composable-data-stack 0.4.0__py3-none-any.whl

cli/resolver.py

@@ -0,0 +1,28 @@
+# cli/resolver.py
+from __future__ import annotations
+
+from typing import Any
+
+
+def parse_contract_ref(value: str) -> tuple[str, str] | None:
+    parts = value.split(".", 1)
+    if len(parts) != 2 or not parts[0] or not parts[1]:
+        return None
+    return parts[0], parts[1]
+
+
+def resolve_path(obj: dict[str, Any], path: str) -> Any:
+    current: Any = obj
+    for part in path.split("."):
+        if not isinstance(current, dict) or part not in current:
+            raise KeyError(path)
+        current = current[part]
+    return current
+
+
+def is_secret_ref(value: Any) -> bool:
+    return isinstance(value, str) and value.startswith("secrets.") and len(value) > len("secrets.")
+
+
+def secret_name_from_ref(value: str) -> str:
+    return value.split(".", 1)[1]

cli/resources/__init__.py

@@ -0,0 +1 @@
+"""Runtime data bundled with the CDS CLI."""

cli/resources/rule-schema.json

@@ -0,0 +1,274 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/RonaldHensbergen/composable-data-stack/security-rules.schema.json",
+  "title": "Composable Data Stack Security Rule Set",
+  "type": "object",
+  "required": ["version", "rules"],
+  "additionalProperties": false,
+  "properties": {
+    "$schema": {
+      "type": "string"    
+    },
+    "version": {
+      "type": "string",
+      "pattern": "^1\\.0(\\.\\d+)?$"
+    },
+    "metadata": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "name": { "type": "string" },
+        "description": { "type": "string" },
+        "defaultProfileClass": {
+          "type": "string",
+          "enum": ["local", "dev", "staging", "prod"]
+        }
+      }
+    },
+    "rules": {
+      "type": "array",
+      "minItems": 1,
+      "items": { "$ref": "#/$defs/rule" }
+    }
+  },
+  "$defs": {
+    "severity": {
+      "type": "string",
+      "enum": ["low", "medium", "high"]
+    },
+    "category": {
+      "type": "string",
+      "enum": [
+        "secrets",
+        "auth",
+        "network-exposure",
+        "file-output-safety",
+        "config-integrity",
+        "supply-chain",
+        "runtime-hardening",
+        "observability-leakage"
+      ]
+    },
+    "scopeItem": {
+      "type": "string",
+      "enum": [
+        "profile",
+        "profile-raw",
+        "profile-resolved",
+        "module-values",
+        "bindings",
+        "service",
+        "service-env",
+        "runtime",
+        "rendered-compose",
+        "none"
+      ]
+    },
+    "matchCondition": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "pathPatterns": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "keyRegex": {
+          "type": "string"
+        },
+        "valueRegex": {
+          "type": "string"
+        },
+        "notValueRegex": {
+          "type": "string"
+        },
+        "containsAny": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "equalsAny": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "serviceTypes": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "enum": [
+              "admin-ui",
+              "database",
+              "api",
+              "worker",
+              "cache",
+              "broker",
+              "ingress",
+              "generic"
+            ]
+          }
+        },
+        "profileClasses": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "enum": ["local", "dev", "staging", "prod"]
+          }
+        },
+        "envInterpolation": {
+          "type": "boolean"
+        },
+        "allowEmpty": {
+          "type": "boolean"
+        },
+        "entropy": {
+          "type": "string",
+          "enum": ["high"]
+        },
+        "minLength": {
+          "type": "integer",
+          "minimum": 1
+        },
+        "portExposure": {
+          "type": "string",
+          "enum": ["localhost-only", "host-published", "0.0.0.0", "public"]
+        },
+        "imageTagPolicy": {
+          "type": "string",
+          "enum": ["forbid-latest", "require-tag", "require-digest"]
+        },
+        "permissions": {
+          "type": "string",
+          "enum": ["world-readable", "group-readable", "owner-only"]
+        },
+        "runtimeFlags": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "fallbackPattern": {
+          "type": "string"
+        },
+        "secretSinkPolicy": {
+          "type": "string",
+          "enum": ["allowed", "forbidden"]
+        }
+      }
+    },
+    "match": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "all": {
+          "type": "array",
+          "minItems": 1,
+          "items": { "$ref": "#/$defs/matchCondition" }
+        },
+        "any": {
+          "type": "array",
+          "minItems": 1,
+          "items": { "$ref": "#/$defs/matchCondition" }
+        }
+      },
+      "anyOf": [
+        { "required": ["all"] },
+        { "required": ["any"] }
+      ]
+    },
+    "recommendation": {
+      "type": "array",
+      "minItems": 1,
+      "items": { "type": "string" }
+    },
+    "rule": {
+      "type": "object",
+      "required": [
+        "id",
+        "title",
+        "severity",
+        "category",
+        "scope",
+        "match",
+        "message",
+        "whyItMatters",
+        "recommendation"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "id": {
+          "type": "string",
+          "pattern": "^CDS-SEC-\\d{3}$"
+        },
+        "$comment": {
+          "type": "string"
+        },
+        "title": {
+          "type": "string"
+        },
+        "severity": {
+          "$ref": "#/$defs/severity"
+        },
+        "category": {
+          "$ref": "#/$defs/category"
+        },
+        "scope": {
+          "type": "array",
+          "minItems": 1,
+          "items": { "$ref": "#/$defs/scopeItem" }
+        },
+        "match": {
+          "$ref": "#/$defs/match"
+        },
+        "message": {
+          "type": "string"
+        },
+        "whyItMatters": {
+          "type": "string"
+        },
+        "recommendation": {
+          "$ref": "#/$defs/recommendation"
+        },
+        "references": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "enabled": {
+          "type": "boolean",
+          "default": true
+        }
+      }
+    }
+  },
+  "examples": [
+    {
+      "version": "1.0.0",
+      "metadata": {
+        "name": "cds-core-security-rules",
+        "description": "Core security validation rules for cds validate --security",
+        "defaultProfileClass": "local"
+      },
+      "rules": [
+        {
+          "id": "CDS-SEC-001",
+          "title": "Hardcoded secret-like value",
+          "severity": "high",
+          "category": "secrets",
+          "scope": ["profile-raw", "module-values", "service-env"],
+          "match": {
+            "all": [
+              {
+                "keyRegex": "(?i)(password|passwd|secret|token|api[_-]?key|access[_-]?key|secret[_-]?key|private[_-]?key|jwt|dsn)"
+              },
+              {
+                "notValueRegex": "^(\\$\\{[A-Z0-9_:-]+\\}|<set-me>|<from-env>|REDACTED|example)$"
+              }
+            ]
+          },
+          "message": "Secret-like value appears to be hardcoded",
+          "whyItMatters": "Hardcoded secrets can leak through source control, rendered output, and logs.",
+          "recommendation": [
+            "Move the value to an environment variable or secret backend.",
+            "Reference the secret indirectly rather than storing it in YAML."
+          ],
+          "enabled": true
+        }
+      ]
+    }
+  ]
+}