fluidattacks_core_models 13.0.0__tar.gz → 13.2.0__tar.gz

{fluidattacks_core_models-13.0.0 → fluidattacks_core_models-13.2.0}/.gitignore

@@ -1,5 +1,9 @@
+dist/
+dist-*/
+/.cargo-cache
 target/
 .direnv/
 .venv/
 .vscode/settings.json
 .zed/settings.json
+*.so

{fluidattacks_core_models-13.0.0 → fluidattacks_core_models-13.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: fluidattacks_core_models
-Version: 13.0.0
+Version: 13.2.0
 Summary: Fluid Attacks Core Models Library
 Author-email: Development <development@fluidattacks.com>
 License: MPL-2.0

{fluidattacks_core_models-13.0.0 → fluidattacks_core_models-13.2.0}/fluidattacks_core/models/state_machines/__init__.py

@@ -1,3 +1,8 @@
+from fluidattacks_core.models.state_machines.component_orchestrator import (
+    ComponentScanOptions,
+    ResolvesScanOptions,
+    StateMachineComponentOrchestrator,
+)
 from fluidattacks_core.models.state_machines.root_scanner import (
     ContextualizesScanInput,
     ContextualizesScanOptions,
@@ -18,11 +23,14 @@ from fluidattacks_core.models.state_machines.types import (
 )
 
 __all__ = [
+    "ComponentScanOptions",
     "ContextualizesScanInput",
     "ContextualizesScanOptions",
     "PerRootScanOptions",
+    "ResolvesScanOptions",
     "StateMachine",
     "StateMachineCloningInput",
+    "StateMachineComponentOrchestrator",
     "StateMachineExecutePerRootInput",
     "StateMachineExecuteScannerInput",
     "StateMachineExecuteSiftsInput",

fluidattacks_core_models-13.2.0/fluidattacks_core/models/state_machines/component_orchestrator.py

@@ -0,0 +1,63 @@
+from hashlib import sha256
+from typing import Generic, TypeVar
+
+from pydantic import BaseModel, ConfigDict, Field, computed_field
+
+from fluidattacks_core.models.state_machines.root_scanner import (
+    MACHINE_NAME_DIGEST_LENGTH,
+    MAX_EXECUTION_NAME,
+    UNSAFE_NAME_CHARS,
+    TJobNameSegment,
+    TStorageKey,
+    TVisibleAscii,
+)
+
+
+class ComponentScanOptions(BaseModel):
+    model_config = ConfigDict(extra="forbid", frozen=True, revalidate_instances="always")
+    config_id: TStorageKey
+    entity_name: TStorageKey
+    user_email: TVisibleAscii = Field(..., min_length=1)
+
+
+class ResolvesScanOptions(ComponentScanOptions):
+    pass
+
+
+TComponentOptions = TypeVar("TComponentOptions", bound=ComponentScanOptions)
+
+
+class StateMachineComponentOrchestrator(BaseModel, Generic[TComponentOptions]):
+    model_config = ConfigDict(extra="forbid", frozen=True, serialize_by_alias=True)
+    job_definition: str = Field(..., min_length=1, serialization_alias="jobDefinition")
+    job_queue: str = Field(..., min_length=1, serialization_alias="jobQueue")
+    scanner_name: TJobNameSegment = Field(..., serialization_alias="scannerName")
+    options: TComponentOptions = Field(..., exclude=True)
+
+    @computed_field(alias="configId")  # type: ignore[prop-decorator]
+    @property
+    def config_id(self) -> str:
+        return self.options.config_id
+
+    @computed_field(alias="entityName")  # type: ignore[prop-decorator]
+    @property
+    def entity_name(self) -> str:
+        return self.options.entity_name
+
+    @computed_field(alias="executionOptions")  # type: ignore[prop-decorator]
+    @property
+    def execution_options(self) -> str:
+        return self.options.model_dump_json()
+
+    def to_wire(self) -> dict[str, str]:
+        return self.model_dump(mode="json", by_alias=True)
+
+    def get_machine_name(self) -> str:
+        digest = sha256(
+            (
+                f"{self.options.entity_name}\x00{self.scanner_name}\x00{self.options.config_id}"
+            ).encode()
+        ).hexdigest()[:MACHINE_NAME_DIGEST_LENGTH]
+        readable = UNSAFE_NAME_CHARS.sub("_", f"{self.options.entity_name}_{self.scanner_name}")
+        budget = MAX_EXECUTION_NAME - MACHINE_NAME_DIGEST_LENGTH - 1
+        return f"{readable[:budget]}_{digest}"

{fluidattacks_core_models-13.0.0 → fluidattacks_core_models-13.2.0}/import-linter.cfg

@@ -1,16 +1,7 @@
 [importlinter]
-  root_package = fluidattacks_core
+  root_package = fluidattacks_core.models
   include_external_packages = True
 
-[importlinter:contract:portion]
-  name = Single Portion
-  type = layers
-  containers =
-    fluidattacks_core
-  exhaustive = true
-  layers =
-    models
-
 [importlinter:contract:dag]
   name = Direct Acyclic Graph
   type = layers

{fluidattacks_core_models-13.0.0 → fluidattacks_core_models-13.2.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "fluidattacks_core_models"
-version = "13.0.0"
+version = "13.2.0"
 description = "Fluid Attacks Core Models Library"
 authors = [{ name = "Development", email = "development@fluidattacks.com" }]
 license = { text = "MPL-2.0" }

fluidattacks_core_models-13.2.0/tests/test_component_orchestrator.py

@@ -0,0 +1,178 @@
+import json
+
+import pytest
+from pydantic import ValidationError
+
+from fluidattacks_core.models.state_machines.component_orchestrator import (
+    ComponentScanOptions,
+    ResolvesScanOptions,
+    StateMachineComponentOrchestrator,
+)
+from fluidattacks_core.models.state_machines.root_scanner import (
+    MACHINE_NAME_DIGEST_LENGTH,
+    MAX_EXECUTION_NAME,
+    UNSAFE_NAME_CHARS,
+)
+
+
+class _OptionsWithAnExtraField(ComponentScanOptions):
+    seed_domain: str
+
+
+def _options(**overrides: str) -> ComponentScanOptions:
+    arguments: dict[str, str] = {
+        "config_id": "123456",
+        "entity_name": "acme",
+        "user_email": "test@fluidattacks.com",
+    }
+    arguments.update(overrides)
+    return ComponentScanOptions(**arguments)
+
+
+def _wire_payload(**overrides: object) -> dict[str, object]:
+    payload: dict[str, object] = {
+        "job_definition": "resolves_nix",
+        "job_queue": "resolves",
+        "scanner_name": "resolves-scan",
+        "options": _options(),
+    }
+    payload.update(overrides)
+    return payload
+
+
+def _machine_input(
+    options: ComponentScanOptions | None = None,
+    scanner_name: str = "resolves-scan",
+) -> StateMachineComponentOrchestrator[ComponentScanOptions]:
+    resolved = options if options is not None else _options()
+    return StateMachineComponentOrchestrator[ComponentScanOptions].model_validate(
+        _wire_payload(options=resolved, scanner_name=scanner_name)
+    )
+
+
+def test_orchestrator_serializes_six_wire_keys_from_the_options() -> None:
+    options = _options()
+    machine_input = _machine_input(options)
+    dumped = machine_input.model_dump(mode="json")
+    assert machine_input.to_wire() == dumped
+    assert set(dumped) == {
+        "configId",
+        "entityName",
+        "executionOptions",
+        "jobDefinition",
+        "jobQueue",
+        "scannerName",
+    }
+    blob = json.loads(dumped["executionOptions"])
+    assert dumped["configId"] == blob["config_id"]
+    assert dumped["entityName"] == blob["entity_name"]
+    assert ComponentScanOptions.model_validate_json(machine_input.execution_options) == options
+
+
+def test_entity_name_is_a_storage_key_not_a_free_string() -> None:
+    for value in ("-h", "--storage-dir", ".", "..", "a..b", "_internal", "a/b", ""):
+        with pytest.raises(ValidationError):
+            _options(entity_name=value)
+    for value in ("acme\n", "acme\t", "acme corp", "gr\u043eup"):
+        with pytest.raises(ValidationError):
+            _options(entity_name=value)
+    for value in ("acme", "acme_nickname", "group.repo-name_v2", "0abc"):
+        assert _options(entity_name=value).entity_name == value
+
+
+def test_options_refuse_unknown_fields_rebinding_and_unvalidated_instances() -> None:
+    with pytest.raises(ValidationError):
+        ComponentScanOptions.model_validate({**_options().model_dump(), "cwd": "../../.."})
+    options = _options()
+    for field in ("config_id", "entity_name", "user_email"):
+        with pytest.raises(ValidationError, match="frozen"):
+            setattr(options, field, "other")
+    smuggled = ComponentScanOptions.model_construct(
+        config_id="1", entity_name="../../etc", user_email="e@f"
+    )
+    with pytest.raises(ValidationError):
+        StateMachineComponentOrchestrator[ComponentScanOptions].model_validate(
+            _wire_payload(options=smuggled)
+        )
+
+
+def test_orchestrator_rejects_unknown_and_empty_wire_fields() -> None:
+    for overrides in ({"unknown_field": "bad"}, {"job_definition": ""}, {"job_queue": ""}):
+        with pytest.raises(ValidationError):
+            StateMachineComponentOrchestrator[ComponentScanOptions].model_validate(
+                _wire_payload(**overrides)
+            )
+    for name in ("has space", "has.dot", "-h", "_leading", "sla/sh", ""):
+        with pytest.raises(ValidationError):
+            _machine_input(scanner_name=name)
+
+
+def test_machine_name_stays_valid_at_the_execution_name_limit() -> None:
+    longest = _machine_input(
+        options=_options(config_id="c" * 128, entity_name="a" * 128),
+        scanner_name="s" * 200,
+    )
+    garbage = ComponentScanOptions.model_construct(
+        config_id="c" * 200, entity_name="a corp/../etc", user_email="e@f"
+    )
+    unvalidated = StateMachineComponentOrchestrator[ComponentScanOptions].model_construct(
+        job_definition="resolves_nix",
+        job_queue="resolves",
+        scanner_name="resolves scan/../x",
+        options=garbage,
+    )
+    for machine_input in (longest, unvalidated):
+        name = machine_input.get_machine_name()
+        assert len(name) <= MAX_EXECUTION_NAME
+        assert not UNSAFE_NAME_CHARS.search(name)
+
+
+def test_machine_name_stays_greppable_by_entity_and_scanner() -> None:
+    assert _machine_input().get_machine_name().startswith("acme_resolves-scan_")
+
+
+def test_machine_name_is_injective() -> None:
+    baseline = _machine_input().get_machine_name()
+    assert baseline != _machine_input(scanner_name="resolves-dast-scan").get_machine_name()
+    for field in ("config_id", "entity_name"):
+        assert baseline != _machine_input(_options(**{field: "other"})).get_machine_name()
+    hidden = "e" * (MAX_EXECUTION_NAME - MACHINE_NAME_DIGEST_LENGTH)
+    entities = {
+        _machine_input(_options(entity_name=f"{hidden}{suffix}")).get_machine_name()
+        for suffix in ("a", "b")
+    }
+    masked = {
+        _machine_input(_options(entity_name=hidden), scanner).get_machine_name()
+        for scanner in ("resolves-scan", "resolves-dast-scan")
+    }
+    filled = "a" * (MAX_EXECUTION_NAME - MACHINE_NAME_DIGEST_LENGTH - 1)
+    fenced = {
+        _machine_input(_options(entity_name=f"{filled}{tail}"), scanner).get_machine_name()
+        for tail, scanner in (("bc", "d"), ("b", "cd"))
+    }
+    assert len(entities) == 2
+    assert len(masked) == 2
+    assert len(fenced) == 2
+
+
+def test_orchestrator_binds_the_options_type_it_is_parameterized_with() -> None:
+    extended = _OptionsWithAnExtraField(
+        config_id="123456",
+        entity_name="acme",
+        seed_domain="acme.com",
+        user_email="test@fluidattacks.com",
+    )
+    machine_input = StateMachineComponentOrchestrator[_OptionsWithAnExtraField].model_validate(
+        _wire_payload(options=extended)
+    )
+    assert json.loads(machine_input.execution_options)["seed_domain"] == "acme.com"
+    with pytest.raises(ValidationError):
+        StateMachineComponentOrchestrator[_OptionsWithAnExtraField].model_validate(_wire_payload())
+
+
+def test_resolves_options_add_no_fields_of_their_own() -> None:
+    options = ResolvesScanOptions(
+        config_id="123456", entity_name="acme", user_email="test@fluidattacks.com"
+    )
+    with pytest.raises(ValidationError):
+        ResolvesScanOptions.model_validate({**options.model_dump(), "seed_domain": "acme.com"})

{fluidattacks_core_models-13.0.0 → fluidattacks_core_models-13.2.0}/uv.lock

@@ -187,7 +187,7 @@ wheels = [
 
 [[package]]
 name = "fluidattacks-core-models"
-version = "13.0.0"
+version = "13.2.0"
 source = { editable = "." }
 dependencies = [
     { name = "pydantic" },