ciris-server 0.4.2__tar.gz → 0.4.3__tar.gz

{ciris_server-0.4.2 → ciris_server-0.4.3}/Cargo.lock

@@ -994,7 +994,7 @@ dependencies = [
 
 [[package]]
 name = "ciris-server"
-version = "0.4.2"
+version = "0.4.3"
 dependencies = [
  "anyhow",
  "async-trait",

{ciris_server-0.4.2 → ciris_server-0.4.3}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "ciris-server"
-version = "0.4.2"   # 0.1 = lens-only (agent ~2.9.7); 0.3 = +auth subsystem / one-wheel; 0.4 = +federation peering/identity (capacity scoring, consent:replication, register_federation_key gate, root-bootstrap, NodeCode); 0.4.1 = self-attested first-run root claim (fresh-founder hybrid PoP, #887); 0.4.2 = one-time claim PIN on fresh boot (operator-presence gate); 0.5 = +registry (~2.9.8); 1.0 = +node (~2.9.10). Patch forward on breakage.
+version = "0.4.3"   # 0.1 = lens-only (agent ~2.9.7); 0.3 = +auth subsystem / one-wheel; 0.4 = +federation peering/identity (capacity scoring, consent:replication, register_federation_key gate, root-bootstrap, NodeCode); 0.4.1 = self-attested first-run root claim (fresh-founder hybrid PoP, #887); 0.4.2 = one-time claim PIN; 0.4.3 = CC-compliant ownership: infra:* responsible-party owner-binding (node-role, agency-forbidden), serve-only-until-owned; 0.5 = +registry (~2.9.8); 1.0 = +node (~2.9.10). Patch forward on breakage.
 edition = "2021"
 # MSRV floor is set by the substrate: ciris-verify v5.2.0 requires 1.86
 # (persist v6.0.1 is 1.83). Build with the higher of the two.

{ciris_server-0.4.2 → ciris_server-0.4.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ciris-server
-Version: 0.4.2
+Version: 0.4.3
 License-File: LICENSE
 Summary: The fabric node — the federation's headless cohabitation runtime (registry + lens [+ node] over one shared substrate), as the abi3 wheel CIRISAgent consumes. agent = fabric node + brain.
 Author-email: Eric Moore <eric@ciris.ai>

{ciris_server-0.4.2 → ciris_server-0.4.3}/src/auth/bootstrap.rs

@@ -592,6 +592,20 @@ struct SetupRootRequest {
     /// NOT the federation directory.
     #[serde(default)]
     founder: Option<Founder>,
+    /// The cohort scope the responsible party claims this node under — one of
+    /// `self` / `family` / `community` (CC 4.4.3.4.1 cohort scopes). REQUIRED:
+    /// it records the membership-standing tier the owner-binding covers. Rides
+    /// inside the signed body, so it is signature-bound. Validated against the
+    /// closed set; anything else → `400`.
+    #[serde(default)]
+    cohort_scope: Option<String>,
+    /// OPTIONAL explicit infra scope set for the owner-binding (CC 4.4.3.5 —
+    /// `infra:*` ONLY). When absent the canonical
+    /// [`ownership::OWNER_BINDING_INFRA_SCOPES`] set is used. Any `agency:*` (or
+    /// legacy agency) scope here is REJECTED (CC 1.13.5): a node delegation
+    /// literally cannot carry agency.
+    #[serde(default)]
+    infra_scopes: Option<Vec<String>>,
     /// The one-time CLAIM PIN printed to THIS node's console/log on a fresh boot —
     /// the operator-presence secret (CONSOLE-ONLY; never served over HTTP). It is
     /// verified (constant-time) against the boot PIN before ROOT is bound, and
@@ -606,10 +620,42 @@ struct SetupRootRequest {
 struct SetupRootResponse {
     /// The ROOT `wa_id` that was claimed.
     wa_id: String,
-    /// The claiming federation identity (`key_id`).
+    /// The claiming federation identity (`key_id`) — the RESPONSIBLE PARTY (a
+    /// `user`-role identity), NOT a bare node.
     identity_key_id: String,
-    /// The bridged API role (`SYSTEM_ADMIN`).
+    /// The bridged API role (`SYSTEM_ADMIN`), derived from the owner-binding.
     role: String,
+    /// The cohort scope the node was claimed under (`self` / `family` /
+    /// `community`).
+    cohort_scope: String,
+    /// The owner-binding `delegates_to(user → node, infra:*)` attestation id (the
+    /// CC 3.2 responsible-party binding that was emitted).
+    owner_binding_attestation_id: String,
+}
+
+/// The closed set of cohort scopes a node may be claimed under (CC 4.4.3.4.1).
+const COHORT_SCOPES: &[&str] = &["self", "family", "community"];
+
+/// Validate the claimed cohort scope against [`COHORT_SCOPES`]. Returns the
+/// normalized (trimmed) value, or `Err(response)` (a `400`) when absent/invalid.
+/// The error is boxed (`result_large_err`) — an axum `Response` is large and
+/// this is the cold/reject path.
+fn validate_cohort_scope(req: &SetupRootRequest) -> Result<String, Box<Response>> {
+    let Some(raw) = req.cohort_scope.as_deref() else {
+        return Err(Box::new(err(
+            StatusCode::BAD_REQUEST,
+            "first-run ROOT claim must carry `cohort_scope` (one of self|family|community)",
+        )));
+    };
+    let v = raw.trim();
+    if COHORT_SCOPES.contains(&v) {
+        Ok(v.to_string())
+    } else {
+        Err(Box::new(err(
+            StatusCode::BAD_REQUEST,
+            format!("invalid cohort_scope {v:?} — must be one of self|family|community"),
+        )))
+    }
 }
 
 fn err(code: StatusCode, msg: impl Into<String>) -> Response {
@@ -707,6 +753,26 @@ fn verify_claim_pin(st: &SetupState, req: &SetupRootRequest) -> Option<Response>
 /// `POST /v1/setup/root` — first-time-setup ROOT claim for a FRESH node with no
 /// baked seed.
 ///
+/// # The responsible-party model (CC 4.4.3.5 + CC 3.2 + CC 1.13.5)
+///
+/// A fabric node is `node`-role and MUST NOT have agency ("infrastructure must
+/// not have agency", CC 1.13.5). This claim therefore establishes a RESPONSIBLE
+/// PARTY, not an agency partnership:
+///
+///   - the claimant is the **responsible user** — registered as `identity_type
+///     "user"` (CC 3.2: ownership roots in an accountable human);
+///   - on success the handler emits the structural owner-binding
+///     `delegates_to(user → THIS node, infra:*)`
+///     ([`ownership::emit_owner_binding`]) — `infra:*` scopes ONLY;
+///   - it records the chosen `cohort_scope` (self|family|community); and
+///   - the ROOT WaCert / `SYSTEM_ADMIN` is the *derived* API-role view of that
+///     same responsible party.
+///
+/// Any `agency:*` (or legacy agency) scope in the claim is REJECTED (`400`) — a
+/// node delegation literally cannot carry agency (the CC 1.13.5 wire-checkable
+/// invariant). The AGENT's joint-agency partnership (`agency:*` +
+/// `consent:partnership_grant/accept`) stays in the agent, NOT here.
+///
 /// # Security model — four independent gates
 ///
 /// 0. **One-time CLAIM PIN (operator-presence)** — the claim MUST carry the
@@ -835,6 +901,32 @@ async fn setup_root(
         );
     };
 
+    // (responsible-party model — CC 4.4.3.5 + CC 3.2 + CC 1.13.5)
+    // The claimant is the RESPONSIBLE PARTY, not an agency partner. Two
+    // body-level gates before we spend a signature verify:
+    //   (b) the cohort scope (self|family|community) the node is claimed under, and
+    //   (CC 1.13.5) REFUSE any agency:* (or legacy agency) scope in the claim — a
+    //       node delegation literally cannot carry agency. The owner-binding is
+    //       infra:* ONLY.
+    let cohort_scope = match validate_cohort_scope(&req) {
+        Ok(v) => v,
+        Err(resp) => return *resp,
+    };
+    let infra_scopes: Vec<String> = match req.infra_scopes.clone() {
+        Some(s) => s,
+        None => super::ownership::OWNER_BINDING_INFRA_SCOPES
+            .iter()
+            .map(|s| s.to_string())
+            .collect(),
+    };
+    if !super::ownership::scopes_are_infra_only(&infra_scopes) {
+        return err(
+            StatusCode::BAD_REQUEST,
+            "first-run ROOT claim carries a non-infra (agency:* or legacy-agency) scope — \
+             a node delegation MUST be infra:* ONLY (CC 1.13.5); agency stays in the agent",
+        );
+    }
+
     let signing_key_id = match header_str(&headers, verify::HEADER_KEY_ID) {
         Some(v) => v,
         None => {
@@ -942,6 +1034,32 @@ async fn setup_root(
     };
     match store::upsert(&st.engine, cert).await {
         Ok(()) => {
+            // (responsible-party model, CC 3.2) Emit the owner-binding
+            // delegates_to(responsible_user → THIS node, infra:*). This is the
+            // STRUCTURAL artifact that binds the node UNDER the user's authority
+            // with NO agency (CC 1.13.5); the ROOT WaCert / SystemAdmin above is
+            // the derived API-role view of the SAME responsible party. The scope
+            // set was already proven infra-only (the agency reject gate ran on the
+            // body). A failure here is fatal to the claim's CC-meaning, so surface
+            // it (the ROOT cert exists but is owner-unbound — we report 500 so the
+            // operator re-drives rather than silently leaving a half-bound node).
+            let owner_binding_attestation_id = match super::ownership::emit_owner_binding(
+                &st.engine,
+                &founder.key_id,
+                &st.node_key_id,
+                &infra_scopes,
+            )
+            .await
+            {
+                Ok(id) => id,
+                Err(e) => {
+                    return err(
+                        StatusCode::INTERNAL_SERVER_ERROR,
+                        format!("ROOT bound but owner-binding emit failed: {e}"),
+                    )
+                }
+            };
+
             // Consume the one-time PIN: clear it so it can never be replayed. (The
             // route is also 409-closed now that a ROOT exists — this is defence in
             // depth + makes the consumed-once invariant directly assertable.)
@@ -951,8 +1069,11 @@ async fn setup_root(
             tracing::info!(
                 identity = %founder.key_id,
                 wa_id = %wa_id,
-                "first-run ROOT claim: self-attested founder registered + bound as ROOT \
-                 (founder → SYSTEM_ADMIN); one-time claim PIN consumed"
+                cohort_scope = %cohort_scope,
+                owner_binding = %owner_binding_attestation_id,
+                "first-run ROOT claim: responsible user registered + owner-binding \
+                 delegates_to(user → node, infra:*) emitted; ROOT/SYSTEM_ADMIN derived; \
+                 one-time claim PIN consumed (CC 3.2 / CC 1.13.5)"
             );
             (
                 StatusCode::CREATED,
@@ -960,6 +1081,8 @@ async fn setup_root(
                     wa_id,
                     identity_key_id: founder.key_id,
                     role: super::roles::UserRole::SystemAdmin.as_str().to_string(),
+                    cohort_scope,
+                    owner_binding_attestation_id,
                 }),
             )
                 .into_response()
@@ -994,9 +1117,15 @@ fn header_str(headers: &HeaderMap, name: &str) -> Option<String> {
 /// just over the body. So we record the proven identity directly via
 /// [`put_public_key`](ciris_persist::federation::FederationDirectory::put_public_key),
 /// which keeps its own `algorithm == hybrid` + `accord_holder` attestation gates
-/// (a `steward` row needs no attestation). The `scrub_*` fields are populated for
+/// (a `user` row needs no attestation). The `scrub_*` fields are populated for
 /// row-shape completeness (a self-attested envelope + the body signatures); they
 /// are NOT re-verified by `put_public_key`.
+///
+/// **The claimant is the RESPONSIBLE PARTY (CC 3.2): a `user`-role identity, NOT
+/// a steward.** Ownership roots in an accountable human; the node binds UNDER the
+/// user's authority via a later `delegates_to(user → node, infra:*)`. We register
+/// the founder's key as `identity_type "user"` (corrected from the prior
+/// "steward") so [`ownership::is_owner_bound`]'s granter-is-user check resolves.
 async fn register_founder_key(
     engine: &Engine,
     founder: &Founder,
@@ -1011,7 +1140,10 @@ async fn register_founder_key(
         pubkey_ed25519_base64: founder.ed25519_pubkey_b64.clone(),
         pubkey_ml_dsa_65_base64: Some(founder.ml_dsa_65_pubkey_b64.clone()),
         algorithm: algorithm::HYBRID.into(),
-        identity_type: identity_type::STEWARD.into(),
+        // CC 3.2: the responsible party is a `user`-role identity (free-form
+        // TEXT per CC 3.4.7.1). The substrate ships an `identity_type::USER`
+        // constant; we use it (not STEWARD).
+        identity_type: identity_type::USER.into(),
         identity_ref: founder.key_id.clone(),
         valid_from: now,
         valid_until: None,

ciris_server-0.4.3/src/auth/gate.rs

@@ -0,0 +1,79 @@
+//! The owner-binding gate (CIRISServer#9) — the CIRISServer authz floor.
+//! CEG has the primitives but does not mandate it (filed as the optional
+//! normative rule in CIRISRegistry#83).
+//!
+//! **TRUST ≠ JOIN. SERVE ≠ OWN.** A node may *trust + serve* an infrastructure
+//! community (relay/store/transport/serve reads — e.g. the shipped
+//! ciris-canonical pin) with **no owner**. It may *join* (become a member: share
+//! the DEK, count in consensus) a **non-infrastructure** community, and may
+//! perform owner-only operations (e.g. federation peering), only after a
+//! **RESPONSIBLE PARTY is bound** to it — a `user`-role identity holding a live
+//! `delegates_to(user → node, infra:*)` owner-binding (CC 3.2 / CC 4.4.3.5).
+//! Non-infra membership + cross-node data flow are authority acts, which §1.5 /
+//! §7.0.1 require to root in an accountable human — never a bare node.
+//!
+//! **The serve-only floor (the principle this gate enforces).** An UNOWNED node
+//! refuses every owner-op and serves cleartext federation data from the
+//! **canonical root ONLY** — it relays/serves but does not author cross-node
+//! consent, join non-infra groups, or otherwise act with the standing of an
+//! owned member. [`is_owner_bound`] is the producer of the `owner_bound` bit;
+//! [`require_owner_bound`] is the operational gate.
+
+use ciris_persist::prelude::Engine;
+
+pub use crate::auth::ownership::is_owner_bound;
+
+/// The community class for the gate.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum CommunityKind {
+    /// `cohort_subkind: infrastructure` — trust roots (ciris-canonical /
+    /// governance). Joinable with no owner; the trust root is maximally
+    /// inspectable.
+    Infrastructure,
+    /// Any other community (family / community / affiliations).
+    Other,
+}
+
+/// May this node be **admitted as a member** of a community of `kind`, given
+/// whether an accountable owner (responsible party) is bound to it? (Trust +
+/// serve is always allowed and is NOT gated here — this governs *membership*
+/// only.)
+pub fn may_join(kind: CommunityKind, owner_bound: bool) -> bool {
+    match kind {
+        CommunityKind::Infrastructure => true,
+        CommunityKind::Other => owner_bound,
+    }
+}
+
+/// Resolve whether `node_key_id` has a responsible party bound (the producer of
+/// the `owner_bound` bit), then apply [`may_join`]. A node with no live
+/// `delegates_to(user → node, infra:*)` owner-binding may join only
+/// infrastructure communities.
+pub async fn may_join_resolved(engine: &Engine, node_key_id: &str, kind: CommunityKind) -> bool {
+    let owner_bound = is_owner_bound(engine, node_key_id).await.is_some();
+    may_join(kind, owner_bound)
+}
+
+/// **The serve-only-floor gate.** `Ok(responsible_user_key_id)` iff a live
+/// owner-binding exists; `Err(())` for an UNOWNED node (it must refuse the
+/// owner-op and fall back to serving cleartext from the canonical root only).
+///
+/// This is the operational producer of `owner_bound` for owner-requiring
+/// routes (e.g. `POST /v1/federation/peering`): an unowned node refuses
+/// owner-ops, period — independent of any session/role the caller presents.
+pub async fn require_owner_bound(engine: &Engine, node_key_id: &str) -> Result<String, ()> {
+    is_owner_bound(engine, node_key_id).await.ok_or(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn infra_joinable_without_owner_other_is_not() {
+        assert!(may_join(CommunityKind::Infrastructure, false));
+        assert!(may_join(CommunityKind::Infrastructure, true));
+        assert!(!may_join(CommunityKind::Other, false));
+        assert!(may_join(CommunityKind::Other, true));
+    }
+}

{ciris_server-0.4.2 → ciris_server-0.4.3}/src/auth/mod.rs

@@ -39,6 +39,13 @@ pub mod device_auth;
 pub mod erasure;
 pub mod gate;
 pub mod oauth;
+/// Node ownership = the **responsible-party** model (CC 4.4.3.5 + CC 3.2 +
+/// CC 1.13.5): a fabric node has NO agency, so ownership is a `user`-role
+/// responsible party bound by an `infra:*`-only `delegates_to` — NOT the
+/// agent's joint-agency partnership. Carries the infra/agency scope-split
+/// verifier ([`ownership::scopes_are_infra_only`]), the owner-binding emitter,
+/// and the [`ownership::is_owner_bound`] reader.
+pub mod ownership;
 pub mod roles;
 pub mod self_login;
 pub mod session;