decisionlock 0.2.0rc4__py3-none-any.whl

decisionlock/__init__.py

@@ -0,0 +1,5 @@
+"""DecisionLock action-integrity kernel."""
+
+from ._version import __version__
+
+__all__ = ["__version__"]

decisionlock/__main__.py

@@ -0,0 +1,4 @@
+from decisionlock.cli import entrypoint
+
+if __name__ == "__main__":
+    raise SystemExit(entrypoint())

decisionlock/_meta.py

@@ -0,0 +1,12 @@
+from __future__ import annotations
+
+from importlib.metadata import PackageNotFoundError, version
+
+from ._version import __version__
+
+
+def package_version() -> str:
+    try:
+        return version("decisionlock")
+    except PackageNotFoundError:
+        return __version__

decisionlock/_version.py

@@ -0,0 +1 @@
+__version__ = "0.2.0rc4"

decisionlock/adapters/__init__.py

@@ -0,0 +1 @@
+"""Infrastructure adapters for DecisionLock ports."""

decisionlock/adapters/broker/__init__.py

@@ -0,0 +1,17 @@
+from .mock import MockCredentialBroker
+from .production import (
+    BrokeredCredentialAuthority,
+    CredentialAuthorityError,
+    EnvironmentCredentialSource,
+    SQLiteCredentialProfileRepository,
+    credential_profile_binding_digest,
+)
+
+__all__ = [
+    "BrokeredCredentialAuthority",
+    "CredentialAuthorityError",
+    "EnvironmentCredentialSource",
+    "MockCredentialBroker",
+    "SQLiteCredentialProfileRepository",
+    "credential_profile_binding_digest",
+]

decisionlock/adapters/broker/mock.py

@@ -0,0 +1,63 @@
+from __future__ import annotations
+
+from datetime import UTC, datetime, timedelta
+from uuid import uuid4
+
+from decisionlock.adapters.crypto import Ed25519BrokerGrantVerifier, Ed25519Signer
+from decisionlock.domain import ApprovalReceipt, CredentialGrant, CredentialRequest, DecisionReceipt
+from decisionlock.engine.canonical import digest
+from decisionlock.engine.credentials import (
+    attest_credential_grant,
+    validate_credential_request,
+)
+
+
+class MockCredentialBroker:
+    """Contract-faithful broker used for demos and tests; never holds a real secret."""
+
+    def __init__(
+        self,
+        name: str = "mock-broker",
+        signer: Ed25519Signer | None = None,
+    ) -> None:
+        self.name = name
+        self._signer = signer or Ed25519Signer.generate("mock-broker-ed25519")
+
+    @property
+    def verifier(self) -> Ed25519BrokerGrantVerifier:
+        return Ed25519BrokerGrantVerifier(
+            {(self.name, self._signer.key_id): self._signer.public_key()}
+        )
+
+    def attest_for_testing(self, grant: CredentialGrant) -> CredentialGrant:
+        """Re-attest a synthetic grant for negative ceiling tests and the offline demo."""
+
+        return attest_credential_grant(grant, self._signer)
+
+    def issue(
+        self,
+        receipt: DecisionReceipt,
+        request: CredentialRequest,
+        approval: ApprovalReceipt | None = None,
+    ) -> CredentialGrant:
+        validate_credential_request(receipt, request, approval_verified=approval is not None)
+        now = datetime.now(UTC)
+        handle = f"opaque://{self.name}/{uuid4().hex}"
+        grant = CredentialGrant(
+            grant_id="grant_" + uuid4().hex,
+            issuance_id="iss_" + uuid4().hex,
+            decision_id=receipt.decision_id,
+            trace_id=receipt.trace_id,
+            mode="opaque_handle",
+            credential_handle=handle,
+            credential_handle_digest=digest(handle),
+            audience=request.audience,
+            scopes=request.scopes,
+            tenant_id=request.tenant_id,
+            issued_at=now,
+            expires_at=now + timedelta(seconds=request.requested_ttl_seconds),
+            broker=self.name,
+            broker_key_id=self._signer.key_id,
+            attestation="",
+        )
+        return attest_credential_grant(grant, self._signer)

decisionlock/adapters/broker/production.py

@@ -0,0 +1,337 @@
+from __future__ import annotations
+
+import os
+import sqlite3
+from datetime import UTC, datetime, timedelta
+from pathlib import Path
+from typing import Mapping
+from uuid import uuid4
+
+from decisionlock.adapters.crypto import Ed25519BrokerGrantVerifier, Ed25519Signer
+from decisionlock.domain import (
+    ApprovalReceipt,
+    CredentialAuthorityProfile,
+    CredentialAuthorityProfileRecord,
+    CredentialGrant,
+    CredentialProfileStatus,
+    CredentialRequest,
+    DecisionReceipt,
+    ProviderIdentity,
+    VerifiedCredentialAuthority,
+)
+from decisionlock.engine.canonical import digest
+from decisionlock.engine.credentials import attest_credential_grant, validate_credential_request
+from decisionlock.ports import (
+    CredentialMaterialSource,
+    CredentialProfileRepository,
+    ResolvedCredentialMaterial,
+)
+from decisionlock.security.files import ensure_private_file
+
+
+class CredentialAuthorityError(ValueError):
+    pass
+
+
+def credential_profile_binding_digest(profile: CredentialAuthorityProfile) -> str:
+    return digest(profile)
+
+
+class EnvironmentCredentialSource:
+    """Resolve a credential from the process environment only at dispatch time."""
+
+    def __init__(self, environment_variable: str) -> None:
+        if (
+            not environment_variable
+            or "=" in environment_variable
+            or "\x00" in environment_variable
+        ):
+            raise ValueError("credential_source.environment_variable_invalid")
+        self.environment_variable = environment_variable
+
+    @property
+    def binding_digest(self) -> str:
+        return digest({"kind": "environment", "name": self.environment_variable})
+
+    def read(self) -> str:
+        value = os.environ.get(self.environment_variable)
+        if value is None:
+            raise CredentialAuthorityError("credential.source_unavailable")
+        return value
+
+
+class SQLiteCredentialProfileRepository:
+    """Durable non-secret credential profile and revocation state."""
+
+    _SCHEMA = """
+    CREATE TABLE IF NOT EXISTS credential_profiles(
+        profile_id TEXT PRIMARY KEY,
+        binding_digest TEXT UNIQUE NOT NULL,
+        audience TEXT NOT NULL,
+        tenant_key TEXT NOT NULL,
+        profile_json TEXT NOT NULL,
+        status TEXT NOT NULL,
+        revoked_at TEXT,
+        revoke_reason TEXT
+    );
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_active_credential_profile_audience_tenant
+    ON credential_profiles(audience, tenant_key) WHERE status = 'active';
+    """
+
+    def __init__(self, path: Path) -> None:
+        self.path = path
+        ensure_private_file(path)
+        with self._connect() as connection:
+            connection.executescript(self._SCHEMA)
+
+    def _connect(self) -> sqlite3.Connection:
+        connection = sqlite3.connect(self.path, timeout=10, isolation_level=None)
+        connection.row_factory = sqlite3.Row
+        connection.execute("PRAGMA busy_timeout=10000")
+        connection.execute("PRAGMA trusted_schema=OFF")
+        connection.execute("PRAGMA synchronous=FULL")
+        connection.execute("PRAGMA secure_delete=ON")
+        return connection
+
+    @staticmethod
+    def _tenant_key(tenant_id: str | None) -> str:
+        return tenant_id or ""
+
+    @staticmethod
+    def _record(row: sqlite3.Row) -> CredentialAuthorityProfileRecord:
+        profile = CredentialAuthorityProfile.model_validate_json(str(row["profile_json"]))
+        revoked_at = row["revoked_at"]
+        return CredentialAuthorityProfileRecord(
+            profile=profile,
+            binding_digest=str(row["binding_digest"]),
+            status=CredentialProfileStatus(str(row["status"])),
+            revoked_at=(
+                datetime.fromisoformat(str(revoked_at)) if revoked_at is not None else None
+            ),
+            revoke_reason=(str(row["revoke_reason"]) if row["revoke_reason"] is not None else None),
+        )
+
+    def store_credential_profile(self, profile: CredentialAuthorityProfile) -> None:
+        binding_digest = credential_profile_binding_digest(profile)
+        with self._connect() as connection:
+            connection.execute("BEGIN IMMEDIATE")
+            existing = connection.execute(
+                "SELECT * FROM credential_profiles WHERE profile_id = ?", (profile.profile_id,)
+            ).fetchone()
+            if existing is not None:
+                record = self._record(existing)
+                if record.status == CredentialProfileStatus.REVOKED:
+                    connection.execute("ROLLBACK")
+                    raise CredentialAuthorityError("credential.profile_revoked")
+                if record.binding_digest != binding_digest:
+                    connection.execute("ROLLBACK")
+                    raise CredentialAuthorityError("credential.profile_conflict")
+                connection.execute("COMMIT")
+                return
+            try:
+                connection.execute(
+                    """
+                    INSERT INTO credential_profiles(
+                        profile_id,binding_digest,audience,tenant_key,profile_json,status
+                    ) VALUES(?,?,?,?,?,?)
+                    """,
+                    (
+                        profile.profile_id,
+                        binding_digest,
+                        profile.audience,
+                        self._tenant_key(profile.tenant_id),
+                        profile.model_dump_json(),
+                        CredentialProfileStatus.ACTIVE.value,
+                    ),
+                )
+            except sqlite3.IntegrityError as exc:
+                connection.execute("ROLLBACK")
+                raise CredentialAuthorityError("credential.profile_conflict") from exc
+            connection.execute("COMMIT")
+
+    def get_credential_profile(self, profile_id: str) -> CredentialAuthorityProfileRecord | None:
+        with self._connect() as connection:
+            row = connection.execute(
+                "SELECT * FROM credential_profiles WHERE profile_id = ?", (profile_id,)
+            ).fetchone()
+        return self._record(row) if row is not None else None
+
+    def find_active_credential_profile(
+        self, audience: str, tenant_id: str | None
+    ) -> CredentialAuthorityProfileRecord | None:
+        with self._connect() as connection:
+            row = connection.execute(
+                """
+                SELECT * FROM credential_profiles
+                WHERE audience = ? AND tenant_key = ? AND status = ?
+                """,
+                (
+                    audience,
+                    self._tenant_key(tenant_id),
+                    CredentialProfileStatus.ACTIVE.value,
+                ),
+            ).fetchone()
+        return self._record(row) if row is not None else None
+
+    def get_credential_profile_by_binding_digest(
+        self, binding_digest: str
+    ) -> CredentialAuthorityProfileRecord | None:
+        with self._connect() as connection:
+            row = connection.execute(
+                "SELECT * FROM credential_profiles WHERE binding_digest = ?", (binding_digest,)
+            ).fetchone()
+        return self._record(row) if row is not None else None
+
+    def revoke_credential_profile(
+        self, profile_id: str, revoked_at: datetime, reason: str
+    ) -> CredentialAuthorityProfileRecord:
+        if revoked_at.tzinfo is None or revoked_at.utcoffset() is None:
+            raise CredentialAuthorityError("credential.revocation_timestamp_invalid")
+        if not reason:
+            raise CredentialAuthorityError("credential.revocation_reason_required")
+        with self._connect() as connection:
+            result = connection.execute(
+                """
+                UPDATE credential_profiles
+                SET status = ?, revoked_at = ?, revoke_reason = ?
+                WHERE profile_id = ? AND status = ?
+                """,
+                (
+                    CredentialProfileStatus.REVOKED.value,
+                    revoked_at.isoformat(),
+                    reason,
+                    profile_id,
+                    CredentialProfileStatus.ACTIVE.value,
+                ),
+            )
+            if result.rowcount != 1:
+                raise CredentialAuthorityError("credential.profile_not_active")
+        record = self.get_credential_profile(profile_id)
+        if record is None:
+            raise CredentialAuthorityError("credential.profile_missing")
+        return record
+
+
+class BrokeredCredentialAuthority:
+    """Issue signed non-secret grants and resolve provider credentials only at dispatch time."""
+
+    def __init__(
+        self,
+        *,
+        name: str,
+        signer: Ed25519Signer,
+        profiles: CredentialProfileRepository,
+        sources: Mapping[str, CredentialMaterialSource],
+    ) -> None:
+        if not name:
+            raise ValueError("credential.broker_name_required")
+        self.name = name
+        self._signer = signer
+        self._profiles = profiles
+        self._sources = dict(sources)
+
+    @property
+    def verifier(self) -> Ed25519BrokerGrantVerifier:
+        return Ed25519BrokerGrantVerifier(
+            {(self.name, self._signer.key_id): self._signer.public_key()}
+        )
+
+    def issue(
+        self,
+        receipt: DecisionReceipt,
+        request: CredentialRequest,
+        approval: ApprovalReceipt | None = None,
+    ) -> CredentialGrant:
+        validate_credential_request(receipt, request, approval_verified=approval is not None)
+        record = self._profiles.find_active_credential_profile(request.audience, request.tenant_id)
+        if record is None:
+            raise CredentialAuthorityError("credential.profile_unavailable")
+        profile = record.profile
+        if request.scopes != profile.scopes:
+            # A static/external secret is not attenuated merely because a caller asks for fewer
+            # scopes. Exact equality prevents DecisionLock from claiming least privilege it cannot
+            # technically enforce at the provider.
+            raise CredentialAuthorityError("credential.profile_scope_mismatch")
+        source = self._sources.get(profile.profile_id)
+        if source is None or source.binding_digest != profile.source_binding_digest:
+            raise CredentialAuthorityError("credential.source_binding_mismatch")
+        now = datetime.now(UTC)
+        if profile.expires_at is not None and profile.expires_at <= now:
+            raise CredentialAuthorityError("credential.profile_expired")
+        expires_at = min(
+            now + timedelta(seconds=request.requested_ttl_seconds),
+            receipt.expires_at,
+            *([profile.expires_at] if profile.expires_at is not None else []),
+        )
+        if expires_at <= now:
+            raise CredentialAuthorityError("credential.grant_window_invalid")
+        grant = CredentialGrant(
+            grant_id="grant_" + uuid4().hex,
+            issuance_id="iss_" + uuid4().hex,
+            decision_id=receipt.decision_id,
+            trace_id=receipt.trace_id,
+            mode="brokered_execution",
+            credential_handle=None,
+            credential_handle_digest=record.binding_digest,
+            audience=request.audience,
+            scopes=request.scopes,
+            tenant_id=request.tenant_id,
+            issued_at=now,
+            expires_at=expires_at,
+            broker=self.name,
+            broker_key_id=self._signer.key_id,
+            attestation="",
+        )
+        return attest_credential_grant(grant, self._signer)
+
+    def resolve(
+        self,
+        authority: VerifiedCredentialAuthority,
+        provider: ProviderIdentity,
+        *,
+        now: datetime | None = None,
+    ) -> ResolvedCredentialMaterial:
+        now = now or datetime.now(UTC)
+        if authority.mode != "brokered_execution":
+            raise CredentialAuthorityError("credential.brokered_mode_required")
+        if authority.broker != self.name or authority.broker_key_id != self._signer.key_id:
+            raise CredentialAuthorityError("credential.broker_binding_mismatch")
+        if authority.expires_at <= now:
+            raise CredentialAuthorityError("credential.expired")
+        record = self._profiles.get_credential_profile_by_binding_digest(
+            authority.credential_handle_digest
+        )
+        if record is None:
+            raise CredentialAuthorityError("credential.profile_missing")
+        if record.status != CredentialProfileStatus.ACTIVE:
+            raise CredentialAuthorityError("credential.profile_revoked")
+        profile = record.profile
+        if profile.expires_at is not None and profile.expires_at <= now:
+            raise CredentialAuthorityError("credential.profile_expired")
+        if profile.provider != provider:
+            raise CredentialAuthorityError("credential.provider_binding_mismatch")
+        if (
+            authority.audience != profile.audience
+            or authority.scopes != profile.scopes
+            or authority.tenant_id != profile.tenant_id
+        ):
+            raise CredentialAuthorityError("credential.profile_binding_mismatch")
+        source = self._sources.get(profile.profile_id)
+        if source is None or source.binding_digest != profile.source_binding_digest:
+            raise CredentialAuthorityError("credential.source_binding_mismatch")
+        secret = source.read()
+        if (
+            not secret
+            or secret != secret.strip()
+            or "\r" in secret
+            or "\n" in secret
+            or "\x00" in secret
+        ):
+            raise CredentialAuthorityError("credential.material_invalid")
+        header_value = f"{profile.header_scheme} {secret}" if profile.header_scheme else secret
+        return ResolvedCredentialMaterial(
+            profile_id=profile.profile_id,
+            header_name=profile.header_name,
+            header_value=header_value,
+            source_binding_digest=profile.source_binding_digest,
+        )

decisionlock/adapters/crypto/__init__.py

@@ -0,0 +1,15 @@
+from .ed25519 import (
+    Ed25519BrokerGrantVerifier,
+    Ed25519Signer,
+    Ed25519Verifier,
+    decode_signature,
+    encode_signature,
+)
+
+__all__ = [
+    "Ed25519BrokerGrantVerifier",
+    "Ed25519Signer",
+    "Ed25519Verifier",
+    "decode_signature",
+    "encode_signature",
+]

decisionlock/adapters/crypto/ed25519.py

@@ -0,0 +1,131 @@
+from __future__ import annotations
+
+import base64
+import binascii
+from pathlib import Path
+
+from cryptography.exceptions import InvalidSignature
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey, Ed25519PublicKey
+
+from decisionlock.security.files import read_regular_file, secure_atomic_write
+
+
+class Ed25519Signer:
+    def __init__(self, private_key: Ed25519PrivateKey, key_id: str = "local-ed25519") -> None:
+        self._private_key = private_key
+        self._key_id = key_id
+
+    @property
+    def key_id(self) -> str:
+        return self._key_id
+
+    def sign(self, payload: bytes) -> bytes:
+        return self._private_key.sign(payload)
+
+    def public_key(self) -> Ed25519PublicKey:
+        return self._private_key.public_key()
+
+    @classmethod
+    def generate(cls, key_id: str = "local-ed25519") -> Ed25519Signer:
+        return cls(Ed25519PrivateKey.generate(), key_id)
+
+    def save_private(self, path: Path) -> None:
+        secure_atomic_write(
+            path,
+            self._private_key.private_bytes(
+                serialization.Encoding.PEM,
+                serialization.PrivateFormat.PKCS8,
+                serialization.NoEncryption(),
+            ),
+            mode=0o600,
+        )
+
+    def save_public(self, path: Path) -> None:
+        secure_atomic_write(
+            path,
+            self.public_key().public_bytes(
+                serialization.Encoding.PEM, serialization.PublicFormat.SubjectPublicKeyInfo
+            ),
+            mode=0o644,
+        )
+
+    @classmethod
+    def load_private(cls, path: Path, key_id: str = "local-ed25519") -> Ed25519Signer:
+        key = serialization.load_pem_private_key(read_regular_file(path), password=None)
+        if not isinstance(key, Ed25519PrivateKey):
+            raise TypeError("not an Ed25519 private key")
+        return cls(key, key_id)
+
+
+class Ed25519Verifier:
+    def __init__(self, keys: dict[str, Ed25519PublicKey]):
+        self._keys = keys
+
+    def verify(self, key_id: str, payload: bytes, signature: bytes) -> bool:
+        key = self._keys.get(key_id)
+        if key is None:
+            return False
+        try:
+            key.verify(signature, payload)
+            return True
+        except InvalidSignature:
+            return False
+
+    @classmethod
+    def from_public_file(cls, path: Path, key_id: str = "local-ed25519") -> Ed25519Verifier:
+        key = serialization.load_pem_public_key(read_regular_file(path))
+        if not isinstance(key, Ed25519PublicKey):
+            raise TypeError("not an Ed25519 public key")
+        return cls({key_id: key})
+
+
+class Ed25519BrokerGrantVerifier:
+    """Explicit trust store for provider-neutral broker grant attestations."""
+
+    def __init__(self, keys: dict[tuple[str, str], Ed25519PublicKey]) -> None:
+        self._keys = keys
+
+    def verify(
+        self,
+        broker_id: str,
+        key_id: str,
+        payload: bytes,
+        signature: bytes,
+    ) -> bool:
+        key = self._keys.get((broker_id, key_id))
+        if key is None:
+            return False
+        try:
+            key.verify(signature, payload)
+            return True
+        except InvalidSignature:
+            return False
+
+    @classmethod
+    def from_public_file(
+        cls,
+        path: Path,
+        *,
+        broker_id: str,
+        key_id: str = "mock-broker-ed25519",
+    ) -> Ed25519BrokerGrantVerifier:
+        key = serialization.load_pem_public_key(read_regular_file(path))
+        if not isinstance(key, Ed25519PublicKey):
+            raise TypeError("not an Ed25519 public key")
+        return cls({(broker_id, key_id): key})
+
+
+def encode_signature(value: bytes) -> str:
+    return base64.urlsafe_b64encode(value).decode("ascii").rstrip("=")
+
+
+def decode_signature(value: str) -> bytes:
+    try:
+        return base64.b64decode(
+            value + "=" * ((4 - len(value) % 4) % 4),
+            altchars=b"-_",
+            validate=True,
+        )
+    except (binascii.Error, ValueError) as exc:
+        raise ValueError("invalid signature encoding") from exc

decisionlock/adapters/evidence/__init__.py

@@ -0,0 +1,19 @@
+from .bundle import (
+    MAX_EVIDENCE_ARTIFACT_BYTES,
+    MAX_EVIDENCE_ARTIFACTS,
+    MAX_EVIDENCE_METADATA_BYTES,
+    MAX_EVIDENCE_TOTAL_BYTES,
+    EvidenceVerificationError,
+    build_bundle,
+    verify_bundle,
+)
+
+__all__ = [
+    "MAX_EVIDENCE_ARTIFACT_BYTES",
+    "MAX_EVIDENCE_ARTIFACTS",
+    "MAX_EVIDENCE_METADATA_BYTES",
+    "MAX_EVIDENCE_TOTAL_BYTES",
+    "EvidenceVerificationError",
+    "build_bundle",
+    "verify_bundle",
+]