fluidattacks_core_models 12.0.0__tar.gz → 13.1.0__tar.gz

{fluidattacks_core_models-12.0.0 → fluidattacks_core_models-13.1.0}/.gitignore

@@ -1,3 +1,5 @@
+dist-*/
+/.cargo-cache
 target/
 .direnv/
 .venv/

{fluidattacks_core_models-12.0.0 → fluidattacks_core_models-13.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: fluidattacks_core_models
-Version: 12.0.0
+Version: 13.1.0
 Summary: Fluid Attacks Core Models Library
 Author-email: Development <development@fluidattacks.com>
 License: MPL-2.0

{fluidattacks_core_models-12.0.0 → fluidattacks_core_models-13.1.0}/fluidattacks_core/models/state_machines/__init__.py

@@ -1,3 +1,7 @@
+from fluidattacks_core.models.state_machines.component_orchestrator import (
+    ComponentScanOptions,
+    StateMachineComponentOrchestrator,
+)
 from fluidattacks_core.models.state_machines.root_scanner import (
     ContextualizesScanInput,
     ContextualizesScanOptions,
@@ -18,11 +22,13 @@ from fluidattacks_core.models.state_machines.types import (
 )
 
 __all__ = [
+    "ComponentScanOptions",
     "ContextualizesScanInput",
     "ContextualizesScanOptions",
     "PerRootScanOptions",
     "StateMachine",
     "StateMachineCloningInput",
+    "StateMachineComponentOrchestrator",
     "StateMachineExecutePerRootInput",
     "StateMachineExecuteScannerInput",
     "StateMachineExecuteSiftsInput",

fluidattacks_core_models-13.1.0/fluidattacks_core/models/state_machines/component_orchestrator.py

@@ -0,0 +1,59 @@
+from hashlib import sha256
+from typing import Generic, TypeVar
+
+from pydantic import BaseModel, ConfigDict, Field, computed_field
+
+from fluidattacks_core.models.state_machines.root_scanner import (
+    MACHINE_NAME_DIGEST_LENGTH,
+    MAX_EXECUTION_NAME,
+    UNSAFE_NAME_CHARS,
+    TJobNameSegment,
+    TStorageKey,
+    TVisibleAscii,
+)
+
+
+class ComponentScanOptions(BaseModel):
+    model_config = ConfigDict(extra="forbid", frozen=True, revalidate_instances="always")
+    config_id: TStorageKey
+    entity_name: TStorageKey
+    user_email: TVisibleAscii = Field(..., min_length=1)
+
+
+TComponentOptions = TypeVar("TComponentOptions", bound=ComponentScanOptions)
+
+
+class StateMachineComponentOrchestrator(BaseModel, Generic[TComponentOptions]):
+    model_config = ConfigDict(extra="forbid", frozen=True, serialize_by_alias=True)
+    job_definition: str = Field(..., min_length=1, serialization_alias="jobDefinition")
+    job_queue: str = Field(..., min_length=1, serialization_alias="jobQueue")
+    scanner_name: TJobNameSegment = Field(..., serialization_alias="scannerName")
+    options: TComponentOptions = Field(..., exclude=True)
+
+    @computed_field(alias="configId")  # type: ignore[prop-decorator]
+    @property
+    def config_id(self) -> str:
+        return self.options.config_id
+
+    @computed_field(alias="entityName")  # type: ignore[prop-decorator]
+    @property
+    def entity_name(self) -> str:
+        return self.options.entity_name
+
+    @computed_field(alias="executionOptions")  # type: ignore[prop-decorator]
+    @property
+    def execution_options(self) -> str:
+        return self.options.model_dump_json()
+
+    def to_wire(self) -> dict[str, str]:
+        return self.model_dump(mode="json", by_alias=True)
+
+    def get_machine_name(self) -> str:
+        digest = sha256(
+            (
+                f"{self.options.entity_name}\x00{self.scanner_name}\x00{self.options.config_id}"
+            ).encode()
+        ).hexdigest()[:MACHINE_NAME_DIGEST_LENGTH]
+        readable = UNSAFE_NAME_CHARS.sub("_", f"{self.options.entity_name}_{self.scanner_name}")
+        budget = MAX_EXECUTION_NAME - MACHINE_NAME_DIGEST_LENGTH - 1
+        return f"{readable[:budget]}_{digest}"

{fluidattacks_core_models-12.0.0 → fluidattacks_core_models-13.1.0}/fluidattacks_core/models/state_machines/root_scanner.py

@@ -45,8 +45,7 @@ class ContextualizesScanOptions(PerRootScanOptions):
 
 
 class TracesScanOptions(PerRootScanOptions):
-    root_id: TStorageKey
-    commit: Annotated[str, StringConstraints(pattern=r"^[0-9a-f]{40}$")]
+    pass
 
 
 TOptions = TypeVar("TOptions", bound=PerRootScanOptions)

{fluidattacks_core_models-12.0.0 → fluidattacks_core_models-13.1.0}/import-linter.cfg

@@ -1,16 +1,7 @@
 [importlinter]
-  root_package = fluidattacks_core
+  root_package = fluidattacks_core.models
   include_external_packages = True
 
-[importlinter:contract:portion]
-  name = Single Portion
-  type = layers
-  containers =
-    fluidattacks_core
-  exhaustive = true
-  layers =
-    models
-
 [importlinter:contract:dag]
   name = Direct Acyclic Graph
   type = layers

{fluidattacks_core_models-12.0.0 → fluidattacks_core_models-13.1.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "fluidattacks_core_models"
-version = "12.0.0"
+version = "13.1.0"
 description = "Fluid Attacks Core Models Library"
 authors = [{ name = "Development", email = "development@fluidattacks.com" }]
 license = { text = "MPL-2.0" }

fluidattacks_core_models-13.1.0/tests/test_component_orchestrator.py

@@ -0,0 +1,169 @@
+import json
+
+import pytest
+from pydantic import ValidationError
+
+from fluidattacks_core.models.state_machines.component_orchestrator import (
+    ComponentScanOptions,
+    StateMachineComponentOrchestrator,
+)
+from fluidattacks_core.models.state_machines.root_scanner import (
+    MACHINE_NAME_DIGEST_LENGTH,
+    MAX_EXECUTION_NAME,
+    UNSAFE_NAME_CHARS,
+)
+
+
+class _ResolvesScanOptions(ComponentScanOptions):
+    seed_domain: str
+
+
+def _options(**overrides: str) -> ComponentScanOptions:
+    arguments: dict[str, str] = {
+        "config_id": "123456",
+        "entity_name": "acme",
+        "user_email": "test@fluidattacks.com",
+    }
+    arguments.update(overrides)
+    return ComponentScanOptions(**arguments)
+
+
+def _wire_payload(**overrides: object) -> dict[str, object]:
+    payload: dict[str, object] = {
+        "job_definition": "resolves_nix",
+        "job_queue": "resolves",
+        "scanner_name": "resolves-scan",
+        "options": _options(),
+    }
+    payload.update(overrides)
+    return payload
+
+
+def _machine_input(
+    options: ComponentScanOptions | None = None,
+    scanner_name: str = "resolves-scan",
+) -> StateMachineComponentOrchestrator[ComponentScanOptions]:
+    resolved = options if options is not None else _options()
+    return StateMachineComponentOrchestrator[ComponentScanOptions].model_validate(
+        _wire_payload(options=resolved, scanner_name=scanner_name)
+    )
+
+
+def test_orchestrator_serializes_six_wire_keys_from_the_options() -> None:
+    options = _options()
+    machine_input = _machine_input(options)
+    dumped = machine_input.model_dump(mode="json")
+    assert machine_input.to_wire() == dumped
+    assert set(dumped) == {
+        "configId",
+        "entityName",
+        "executionOptions",
+        "jobDefinition",
+        "jobQueue",
+        "scannerName",
+    }
+    blob = json.loads(dumped["executionOptions"])
+    assert dumped["configId"] == blob["config_id"]
+    assert dumped["entityName"] == blob["entity_name"]
+    assert ComponentScanOptions.model_validate_json(machine_input.execution_options) == options
+
+
+def test_entity_name_is_a_storage_key_not_a_free_string() -> None:
+    for value in ("-h", "--storage-dir", ".", "..", "a..b", "_internal", "a/b", ""):
+        with pytest.raises(ValidationError):
+            _options(entity_name=value)
+    for value in ("acme\n", "acme\t", "acme corp", "gr\u043eup"):
+        with pytest.raises(ValidationError):
+            _options(entity_name=value)
+    for value in ("acme", "acme_nickname", "group.repo-name_v2", "0abc"):
+        assert _options(entity_name=value).entity_name == value
+
+
+def test_options_refuse_unknown_fields_rebinding_and_unvalidated_instances() -> None:
+    with pytest.raises(ValidationError):
+        ComponentScanOptions.model_validate({**_options().model_dump(), "cwd": "../../.."})
+    options = _options()
+    for field in ("config_id", "entity_name", "user_email"):
+        with pytest.raises(ValidationError, match="frozen"):
+            setattr(options, field, "other")
+    smuggled = ComponentScanOptions.model_construct(
+        config_id="1", entity_name="../../etc", user_email="e@f"
+    )
+    with pytest.raises(ValidationError):
+        StateMachineComponentOrchestrator[ComponentScanOptions].model_validate(
+            _wire_payload(options=smuggled)
+        )
+
+
+def test_orchestrator_rejects_unknown_and_empty_wire_fields() -> None:
+    for overrides in ({"unknown_field": "bad"}, {"job_definition": ""}, {"job_queue": ""}):
+        with pytest.raises(ValidationError):
+            StateMachineComponentOrchestrator[ComponentScanOptions].model_validate(
+                _wire_payload(**overrides)
+            )
+    for name in ("has space", "has.dot", "-h", "_leading", "sla/sh", ""):
+        with pytest.raises(ValidationError):
+            _machine_input(scanner_name=name)
+
+
+def test_machine_name_stays_valid_at_the_execution_name_limit() -> None:
+    longest = _machine_input(
+        options=_options(config_id="c" * 128, entity_name="a" * 128),
+        scanner_name="s" * 200,
+    )
+    garbage = ComponentScanOptions.model_construct(
+        config_id="c" * 200, entity_name="a corp/../etc", user_email="e@f"
+    )
+    unvalidated = StateMachineComponentOrchestrator[ComponentScanOptions].model_construct(
+        job_definition="resolves_nix",
+        job_queue="resolves",
+        scanner_name="resolves scan/../x",
+        options=garbage,
+    )
+    for machine_input in (longest, unvalidated):
+        name = machine_input.get_machine_name()
+        assert len(name) <= MAX_EXECUTION_NAME
+        assert not UNSAFE_NAME_CHARS.search(name)
+
+
+def test_machine_name_stays_greppable_by_entity_and_scanner() -> None:
+    assert _machine_input().get_machine_name().startswith("acme_resolves-scan_")
+
+
+def test_machine_name_is_injective() -> None:
+    baseline = _machine_input().get_machine_name()
+    assert baseline != _machine_input(scanner_name="resolves-dast-scan").get_machine_name()
+    for field in ("config_id", "entity_name"):
+        assert baseline != _machine_input(_options(**{field: "other"})).get_machine_name()
+    hidden = "e" * (MAX_EXECUTION_NAME - MACHINE_NAME_DIGEST_LENGTH)
+    entities = {
+        _machine_input(_options(entity_name=f"{hidden}{suffix}")).get_machine_name()
+        for suffix in ("a", "b")
+    }
+    masked = {
+        _machine_input(_options(entity_name=hidden), scanner).get_machine_name()
+        for scanner in ("resolves-scan", "resolves-dast-scan")
+    }
+    filled = "a" * (MAX_EXECUTION_NAME - MACHINE_NAME_DIGEST_LENGTH - 1)
+    fenced = {
+        _machine_input(_options(entity_name=f"{filled}{tail}"), scanner).get_machine_name()
+        for tail, scanner in (("bc", "d"), ("b", "cd"))
+    }
+    assert len(entities) == 2
+    assert len(masked) == 2
+    assert len(fenced) == 2
+
+
+def test_orchestrator_binds_the_options_type_it_is_parameterized_with() -> None:
+    resolves = _ResolvesScanOptions(
+        config_id="123456",
+        entity_name="acme",
+        seed_domain="acme.com",
+        user_email="test@fluidattacks.com",
+    )
+    machine_input = StateMachineComponentOrchestrator[_ResolvesScanOptions].model_validate(
+        _wire_payload(options=resolves)
+    )
+    assert json.loads(machine_input.execution_options)["seed_domain"] == "acme.com"
+    with pytest.raises(ValidationError):
+        StateMachineComponentOrchestrator[_ResolvesScanOptions].model_validate(_wire_payload())

{fluidattacks_core_models-12.0.0 → fluidattacks_core_models-13.1.0}/tests/test_root_scanner.py

@@ -15,8 +15,6 @@ from fluidattacks_core.models.state_machines.root_scanner import (
     TracesScanOptions,
 )
 
-_SHA = "0f1e2d3c4b5a69788796a5b4c3d2e1f00f1e2d3c"
-
 
 class _DastScanOptions(PerRootScanOptions):
     network_name: str
@@ -277,8 +275,6 @@ def _traces_options(**overrides: str) -> TracesScanOptions:
         "group_name": "acme",
         "root_nickname": "nickname",
         "user_email": "test@fluidattacks.com",
-        "root_id": "3f2504e0-4f89-11d3-9a0c-0305e82c3301",
-        "commit": _SHA,
     }
     arguments.update(overrides)
     return TracesScanOptions(**arguments)
@@ -295,36 +291,12 @@ def _traces_input(options: TracesScanOptions | None = None) -> TracesScanInput:
     )
 
 
-def test_traces_scan_options_add_the_two_fields_the_artifact_layout_needs() -> None:
+def test_traces_scan_options_are_exactly_the_shared_per_root_fields() -> None:
     options = _traces_options()
-    assert set(options.model_dump()) == {
-        "commit",
-        "config_id",
-        "group_name",
-        "root_id",
-        "root_nickname",
-        "user_email",
-    }
+    assert set(options.model_dump()) == set(PerRootScanOptions.model_fields)
     assert TracesScanOptions.model_validate_json(options.model_dump_json()) == options
 
 
-def test_traces_scan_options_reject_a_root_id_that_would_escape_its_prefix() -> None:
-    for value in ("..", "a/b", "-h", ".", "a..b", "", "_internal"):
-        with pytest.raises(ValidationError):
-            _traces_options(root_id=value)
-
-
-def test_traces_scan_options_reject_a_commit_that_is_not_a_full_lowercase_sha() -> None:
-    for value in ("", _SHA[:39], f"{_SHA}0", _SHA.upper(), _SHA.replace("0", "g"), f"{_SHA}\n"):
-        with pytest.raises(ValidationError):
-            _traces_options(commit=value)
-
-
-def test_traces_scan_options_accept_the_commits_the_mirror_reports() -> None:
-    for value in (_SHA, "0" * 40, "f" * 40):
-        assert _traces_options(commit=value).commit == value
-
-
 def test_traces_scan_input_keeps_the_seven_wire_keys_the_machine_reads() -> None:
     dumped = _traces_input().to_wire()
     assert set(dumped) == {
@@ -336,11 +308,3 @@ def test_traces_scan_input_keeps_the_seven_wire_keys_the_machine_reads() -> None
         "rootNickname",
         "scannerName",
     }
-
-
-def test_traces_scan_input_carries_root_id_and_commit_only_in_execution_options() -> None:
-    options = _traces_options()
-    dumped = _traces_input(options).to_wire()
-    blob = dumped["executionOptions"]
-    assert isinstance(blob, str)
-    assert json.loads(blob) == options.model_dump()

{fluidattacks_core_models-12.0.0 → fluidattacks_core_models-13.1.0}/uv.lock

@@ -187,7 +187,7 @@ wheels = [
 
 [[package]]
 name = "fluidattacks-core-models"
-version = "12.0.0"
+version = "13.1.0"
 source = { editable = "." }
 dependencies = [
     { name = "pydantic" },