Burp's context menu.
+
+When you send a request to AuthzLoom, the live bytes stay inside Burp. Python
+receives the host, method, path and an opaque handle. During replay, only an
+allowlisted overlay is applied. Authorization and Cookie headers remain under
+Burp's control.
+
+The local API provides `GET /health`, `GET /ready` and `GET /version`.
+`/status` accepts `limit` and `offset`. It only binds to loopback.
+
+## Development
+
+Run the complete local check before submitting a change:
+
+```powershell
+powershell -ExecutionPolicy Bypass -File ./verify-integration.ps1
+```
+
+Please keep the public repository independent. Private paths, client
+configuration, target evidence, credentials and generated run data should
+never be committed.
+
+## License
+
+AuthzLoom is available under the MIT License. See [LICENSE](LICENSE).

authzloom-1.0.1/pyproject.toml

@@ -0,0 +1,34 @@
+[build-system]
+requires = ["setuptools>=75"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "authzloom"
+version = "1.0.1"
+description = "Local-first authorization matrix testing with redacted readback evidence"
+readme = "README.md"
+requires-python = ">=3.11"
+license = { text = "MIT" }
+keywords = ["authorization", "security-testing", "mcp", "burp-suite", "graphql"]
+classifiers = [
+  "Development Status :: 4 - Beta",
+  "License :: OSI Approved :: MIT License",
+  "Programming Language :: Python :: 3",
+  "Programming Language :: Python :: 3.11",
+  "Programming Language :: Python :: 3.12",
+  "Programming Language :: Python :: 3.13",
+  "Topic :: Security",
+]
+dependencies = []
+
+[project.optional-dependencies]
+yaml = ["PyYAML>=6.0.2"]
+cdp = ["playwright>=1.55"]
+dev = ["pytest>=8.4"]
+
+[project.scripts]
+authzloom = "authzloom.cli:main"
+authzloom-mcp = "authzloom.mcp_server:main"
+
+[tool.setuptools.packages.find]
+where = ["src"]

authzloom-1.0.1/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

authzloom-1.0.1/src/authzloom/__init__.py

@@ -0,0 +1,3 @@
+"""AuthzLoom: bounded authorization testing with readback evidence."""
+
+__version__ = "1.0.1"

authzloom-1.0.1/src/authzloom/__main__.py

@@ -0,0 +1,4 @@
+from .cli import main
+
+raise SystemExit(main())
+

authzloom-1.0.1/src/authzloom/api.py

@@ -0,0 +1,180 @@
+from __future__ import annotations
+
+import json
+import os
+import signal
+import threading
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from pathlib import Path
+from typing import Any
+from urllib.parse import parse_qs, urlparse
+
+from . import __version__
+from .captures import CaptureRegistry
+from .errors import AuthzLoomError, LimitExceeded, RunInProgress, RunNotFound, public_error
+from .executor import run
+from .limits import Limits
+from .models import Scenario
+from .planner import plan
+from .redact import redact
+from .store import Store
+
+
+class AuthzLoomService:
+    def __init__(self, root: Path, token: str, limits: Limits | None = None):
+        self.limits = limits or Limits.from_env()
+        self.store, self.token = Store(root, self.limits), token
+        self.captures = CaptureRegistry(self.limits)
+        self._run_lock = threading.Lock()
+        self._running = False
+        self._cancel = threading.Event()
+        self.ingested: list[dict[str, Any]] = []
+
+    def close(self) -> None:
+        self.store.close()
+
+    def handler(self):
+        service = self
+
+        class Handler(BaseHTTPRequestHandler):
+            def _json(self, status: int, value: Any):
+                data = json.dumps(value).encode()
+                self.send_response(status)
+                self.send_header("Content-Type", "application/json")
+                self.send_header("Content-Length", str(len(data)))
+                self.end_headers()
+                self.wfile.write(data)
+
+            def _authorized(self) -> bool:
+                return bool(service.token) and self.headers.get("Authorization") == f"Bearer {service.token}"
+
+            def _body(self):
+                length = int(self.headers.get("Content-Length", 0) or 0)
+                if length > service.limits.max_api_body_bytes:
+                    raise LimitExceeded("input or output exceeds configured limits")
+                if length < 0:
+                    raise LimitExceeded("input or output exceeds configured limits")
+                raw = self.rfile.read(length) if length else b"{}"
+                if len(raw) > service.limits.max_api_body_bytes:
+                    raise LimitExceeded("input or output exceeds configured limits")
+                return json.loads(raw or b"{}")
+
+            def _discard_body(self):
+                length = int(self.headers.get("Content-Length", 0) or 0)
+                if length <= 0:
+                    return
+                remaining = min(length, service.limits.max_api_body_bytes)
+                while remaining > 0:
+                    chunk = self.rfile.read(min(65_536, remaining))
+                    if not chunk:
+                        break
+                    remaining -= len(chunk)
+
+            def do_GET(self):
+                parsed = urlparse(self.path)
+                if parsed.path == "/health":
+                    return self._json(200, {"ok": True, "service": "authzloom"})
+                if parsed.path == "/version":
+                    return self._json(200, {"name": "authzloom", "version": __version__})
+                if parsed.path == "/ready":
+                    try:
+                        service.store.list(limit=1)
+                    except Exception:
+                        return self._json(503, {"ok": False, "service": "authzloom"})
+                    return self._json(200, {"ok": True, "service": "authzloom"})
+                if not self._authorized():
+                    return self._json(401, {"error": "unauthorized"})
+                if parsed.path == "/status":
+                    query = parse_qs(parsed.query)
+                    limit = int((query.get("limit") or ["50"])[0])
+                    offset = int((query.get("offset") or ["0"])[0])
+                    return self._json(200, service.store.list(limit=limit, offset=offset))
+                if parsed.path.startswith("/export/"):
+                    try:
+                        return self._json(200, redact(service.store.get(parsed.path.rsplit("/", 1)[-1])))
+                    except RunNotFound:
+                        return self._json(404, {"error": "unknown run"})
+                    except AuthzLoomError as exc:
+                        return self._json(exc.http_status, exc.to_dict())
+                self._json(404, {"error": "not found"})
+
+            def do_POST(self):
+                if not self._authorized():
+                    return self._json(401, {"error": "unauthorized"})
+                parsed = urlparse(self.path)
+                try:
+                    if parsed.path == "/cancel":
+                        self._discard_body()
+                        service._cancel.set()
+                        return self._json(202, {"ok": True, "state": "cancelled"})
+                    body = self._body()
+                    if parsed.path == "/ingest":
+                        if any(key in body for key in ("request_b64", "response_b64", "raw", "raw_capture")):
+                            raise LimitExceeded("captures must remain in the Burp bridge; send a handle")
+                        meta = None
+                        if body.get("handle") and body.get("host"):
+                            meta = service.captures.ingest_document(body)
+                        clean = redact(body)
+                        service.ingested.append(clean)
+                        if len(service.ingested) > service.limits.max_ingested_captures:
+                            service.ingested.pop(0)
+                        payload = {"ingest_id": len(service.ingested) - 1, "capture": clean}
+                        if meta:
+                            payload.update(meta)
+                        return self._json(202, payload)
+                    if parsed.path == "/plan":
+                        scenario = Scenario.from_dict(body)
+                        return self._json(200, {"cases": [vars_case(x) for x in plan(scenario)]})
+                    if parsed.path == "/run":
+                        scenario = Scenario.from_dict(body)
+                        if not service._run_lock.acquire(blocking=False):
+                            raise RunInProgress("another run is already active")
+                        service._running = True
+                        service._cancel.clear()
+                        try:
+                            result = run(
+                                scenario,
+                                burp_token=os.environ.get("AUTHZLOOM_TOKEN", service.token),
+                                cancel=service._cancel,
+                            )
+                            run_id = service.store.save(result)
+                            return self._json(200, {"run_id": run_id, "result": redact(result)})
+                        finally:
+                            service._running = False
+                            service._run_lock.release()
+                    return self._json(404, {"error": "not found"})
+                except AuthzLoomError as exc:
+                    return self._json(exc.http_status, exc.to_dict())
+                except Exception:
+                    return self._json(400, public_error(Exception()))
+
+            def log_message(self, *_):
+                pass
+
+        return Handler
+
+
+def vars_case(case):
+    return {"name": case.name, "session": case.session, "object_owner": case.object_owner}
+
+
+def serve(host: str, port: int, root: Path, token: str) -> None:
+    if host not in {"127.0.0.1", "::1", "localhost"}:
+        raise ValueError("AuthzLoom API must bind to loopback")
+    service = AuthzLoomService(root, token)
+    server = ThreadingHTTPServer((host, port), service.handler())
+    print(f"AuthzLoom listening on http://{host}:{port}")
+
+    def _stop(*_):
+        threading.Thread(target=server.shutdown, daemon=True).start()
+
+    try:
+        signal.signal(signal.SIGINT, _stop)
+        signal.signal(signal.SIGTERM, _stop)
+    except (ValueError, OSError):
+        pass
+    try:
+        server.serve_forever()
+    finally:
+        server.server_close()
+        service.close()

authzloom-1.0.1/src/authzloom/assertions.py

@@ -0,0 +1,71 @@
+from __future__ import annotations
+
+import json
+import re
+from typing import Any
+
+from .models import Assertion
+
+STATUS_NOT_RUN = "not_run"
+STATUS_PASSED = "passed"
+STATUS_FAILED = "failed"
+STATUS_ERROR = "error"
+
+_INDEX = re.compile(r"^(0|[1-9][0-9]*)$")
+
+
+def _walk(value: Any, segments: list[Any]) -> Any:
+    for part in segments:
+        if isinstance(value, list):
+            if not isinstance(part, int):
+                if not (isinstance(part, str) and _INDEX.fullmatch(part)):
+                    raise KeyError(part)
+                part = int(part)
+            value = value[part]
+        elif isinstance(value, dict):
+            if part in value:
+                value = value[part]
+            elif str(part) in value:
+                value = value[str(part)]
+            else:
+                raise KeyError(part)
+        else:
+            raise TypeError(part)
+    return value
+
+
+def path_segments(assertion: Assertion) -> list[Any]:
+    if assertion.segments:
+        return list(assertion.segments)
+    if not assertion.path:
+        return []
+    parts: list[Any] = []
+    for part in assertion.path.strip(".").split("."):
+        if _INDEX.fullmatch(part):
+            parts.append(int(part))
+        else:
+            parts.append(part)
+    return parts
+
+
+def evaluate(response_body: str, assertion: Assertion | None, *, truncated: bool = False) -> tuple[bool | None, str]:
+    if assertion is None:
+        return None, STATUS_NOT_RUN
+    if truncated:
+        return False, STATUS_ERROR
+    try:
+        value: Any = json.loads(response_body)
+        parse_error = False
+    except json.JSONDecodeError:
+        value = response_body
+        parse_error = True
+    segments = path_segments(assertion)
+    if segments:
+        if parse_error:
+            return False, STATUS_ERROR
+        try:
+            value = _walk(value, segments)
+        except (KeyError, IndexError, TypeError, ValueError):
+            return False, STATUS_FAILED
+    passed = value == assertion.equals
+    return passed, STATUS_PASSED if passed else STATUS_FAILED