gargoyle-receipts 0.5.3.dev0__tar.gz → 0.6.1.dev0__tar.gz

{gargoyle_receipts-0.5.3.dev0/gargoyle_receipts.egg-info → gargoyle_receipts-0.6.1.dev0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gargoyle-receipts
-Version: 0.5.3.dev0
+Version: 0.6.1.dev0
 Summary: Signed, single-use, argument-bound receipts and human-approval holds for agent tool calls.
 Author: Justin LaPorte
 License-Expression: Apache-2.0
@@ -59,7 +59,7 @@ your MCP server and lets through only what both agreed to.
 
 [![PyPI](https://img.shields.io/pypi/v/gargoyle-receipts)](https://pypi.org/project/gargoyle-receipts/)
 
-Status: pre-release (`0.5.3.dev0`, on PyPI as `gargoyle-receipts`). The wire format is `gargoyle/3` and may
+Status: pre-release (`0.6.1.dev0`, on PyPI as `gargoyle-receipts`). The wire format is `gargoyle/3` and may
 still change before the first release; it is specified in [SPEC.md](SPEC.md).
 
 ## What a receipt gives you
@@ -255,9 +255,12 @@ Three commands, no policy engine, no containers, no client changes:
     gargoyle approve --watch 2                  # where the approver sits (terminal)
 
 or approve in a browser: open the issuer's `/approve` page and load
-`approver-web.json`; the page shows each held call with its full arguments,
-checked against the receipt, and signs the grant locally with WebCrypto.
-The key never leaves the browser. Then paste the server entry from
+`approver-web.json`, or, with Entra configured, sign in with Microsoft;
+the page shows each held call with its full arguments, checked against
+the receipt, and signs the grant locally with WebCrypto. The key never
+leaves the browser, and with Entra it is generated there, non-exportable,
+and enrolled under the approver's UPN, so grants and audits name the
+person. Then paste the server entry from
 `gargoyle-deploy/mcp-config.json` into your MCP client.
 [docs/guide-hyperv-ubuntu-apache.md](docs/guide-hyperv-ubuntu-apache.md)
 is the full single-instance build: Ubuntu VM on Hyper-V, Apache with TLS,
@@ -298,6 +301,8 @@ cannot attach receipts work unchanged. Configuration is by environment:
 | `GARGOYLE_MCP_ISSUER_URL`, `GARGOYLE_MCP_CLIENT_TOKEN` | self-issue mode: the issuing service and the identity token (whose subject is this server's principal) to obtain receipts with; `GARGOYLE_MCP_APPROVAL_TIMEOUT_SECONDS` and `GARGOYLE_MCP_POLL_SECONDS` tune the wait for a grant |
 | issuer `GARGOYLE_ISSUER_AUDIENCE` | the `aud` an identity token must carry; a comma-separated list accepts several, so init-minted tokens (`gargoyle-issuer`) and a tenant's tokens (the issuer app's client id) work side by side |
 | `GARGOYLE_MCP_ENTRA_TENANT`, `_CLIENT_ID`, `_SCOPE`, `_TOKEN_CACHE` | instead of a fixed client token: the user's own Entra ID token, written by `gargoyle login` (device code, MSAL cache, silent refresh); the principal is their UPN. No usable token refuses `REF_TARGET_LOGIN_REQUIRED` |
+| issuer `GARGOYLE_ENTRA_CLIENT_ID`, `GARGOYLE_ENTRA_SCOPE` | lets the console sign approvers in with Entra (code flow with PKCE, no library); the browser generates a non-exportable key and enrolls it under the UPN |
+| issuer `GARGOYLE_APPROVERS_PATH`, `GARGOYLE_APPROVER_ROLE`, `GARGOYLE_APPROVER_GROUPS` | where enrolled approvers persist (default `approvers.json` beside the keys) and which Entra app role (default `Approver`) or groups may enroll |
 | `GARGOYLE_HOLD_WEBHOOK_URL`, `GARGOYLE_APPROVE_URL` | issuer: POST a notice of every new hold (Slack incoming-webhook shape, `text` plus the hold) with a link to the console; notice only, the grant still needs the approver's key |
 | `GARGOYLE_MCP_AUDIT_LOG` | the evidence log: every decision, honored or refused, as one hash-chained JSON line with its receipt, grant and execution receipt; `gargoyle audit --log` verifies the file |
 

{gargoyle_receipts-0.5.3.dev0 → gargoyle_receipts-0.6.1.dev0}/README.md

@@ -21,7 +21,7 @@ your MCP server and lets through only what both agreed to.
 
 [![PyPI](https://img.shields.io/pypi/v/gargoyle-receipts)](https://pypi.org/project/gargoyle-receipts/)
 
-Status: pre-release (`0.5.3.dev0`, on PyPI as `gargoyle-receipts`). The wire format is `gargoyle/3` and may
+Status: pre-release (`0.6.1.dev0`, on PyPI as `gargoyle-receipts`). The wire format is `gargoyle/3` and may
 still change before the first release; it is specified in [SPEC.md](SPEC.md).
 
 ## What a receipt gives you
@@ -217,9 +217,12 @@ Three commands, no policy engine, no containers, no client changes:
     gargoyle approve --watch 2                  # where the approver sits (terminal)
 
 or approve in a browser: open the issuer's `/approve` page and load
-`approver-web.json`; the page shows each held call with its full arguments,
-checked against the receipt, and signs the grant locally with WebCrypto.
-The key never leaves the browser. Then paste the server entry from
+`approver-web.json`, or, with Entra configured, sign in with Microsoft;
+the page shows each held call with its full arguments, checked against
+the receipt, and signs the grant locally with WebCrypto. The key never
+leaves the browser, and with Entra it is generated there, non-exportable,
+and enrolled under the approver's UPN, so grants and audits name the
+person. Then paste the server entry from
 `gargoyle-deploy/mcp-config.json` into your MCP client.
 [docs/guide-hyperv-ubuntu-apache.md](docs/guide-hyperv-ubuntu-apache.md)
 is the full single-instance build: Ubuntu VM on Hyper-V, Apache with TLS,
@@ -260,6 +263,8 @@ cannot attach receipts work unchanged. Configuration is by environment:
 | `GARGOYLE_MCP_ISSUER_URL`, `GARGOYLE_MCP_CLIENT_TOKEN` | self-issue mode: the issuing service and the identity token (whose subject is this server's principal) to obtain receipts with; `GARGOYLE_MCP_APPROVAL_TIMEOUT_SECONDS` and `GARGOYLE_MCP_POLL_SECONDS` tune the wait for a grant |
 | issuer `GARGOYLE_ISSUER_AUDIENCE` | the `aud` an identity token must carry; a comma-separated list accepts several, so init-minted tokens (`gargoyle-issuer`) and a tenant's tokens (the issuer app's client id) work side by side |
 | `GARGOYLE_MCP_ENTRA_TENANT`, `_CLIENT_ID`, `_SCOPE`, `_TOKEN_CACHE` | instead of a fixed client token: the user's own Entra ID token, written by `gargoyle login` (device code, MSAL cache, silent refresh); the principal is their UPN. No usable token refuses `REF_TARGET_LOGIN_REQUIRED` |
+| issuer `GARGOYLE_ENTRA_CLIENT_ID`, `GARGOYLE_ENTRA_SCOPE` | lets the console sign approvers in with Entra (code flow with PKCE, no library); the browser generates a non-exportable key and enrolls it under the UPN |
+| issuer `GARGOYLE_APPROVERS_PATH`, `GARGOYLE_APPROVER_ROLE`, `GARGOYLE_APPROVER_GROUPS` | where enrolled approvers persist (default `approvers.json` beside the keys) and which Entra app role (default `Approver`) or groups may enroll |
 | `GARGOYLE_HOLD_WEBHOOK_URL`, `GARGOYLE_APPROVE_URL` | issuer: POST a notice of every new hold (Slack incoming-webhook shape, `text` plus the hold) with a link to the console; notice only, the grant still needs the approver's key |
 | `GARGOYLE_MCP_AUDIT_LOG` | the evidence log: every decision, honored or refused, as one hash-chained JSON line with its receipt, grant and execution receipt; `gargoyle audit --log` verifies the file |
 

gargoyle_receipts-0.6.1.dev0/gargoyle/approvers.py

@@ -0,0 +1,116 @@
+"""Enrolled approvers: a person's Entra identity bound to a key they hold.
+
+`gargoyle init` writes approver key files. For a team, an approver should
+instead sign in with Entra ID in the console, generate a key that never
+leaves their browser, and enroll its public half once. The issuer accepts
+the enrollment from a token that carries the approver app role (or a
+configured group), binds the key to the token's UPN, and persists it here.
+From then on the UPN is the approver key id on every grant, a threshold
+rule may name UPNs, and removing a line from this file (or the role in
+Entra) ends that person's ability to approve.
+
+    approvers.json = {"approvers": {"<upn>": {"public_key_hex": ..., "enrolled_at": ..., "enrolled_by": ...}}}
+
+Trust note. The issuer publishes this map (GET /approvers) and the
+middleware fetches it over the issuer's TLS. That makes the issuer's
+operator the authority for who may approve, which is weaker than a
+root-signed key record (SPEC.md section 10) and the right fit for a site
+where the same administrator runs the issuer and the tenant. Separation of
+duties still holds at the key level: an approver's key is never the
+issuer's, and the issuer never sees a private key.
+"""
+
+import json
+import os
+import stat
+import threading
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any, Dict, Optional
+
+ENV_APPROVERS_PATH = "GARGOYLE_APPROVERS_PATH"
+ENV_APPROVER_ROLE = "GARGOYLE_APPROVER_ROLE"        # Entra app role an enrolling token must carry (default Approver)
+ENV_APPROVER_GROUPS = "GARGOYLE_APPROVER_GROUPS"    # or: comma-separated group ids, any of which qualifies
+
+DEFAULT_APPROVER_ROLE = "Approver"
+
+
+def valid_public_key_hex(value: Any) -> bool:
+    return isinstance(value, str) and len(value) == 64 and all(c in "0123456789abcdef" for c in value)
+
+
+class ApproverRegistry:
+    """The enrolled approvers, persisted to a JSON file. Thread-safe for the
+    single process that owns the file."""
+
+    def __init__(self, path: Optional[str]) -> None:
+        self.path = Path(path) if path else None
+        self._lock = threading.Lock()
+        self._approvers: Dict[str, Dict[str, Any]] = {}
+        if self.path is not None and self.path.exists():
+            doc = json.loads(self.path.read_text(encoding="utf-8"))
+            for upn, entry in (doc.get("approvers") or {}).items():
+                if isinstance(entry, dict) and valid_public_key_hex(entry.get("public_key_hex")):
+                    self._approvers[upn] = dict(entry)
+
+    def _save(self) -> None:
+        if self.path is None:
+            return
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        self.path.write_text(json.dumps({"approvers": self._approvers}, indent=2, sort_keys=True) + "\n", encoding="utf-8")
+        try:
+            os.chmod(self.path, stat.S_IRUSR | stat.S_IWUSR)
+        except OSError:
+            pass
+
+    def enroll(self, upn: str, public_key_hex: str, *, enrolled_by: Optional[str] = None,
+               now: Optional[datetime] = None) -> Dict[str, Any]:
+        """Bind `upn` to `public_key_hex`, replacing any earlier key for that
+        UPN (one key per approver; a new browser re-enrolls)."""
+        if not isinstance(upn, str) or not upn:
+            raise ValueError("upn must be a non-empty string")
+        if not valid_public_key_hex(public_key_hex):
+            raise ValueError("public_key_hex must be 64 lowercase hex characters")
+        entry = {"public_key_hex": public_key_hex,
+                 "enrolled_at": (now or datetime.now(timezone.utc)).isoformat(),
+                 "enrolled_by": enrolled_by or upn}
+        with self._lock:
+            replaced = upn in self._approvers
+            self._approvers[upn] = entry
+            self._save()
+        return {"upn": upn, "replaced": replaced, **entry}
+
+    def remove(self, upn: str) -> bool:
+        with self._lock:
+            gone = self._approvers.pop(upn, None) is not None
+            if gone:
+                self._save()
+        return gone
+
+    def public_hex(self) -> Dict[str, str]:
+        """{upn: public_key_hex}, what GET /approvers publishes."""
+        with self._lock:
+            return {upn: e["public_key_hex"] for upn, e in self._approvers.items()}
+
+    def keys(self) -> Dict[str, Any]:
+        """{upn: Ed25519PublicKey}, the map a verifier uses."""
+        from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
+        return {upn: Ed25519PublicKey.from_public_bytes(bytes.fromhex(h)) for upn, h in self.public_hex().items()}
+
+    def __contains__(self, upn: str) -> bool:
+        return upn in self._approvers
+
+
+def may_enroll(who: Dict[str, Any], *, role: str = DEFAULT_APPROVER_ROLE, groups: Optional[list] = None) -> bool:
+    """Does an authenticated identity (identity.principal_from_token's
+    result) qualify as an approver: the app role, or any configured group."""
+    if role and role in (who.get("roles") or []):
+        return True
+    if groups and any(g in (who.get("groups") or []) for g in groups):
+        return True
+    return False
+
+
+def keys_from_hex(mapping: Dict[str, str]) -> Dict[str, Any]:
+    from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
+    return {k: Ed25519PublicKey.from_public_bytes(bytes.fromhex(v)) for k, v in mapping.items() if valid_public_key_hex(v)}

{gargoyle_receipts-0.5.3.dev0 → gargoyle_receipts-0.6.1.dev0}/gargoyle/cli.py

@@ -194,6 +194,7 @@ def cmd_issuer(args) -> int:
 
     out = Path(args.out).resolve()
     os.environ.update(_read_env(out / "issuer.env"))
+    os.environ.setdefault("GARGOYLE_APPROVERS_PATH", str(out / "approvers.json"))   # enrolled approvers live beside the keys
     app = app_from_env()
     # The middleware reads the policy pin from a file; write it next to the
     # config so the client-side entry finds it at the configured path.
@@ -229,8 +230,12 @@ def cmd_audit(args) -> int:
 
     keys = json.loads((Path(args.out).resolve() / "public-keys.json").read_text())
     load = lambda m: {k: Ed25519PublicKey.from_public_bytes(bytes.fromhex(v)) for k, v in m.items()}
+    approvers = dict(keys["approver"])
+    enrolled = Path(args.out).resolve() / "approvers.json"          # approvers who enrolled through Entra, by UPN
+    if enrolled.exists():
+        approvers.update({u: e["public_key_hex"] for u, e in json.loads(enrolled.read_text()).get("approvers", {}).items()})
     trust = dict(issuer_public_keys=load(keys["issuer"]), executor_public_keys=load(keys["executor"]),
-                 approver_public_keys=load(keys["approver"]))
+                 approver_public_keys=load(approvers))
     if args.log:
         # The middleware's evidence log: every decision, honored or refused,
         # hash-chained. Each honored entry is a full receipt chain.
@@ -239,6 +244,8 @@ def cmd_audit(args) -> int:
         for r in v["entries"]:
             # A refused row shows why the executor refused, beside the check outcome.
             why = (" (%s)" % r["verdict"]) if r["kind"] == "refused" and r["verdict"] else ""
+            if r.get("released_by"):
+                why += " released by " + ", ".join(r["released_by"])
             print("%4s %-5s %-8s %-24s %-28s %s%s" % (r["seq"] if r["seq"] is not None else "?",
                                                       "ok" if r["accepted"] else "FAIL", r["kind"] or "?",
                                                       (r["tool"] or "?")[:24], (r["principal"] or "?")[:28], r["reason"], why))

{gargoyle_receipts-0.5.3.dev0 → gargoyle_receipts-0.6.1.dev0}/gargoyle/consumer.py

@@ -152,6 +152,7 @@ class Consumer:
         clock_skew: timedelta = timedelta(0),
         high_water: Optional[HighWater] = None,
         approver_public_keys: Optional[Dict[str, Any]] = None,
+        approver_key_source: Optional[Callable[[], Dict[str, Any]]] = None,
         executor_signing_key: Any = None,
         executor_key_id: Optional[str] = None,
     ) -> None:
@@ -195,6 +196,9 @@ class Consumer:
         self.clock_skew = clock_skew
         self.high_water = high_water if high_water is not None else HighWater()
         self.approver_public_keys = approver_public_keys
+        # Enrolled approvers (gargoyle.approvers), fetched live by the caller's
+        # function and merged over the static map at each flagged check.
+        self.approver_key_source = approver_key_source
 
     # ----- the live policy pin -----
 
@@ -253,7 +257,13 @@ class Consumer:
         if key_record_view is not None:
             return resolve_approver_keys(key_record_view, gate_key_id=gate_key_id,
                                          now=now, clock_skew=self.clock_skew)
-        return dict(self.approver_public_keys or {})
+        keys = dict(self.approver_public_keys or {})
+        if self.approver_key_source is not None:
+            try:
+                keys.update({k: v for k, v in (self.approver_key_source() or {}).items() if k != gate_key_id})
+            except Exception:
+                pass          # an unreachable source adds nothing; the static map stands
+        return keys
 
     def check(
         self,

{gargoyle_receipts-0.5.3.dev0 → gargoyle_receipts-0.6.1.dev0}/gargoyle/evidence.py

@@ -158,8 +158,9 @@ def verify_log(
     and describe the call the entry names; a refused entry that carries a
     receipt has it checked for issuer provenance. Returns
     {"accepted", "reason", "tail_sha256", "count", "honored", "refused",
-     "entries": [{"seq", "kind", "tool", "principal", "accepted", "reason", "verdict"}, ...]},
-    `reason` the verification outcome and `verdict` what the executor recorded.
+     "entries": [{"seq", "kind", "tool", "principal", "accepted", "reason", "verdict", "released_by"}, ...]},
+    `reason` the verification outcome, `verdict` what the executor recorded,
+    `released_by` the approver key ids of the grants an honored held call carried.
     Verification continues past a bad entry so the report names every one."""
     trust = dict(issuer_public_keys=issuer_public_keys, executor_public_keys=executor_public_keys,
                  approver_public_keys=approver_public_keys)
@@ -177,7 +178,7 @@ def verify_log(
             rc = rc if isinstance(rc, dict) else {}
             report.append({"seq": None, "kind": None, "tool": rc.get("tool"), "principal": rc.get("principal"),
                            "accepted": False, "reason": REF_EVIDENCE_UNCHAINED if legacy else REF_EVIDENCE_MALFORMED,
-                           "verdict": None})
+                           "verdict": None, "released_by": []})
             all_ok = False
             continue
         e = raw
@@ -203,8 +204,10 @@ def verify_log(
                                       now=_parse_at(e["at"]), historical=True)
                 ok, reason = p["accepted"], (ACCEPT_ENTRY_VERIFIED if p["accepted"] else p["reason"])
         counts[e["kind"]] += 1
+        released_by = [g.get("approver_key_id") for g in (e["grant"] if isinstance(e["grant"], list) else [e["grant"]])
+                       if isinstance(g, dict)] if e["grant"] is not None else []
         report.append({"seq": e["seq"], "kind": e["kind"], "tool": e["tool"], "principal": e["principal"],
-                       "accepted": ok, "reason": reason, "verdict": e["reason"]})
+                       "accepted": ok, "reason": reason, "verdict": e["reason"], "released_by": released_by})
         all_ok = all_ok and ok
         # The chain continues from what the file says, so one bad entry is
         # reported once rather than cascading into every later one.

{gargoyle_receipts-0.5.3.dev0 → gargoyle_receipts-0.6.1.dev0}/gargoyle/issuer_service.py

@@ -53,6 +53,8 @@ from gargoyle.approval import (REF_APPROVAL_APPROVER_NOT_ELIGIBLE, REF_APPROVAL_
                                verify_grant)
 from gargoyle.envelope import approval_terms
 from gargoyle.notify import notifier_from_env
+from gargoyle.approvers import (DEFAULT_APPROVER_ROLE, ENV_APPROVER_GROUPS, ENV_APPROVER_ROLE, ENV_APPROVERS_PATH,
+                                ApproverRegistry, may_enroll, valid_public_key_hex)
 from gargoyle.identity import entra_keys, principal_from_token
 from gargoyle.issuer import DEFAULT_TTL_SECONDS, issue
 from gargoyle.policy import Policy
@@ -69,12 +71,15 @@ ENV_AUDIENCE = "GARGOYLE_ISSUER_AUDIENCE"
 ENV_APPROVER_KEY_ID = "GARGOYLE_APPROVER_KEY_ID"
 ENV_APPROVER_PUBLIC_KEY_HEX = "GARGOYLE_APPROVER_PUBLIC_KEY_HEX"
 ENV_RECEIPT_TTL = "GARGOYLE_RECEIPT_TTL_SECONDS"
+ENV_CONSOLE_CLIENT_ID = "GARGOYLE_ENTRA_CLIENT_ID"   # the public client app the console signs in with (User-Client-Flow)
+ENV_CONSOLE_SCOPE = "GARGOYLE_ENTRA_SCOPE"           # default api://<last audience>/access
 
 REF_ISSUER_UNAUTHENTICATED = "REF_ISSUER_UNAUTHENTICATED"
 REF_ISSUER_BAD_REQUEST = "REF_ISSUER_BAD_REQUEST"
 REF_ISSUER_ARGS_NOT_TEXT = "REF_ISSUER_ARGS_NOT_TEXT"   # arguments carry characters no UTF-8 text has
 REF_ISSUER_UNKNOWN_HOLD = "REF_ISSUER_UNKNOWN_HOLD"
 REF_ISSUER_NO_APPROVER_TRUST = "REF_ISSUER_NO_APPROVER_TRUST"
+REF_ISSUER_NOT_AN_APPROVER = "REF_ISSUER_NOT_AN_APPROVER"   # enrollment without the approver role or group
 
 
 def build_issuer_app(
@@ -88,6 +93,10 @@ def build_issuer_app(
     ttl_seconds: int = DEFAULT_TTL_SECONDS,
     now: Callable[[], datetime] = lambda: datetime.now(timezone.utc),
     on_hold: Optional[Callable[[Dict[str, Any], Any], None]] = None,
+    approver_registry: Optional[ApproverRegistry] = None,
+    approver_role: str = DEFAULT_APPROVER_ROLE,
+    approver_groups: Optional[list] = None,
+    console_entra: Optional[Dict[str, str]] = None,
 ) -> FastAPI:
     """`on_hold(envelope, args)` is called once for every new hold (gargoyle.notify
     posts it to a webhook); it is notice, not admission, and its failure
@@ -97,6 +106,12 @@ def build_issuer_app(
     app.state.pending_args: Dict[str, Any] = {}           # approval_request_id -> the call's arguments
     app.state.grants: Dict[str, Dict[str, Any]] = {}      # approval_request_id -> grant
     app.state.declined: set = set()                       # approval_request_ids a human refused
+    registry = approver_registry if approver_registry is not None else ApproverRegistry(None)
+    static_approvers = dict(approver_public_keys or {})
+
+    def approver_keys() -> Dict[str, Any]:
+        """Static keys from configuration plus every enrolled approver, by UPN."""
+        return {**static_approvers, **registry.keys()}
 
     def _refuse(status: int, reason: str) -> HTTPException:
         return HTTPException(status_code=status, detail={"reason": reason})
@@ -182,10 +197,11 @@ def build_issuer_app(
         env = app.state.pending.get(arid) if isinstance(arid, str) else None
         if env is None:
             return {"accepted": False, "reason": REF_ISSUER_UNKNOWN_HOLD}
-        if not approver_public_keys:
+        trusted = approver_keys()
+        if not trusted:
             return {"accepted": False, "reason": REF_ISSUER_NO_APPROVER_TRUST}
         g = verify_grant(grant, expected_decision_sha256=env["decision_sha256"],
-                         expected_approval_request_id=arid, approver_public_keys=approver_public_keys,
+                         expected_approval_request_id=arid, approver_public_keys=trusted,
                          gate_key_id=key_id, now=now())
         if not g["accepted"]:
             return {"accepted": False, "reason": g["reason"]}
@@ -230,6 +246,46 @@ def build_issuer_app(
                 "collected": len(have), "required": approval_terms(env)["required"] if env else None,
                 "declined": approval_request_id in app.state.declined}
 
+    @app.get("/approvers")
+    async def approvers():
+        """Public, like /record: the enrolled approvers' public keys by UPN,
+        for the middleware and for audits. Static configured keys are not
+        listed; they travel in config."""
+        return {"approvers": registry.public_hex()}
+
+    @app.post("/approvers/enroll")
+    async def enroll(request: Request, authorization: Optional[str] = Header(default=None)):
+        """Bind the caller's UPN to the public key their browser generated.
+        Only a token carrying the approver role (or a configured group) may;
+        the UPN comes from the token, never from the body."""
+        who = authenticate(authorization)
+        if not may_enroll(who, role=approver_role, groups=approver_groups):
+            raise _refuse(403, REF_ISSUER_NOT_AN_APPROVER)
+        try:
+            body = await request.json()
+        except Exception:
+            raise _refuse(400, REF_ISSUER_BAD_REQUEST)
+        if not isinstance(body, dict) or not valid_public_key_hex(body.get("public_key_hex")):
+            raise _refuse(400, REF_ISSUER_BAD_REQUEST)
+        result = registry.enroll(who["principal"], body["public_key_hex"], now=now())
+        return {"enrolled": True, "key_id": who["principal"], "replaced": result["replaced"]}
+
+    @app.get("/me")
+    async def me(authorization: Optional[str] = Header(default=None)):
+        """Who the console is signed in as, whether they may approve, and
+        the public key enrolled for them (so the browser can tell whether
+        its own key is the one on record)."""
+        who = authenticate(authorization)
+        upn = who["principal"]
+        return {"principal": upn, "may_approve": may_enroll(who, role=approver_role, groups=approver_groups) or upn in static_approvers,
+                "enrolled_public_key_hex": registry.public_hex().get(upn)}
+
+    @app.get("/approve-config")
+    async def approve_config():
+        """Public: how the console signs in. `entra` is null when the site
+        uses approver files instead."""
+        return {"entra": console_entra}
+
     @app.get("/approve")
     async def approve_page():
         return Response((STATIC / "approve.html").read_bytes(), media_type="text/html; charset=utf-8")
@@ -298,4 +354,10 @@ def app_from_env() -> FastAPI:
         audience=os.environ.get(ENV_AUDIENCE) or None,
         ttl_seconds=int(os.environ.get(ENV_RECEIPT_TTL, DEFAULT_TTL_SECONDS)),
         on_hold=notifier_from_env(os.environ),
+        approver_registry=ApproverRegistry(os.environ.get(ENV_APPROVERS_PATH)),
+        approver_role=os.environ.get(ENV_APPROVER_ROLE, DEFAULT_APPROVER_ROLE),
+        approver_groups=[g.strip() for g in os.environ.get(ENV_APPROVER_GROUPS, "").split(",") if g.strip()] or None,
+        console_entra=({"tenant": tenant, "client_id": os.environ[ENV_CONSOLE_CLIENT_ID],
+                        "scope": os.environ.get(ENV_CONSOLE_SCOPE) or "api://%s/access" % (os.environ.get(ENV_AUDIENCE) or "").split(",")[-1].strip()}
+                       if tenant and os.environ.get(ENV_CONSOLE_CLIENT_ID) else None),
     )

{gargoyle_receipts-0.5.3.dev0 → gargoyle_receipts-0.6.1.dev0}/gargoyle/mcp_server.py

@@ -160,6 +160,16 @@ class IssuerClient:
             return {"envelope": None, "reason": body.get("reason") or REF_TARGET_ISSUER_UNAVAILABLE}
         return {"envelope": body.get("envelope"), "reason": None}
 
+    def approver_keys(self) -> Dict[str, Any]:
+        """The issuer's enrolled approvers as {upn: public key}; {} when the
+        issuer cannot be reached (the static map then stands alone)."""
+        from gargoyle.approvers import keys_from_hex
+        try:
+            r = self._get("/approvers")
+            return keys_from_hex(r.json().get("approvers", {})) if r.status_code == 200 else {}
+        except Exception:
+            return {}
+
     def wait_for_grant(self, approval_request_id: str) -> Dict[str, Any]:
         """Poll until the hold has its grant (or, for a receipt that needs
         several approvers, the whole set), a human declined it, the hold
@@ -284,6 +294,7 @@ class ServerState:
                 record=config["record"],
                 replay_cache=replay_cache,
                 approver_public_keys=config.get("approver_public_keys"),
+                approver_key_source=(issuer_client.approver_keys if issuer_client is not None else None),
                 executor_signing_key=config.get("executor_signing_key"),
                 executor_key_id=config.get("executor_key_id"),
             )

{gargoyle_receipts-0.5.3.dev0 → gargoyle_receipts-0.6.1.dev0}/gargoyle/static/approve.html

@@ -34,6 +34,11 @@
   <span class="status" id="status">not loaded</span>
 </header>
 <main>
+  <section class="setup" id="entra" style="display:none">
+    <strong>Sign in with Microsoft</strong> to approve as yourself. Your signing key is created in this browser,
+    cannot be exported, and is enrolled under your account the first time.
+    <div style="margin-top:10px"><button id="signin">Sign in with Microsoft</button> <span id="entra-note"></span></div>
+  </section>
   <section class="setup" id="setup">
     <strong>Load your approver file</strong> (the <code>approver-web.json</code> that <code>gargoyle init</code> wrote).
     It holds your key and your token; they stay in this tab and are gone when you close it.
@@ -43,12 +48,58 @@
   <div class="log" id="log"></div>
 </main>
 <script type="module">
-import { argsSha256, buildGrant, importApproverKey, isoUtc, newGrantId, signGrant } from "./approve.js";
+import { argsSha256, authorizeUrl, buildGrant, exchangeCode, generateApproverKey, importApproverKey, isoUtc, loadStoredKey,
+         newGrantId, pkceChallenge, publicKeyHex, randomVerifier, signGrant, storeKey } from "./approve.js";
 
 const state = { token: null, key: null, keyId: null, ttl: 300, timer: null, seen: new Map() };
 const $ = (id) => document.getElementById(id);
 const log = (m) => { $("log").textContent = new Date().toLocaleTimeString() + "  " + m; };
 
+// ---- Entra path: sign in, hold a browser key, enroll it once ----
+const redirectUri = location.origin + location.pathname;
+async function entraSetup() {
+  let cfg = null;
+  try { cfg = (await (await fetch("approve-config")).json()).entra; } catch (err) { /* older issuer: files only */ }
+  if (!cfg) return;
+  $("entra").style.display = "";
+  const params = new URLSearchParams(location.search);
+  if (params.get("code")) {                               // back from Microsoft with a code
+    history.replaceState(null, "", redirectUri);
+    const verifier = sessionStorage.getItem("gargoyle-pkce"), expected = sessionStorage.getItem("gargoyle-state");
+    if (!verifier || params.get("state") !== expected) { log("sign-in state mismatch; try again"); return; }
+    try {
+      const tok = await exchangeCode({ tenant: cfg.tenant, clientId: cfg.client_id, scope: cfg.scope, redirectUri, code: params.get("code"), verifier });
+      sessionStorage.setItem("gargoyle-token", tok.access_token);
+    } catch (err) { log("sign-in failed: " + err.message); return; }
+  }
+  const token = sessionStorage.getItem("gargoyle-token");
+  if (token) { state.token = token; await entraReady(); return; }
+  $("signin").addEventListener("click", async () => {
+    const verifier = randomVerifier(), st = randomVerifier();
+    sessionStorage.setItem("gargoyle-pkce", verifier); sessionStorage.setItem("gargoyle-state", st);
+    location.href = authorizeUrl({ tenant: cfg.tenant, clientId: cfg.client_id, scope: cfg.scope, redirectUri, challenge: await pkceChallenge(verifier), state: st });
+  });
+}
+
+async function entraReady() {
+  let me;
+  try { me = await api("me"); } catch (err) { sessionStorage.removeItem("gargoyle-token"); log("session expired; sign in again"); return; }
+  if (!me.may_approve) { $("entra-note").textContent = `${me.principal} is signed in but has no Approver role`; return; }
+  let keyPair = await loadStoredKey(me.principal);
+  if (!keyPair) { keyPair = await generateApproverKey(); await storeKey(me.principal, keyPair); }
+  const mine = await publicKeyHex(keyPair);
+  if (me.enrolled_public_key_hex !== mine) {
+    // First time in this browser (or a new browser): enroll this key under the UPN.
+    const res = await api("approvers/enroll", { method: "POST", body: JSON.stringify({ public_key_hex: mine }) });
+    log(res.replaced ? "this browser's key replaced your previous one" : "this browser's key enrolled");
+  }
+  state.key = keyPair.privateKey; state.keyId = me.principal;
+  $("entra").style.display = "none"; $("setup").style.display = "none";
+  $("status").textContent = "approving as " + state.keyId;
+  await refresh(); state.timer = setInterval(refresh, 3000);
+}
+entraSetup();
+
 $("file").addEventListener("change", async (e) => {
   const f = e.target.files[0]; if (!f) return;
   try {

gargoyle_receipts-0.6.1.dev0/gargoyle/static/approve.js

@@ -0,0 +1,121 @@
+// Gargoyle approval console: the browser-side half of a human approval.
+// The approver's Ed25519 key never leaves this page; the issuer receives only
+// the signed grant, exactly as it does from gargoyle-approver. canonicalJson,
+// argsSha256 and grant signing match SPEC.md byte for byte (tests/test_console_js.py
+// checks them against the conformance vectors under Node).
+
+// RFC 8785 canonical JSON. Scalars through JSON.stringify (its escaping and
+// number format are the JCS rules); objects emitted by hand, because
+// JSON.stringify moves integer-like member names to the front.
+export function canonicalJson(value) {
+  if (value === null || typeof value !== "object") {
+    if (typeof value === "number" && !Number.isFinite(value)) throw new TypeError("non-finite numbers are not JSON");
+    if (value === undefined) throw new TypeError("value is not JSON: undefined");
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) return "[" + value.map(canonicalJson).join(",") + "]";
+  const keys = Object.keys(value).sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
+  return "{" + keys.map((k) => JSON.stringify(k) + ":" + canonicalJson(value[k])).join(",") + "}";
+}
+
+const subtle = () => globalThis.crypto.subtle;
+const hex = (buf) => Array.from(new Uint8Array(buf), (b) => b.toString(16).padStart(2, "0")).join("");
+
+export async function sha256Hex(text) {
+  return hex(await subtle().digest("SHA-256", new TextEncoder().encode(text)));
+}
+
+export async function argsSha256(args) {
+  return sha256Hex(canonicalJson(args));
+}
+
+/** Import an approver key from the JSON `gargoyle init` wrote: {kty:"OKP", crv:"Ed25519", d, x}. */
+export async function importApproverKey(jwk) {
+  return subtle().importKey("jwk", { kty: "OKP", crv: "Ed25519", d: jwk.d, x: jwk.x }, { name: "Ed25519" }, false, ["sign"]);
+}
+
+export function buildGrant({ decisionSha256, approvalRequestId, grantId, notAfter }) {
+  if (!grantId) throw new Error("grant_id is mandatory");
+  return { grant_version: "1.0", decision_sha256: decisionSha256, approval_request_id: approvalRequestId, grant_id: grantId, not_after: notAfter };
+}
+
+export async function signGrant(grant, key, keyId) {
+  const signed = { ...grant, approver_key_id: keyId };
+  const region = {};
+  for (const [k, v] of Object.entries(signed)) if (k !== "approver_signature") region[k] = v;
+  const sig = await subtle().sign({ name: "Ed25519" }, key, new TextEncoder().encode(canonicalJson(region)));
+  signed.approver_signature = hex(sig);
+  return signed;
+}
+
+/** ISO-8601 with an explicit +00:00 offset, as the reference writes it. */
+export function isoUtc(date) {
+  return date.toISOString().replace(/\.\d{3}Z$/, "+00:00");
+}
+
+export function newGrantId() {
+  const b = new Uint8Array(16); globalThis.crypto.getRandomValues(b);
+  return hex(b.buffer);
+}
+
+// ---- Entra ID sign-in (OAuth 2.0 authorization code with PKCE, RFC 7636), no library ----
+
+const b64url = (buf) => btoa(String.fromCharCode(...new Uint8Array(buf))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+
+export function randomVerifier() {
+  const bytes = new Uint8Array(32); globalThis.crypto.getRandomValues(bytes);
+  return b64url(bytes);                                   // 43 chars of the unreserved set
+}
+
+export async function pkceChallenge(verifier) {
+  return b64url(await subtle().digest("SHA-256", new TextEncoder().encode(verifier)));
+}
+
+export function authorizeUrl({ tenant, clientId, scope, redirectUri, challenge, state }) {
+  const q = new URLSearchParams({ client_id: clientId, response_type: "code", redirect_uri: redirectUri, response_mode: "query",
+                                  scope: scope + " openid profile", code_challenge: challenge, code_challenge_method: "S256", state });
+  return `https://login.microsoftonline.com/${tenant}/oauth2/v2.0/authorize?${q}`;
+}
+
+export async function exchangeCode({ tenant, clientId, scope, redirectUri, code, verifier }, fetchImpl = globalThis.fetch) {
+  const body = new URLSearchParams({ client_id: clientId, grant_type: "authorization_code", code, redirect_uri: redirectUri,
+                                     code_verifier: verifier, scope: scope + " openid profile" });
+  const r = await fetchImpl(`https://login.microsoftonline.com/${tenant}/oauth2/v2.0/token`,
+                            { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded" }, body });
+  const tok = await r.json();
+  if (!r.ok || !tok.access_token) throw new Error(tok.error_description || tok.error || ("token endpoint " + r.status));
+  return tok;                                             // { access_token, expires_in, id_token, ... }
+}
+
+// ---- The approver's own key: generated here, non-extractable, kept in IndexedDB ----
+
+export async function generateApproverKey() {
+  return subtle().generateKey({ name: "Ed25519" }, false, ["sign", "verify"]);   // private half can never be exported
+}
+
+export async function publicKeyHex(keyPair) {
+  return hex(await subtle().exportKey("raw", keyPair.publicKey));
+}
+
+const DB = "gargoyle-approver", STORE = "keys";
+function openDb() {
+  return new Promise((resolve, reject) => {
+    const req = indexedDB.open(DB, 1);
+    req.onupgradeneeded = () => req.result.createObjectStore(STORE);
+    req.onsuccess = () => resolve(req.result); req.onerror = () => reject(req.error);
+  });
+}
+export async function loadStoredKey(name) {
+  const db = await openDb();
+  return new Promise((resolve, reject) => {
+    const req = db.transaction(STORE).objectStore(STORE).get(name);
+    req.onsuccess = () => resolve(req.result || null); req.onerror = () => reject(req.error);
+  });
+}
+export async function storeKey(name, keyPair) {
+  const db = await openDb();
+  return new Promise((resolve, reject) => {
+    const tx = db.transaction(STORE, "readwrite"); tx.objectStore(STORE).put(keyPair, name);
+    tx.oncomplete = () => resolve(); tx.onerror = () => reject(tx.error);
+  });
+}

{gargoyle_receipts-0.5.3.dev0 → gargoyle_receipts-0.6.1.dev0/gargoyle_receipts.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gargoyle-receipts
-Version: 0.5.3.dev0
+Version: 0.6.1.dev0
 Summary: Signed, single-use, argument-bound receipts and human-approval holds for agent tool calls.
 Author: Justin LaPorte
 License-Expression: Apache-2.0
@@ -59,7 +59,7 @@ your MCP server and lets through only what both agreed to.
 
 [![PyPI](https://img.shields.io/pypi/v/gargoyle-receipts)](https://pypi.org/project/gargoyle-receipts/)
 
-Status: pre-release (`0.5.3.dev0`, on PyPI as `gargoyle-receipts`). The wire format is `gargoyle/3` and may
+Status: pre-release (`0.6.1.dev0`, on PyPI as `gargoyle-receipts`). The wire format is `gargoyle/3` and may
 still change before the first release; it is specified in [SPEC.md](SPEC.md).
 
 ## What a receipt gives you
@@ -255,9 +255,12 @@ Three commands, no policy engine, no containers, no client changes:
     gargoyle approve --watch 2                  # where the approver sits (terminal)
 
 or approve in a browser: open the issuer's `/approve` page and load
-`approver-web.json`; the page shows each held call with its full arguments,
-checked against the receipt, and signs the grant locally with WebCrypto.
-The key never leaves the browser. Then paste the server entry from
+`approver-web.json`, or, with Entra configured, sign in with Microsoft;
+the page shows each held call with its full arguments, checked against
+the receipt, and signs the grant locally with WebCrypto. The key never
+leaves the browser, and with Entra it is generated there, non-exportable,
+and enrolled under the approver's UPN, so grants and audits name the
+person. Then paste the server entry from
 `gargoyle-deploy/mcp-config.json` into your MCP client.
 [docs/guide-hyperv-ubuntu-apache.md](docs/guide-hyperv-ubuntu-apache.md)
 is the full single-instance build: Ubuntu VM on Hyper-V, Apache with TLS,
@@ -298,6 +301,8 @@ cannot attach receipts work unchanged. Configuration is by environment:
 | `GARGOYLE_MCP_ISSUER_URL`, `GARGOYLE_MCP_CLIENT_TOKEN` | self-issue mode: the issuing service and the identity token (whose subject is this server's principal) to obtain receipts with; `GARGOYLE_MCP_APPROVAL_TIMEOUT_SECONDS` and `GARGOYLE_MCP_POLL_SECONDS` tune the wait for a grant |
 | issuer `GARGOYLE_ISSUER_AUDIENCE` | the `aud` an identity token must carry; a comma-separated list accepts several, so init-minted tokens (`gargoyle-issuer`) and a tenant's tokens (the issuer app's client id) work side by side |
 | `GARGOYLE_MCP_ENTRA_TENANT`, `_CLIENT_ID`, `_SCOPE`, `_TOKEN_CACHE` | instead of a fixed client token: the user's own Entra ID token, written by `gargoyle login` (device code, MSAL cache, silent refresh); the principal is their UPN. No usable token refuses `REF_TARGET_LOGIN_REQUIRED` |
+| issuer `GARGOYLE_ENTRA_CLIENT_ID`, `GARGOYLE_ENTRA_SCOPE` | lets the console sign approvers in with Entra (code flow with PKCE, no library); the browser generates a non-exportable key and enrolls it under the UPN |
+| issuer `GARGOYLE_APPROVERS_PATH`, `GARGOYLE_APPROVER_ROLE`, `GARGOYLE_APPROVER_GROUPS` | where enrolled approvers persist (default `approvers.json` beside the keys) and which Entra app role (default `Approver`) or groups may enroll |
 | `GARGOYLE_HOLD_WEBHOOK_URL`, `GARGOYLE_APPROVE_URL` | issuer: POST a notice of every new hold (Slack incoming-webhook shape, `text` plus the hold) with a link to the console; notice only, the grant still needs the approver's key |
 | `GARGOYLE_MCP_AUDIT_LOG` | the evidence log: every decision, honored or refused, as one hash-chained JSON line with its receipt, grant and execution receipt; `gargoyle audit --log` verifies the file |
 

{gargoyle_receipts-0.5.3.dev0 → gargoyle_receipts-0.6.1.dev0}/gargoyle_receipts.egg-info/SOURCES.txt

@@ -6,6 +6,7 @@ gargoyle/__init__.py
 gargoyle/approval.py
 gargoyle/approver_cli.py
 gargoyle/approver_trust.py
+gargoyle/approvers.py
 gargoyle/cli.py
 gargoyle/consumer.py
 gargoyle/entra_login.py
@@ -37,6 +38,7 @@ gargoyle_receipts.egg-info/requires.txt
 gargoyle_receipts.egg-info/top_level.txt
 tests/test_annotations.py
 tests/test_approver_cli.py
+tests/test_approvers.py
 tests/test_canonical.py
 tests/test_cli.py
 tests/test_console_js.py

{gargoyle_receipts-0.5.3.dev0 → gargoyle_receipts-0.6.1.dev0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "gargoyle-receipts"
-version = "0.5.3.dev0"
+version = "0.6.1.dev0"
 description = "Signed, single-use, argument-bound receipts and human-approval holds for agent tool calls."
 readme = "README.md"
 requires-python = ">=3.12"

gargoyle_receipts-0.6.1.dev0/tests/test_approvers.py

@@ -0,0 +1,111 @@
+"""Approvers who sign in with Entra: a browser-held key enrolled under the
+token's UPN, published by the issuer, trusted by the middleware and the
+audit, and usable in threshold rules by name."""
+
+import json
+from datetime import datetime, timedelta, timezone
+
+import pytest
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+from cryptography.hazmat.primitives.serialization import Encoding, PublicFormat
+from fastapi.testclient import TestClient
+
+from gargoyle.approval import build_grant, sign_grant
+from gargoyle.approvers import ApproverRegistry, may_enroll
+from gargoyle.consumer import Consumer
+from gargoyle.issuer_service import REF_ISSUER_NOT_AN_APPROVER, build_issuer_app
+from gargoyle.jws import encode
+from gargoyle.policy import ELIGIBLE, Decision
+
+issuer, idp = Ed25519PrivateKey.generate(), Ed25519PrivateKey.generate()
+PIN = {"policy_id": "p/1", "policy_sha256": "a" * 64}
+TARGET = "mcp://fs"
+pub_hex = lambda k: k.public_key().public_bytes(Encoding.Raw, PublicFormat.Raw).hex()
+
+
+class Hold:
+    def __init__(self, required=1, approvers=None): self.d = Decision(ELIGIBLE, None, True, required, approvers)
+    def pin(self): return PIN
+    def decide(self, target_url, interaction): return self.d
+
+
+def token(upn, roles=(), groups=()):
+    claims = {"preferred_username": upn, "sub": "oid-" + upn, "exp": int((datetime.now(timezone.utc) + timedelta(hours=1)).timestamp())}
+    if roles: claims["roles"] = list(roles)
+    if groups: claims["groups"] = list(groups)
+    return encode(claims, idp, "idp-1")
+
+
+def test_registry_persists_one_key_per_upn(tmp_path):
+    path = tmp_path / "approvers.json"
+    reg = ApproverRegistry(str(path))
+    k1, k2 = Ed25519PrivateKey.generate(), Ed25519PrivateKey.generate()
+    r = reg.enroll("dana@contoso.com", pub_hex(k1))
+    assert r["replaced"] is False and "dana@contoso.com" in reg
+    assert reg.enroll("dana@contoso.com", pub_hex(k2))["replaced"] is True
+    again = ApproverRegistry(str(path))                    # survives a restart
+    assert again.public_hex() == {"dana@contoso.com": pub_hex(k2)}
+    assert set(again.keys()) == {"dana@contoso.com"}
+    assert again.remove("dana@contoso.com") and not again.remove("dana@contoso.com")
+    with pytest.raises(ValueError):
+        reg.enroll("x@y", "zz")
+    assert may_enroll({"roles": ["Approver"]}) and not may_enroll({"roles": ["Reader"]})
+    assert may_enroll({"groups": ["g-1"]}, groups=["g-1"]) and not may_enroll({"groups": ["g-2"]}, groups=["g-1"])
+
+
+def _app(tmp_path, policy=None, groups=None):
+    reg = ApproverRegistry(str(tmp_path / "approvers.json"))
+    app = build_issuer_app(policy=policy or Hold(), signing_key=issuer, key_id="issuer-1", idp_public_keys={"idp-1": idp.public_key()},
+                           approver_registry=reg, approver_groups=groups,
+                           console_entra={"tenant": "t", "client_id": "c", "scope": "api://a/access"})
+    return TestClient(app), reg
+
+
+def test_enrollment_needs_the_role_and_binds_the_tokens_upn(tmp_path):
+    c, reg = _app(tmp_path)
+    key = Ed25519PrivateKey.generate()
+    h = lambda t: {"Authorization": "Bearer " + t}
+    r = c.post("/approvers/enroll", json={"public_key_hex": pub_hex(key)}, headers=h(token("eve@contoso.com")))
+    assert r.status_code == 403 and r.json()["detail"]["reason"] == REF_ISSUER_NOT_AN_APPROVER
+    r = c.post("/approvers/enroll", json={"public_key_hex": pub_hex(key)}, headers=h(token("dana@contoso.com", roles=["Approver"])))
+    assert r.json() == {"enrolled": True, "key_id": "dana@contoso.com", "replaced": False}
+    assert c.get("/approvers").json() == {"approvers": {"dana@contoso.com": pub_hex(key)}}        # public
+    me = c.get("/me", headers=h(token("dana@contoso.com", roles=["Approver"]))).json()
+    assert me == {"principal": "dana@contoso.com", "may_approve": True, "enrolled_public_key_hex": pub_hex(key)}
+    assert c.get("/me", headers=h(token("eve@contoso.com"))).json()["may_approve"] is False
+    assert c.get("/approve-config").json() == {"entra": {"tenant": "t", "client_id": "c", "scope": "api://a/access"}}
+    assert c.post("/approvers/enroll", json={"public_key_hex": "nope"}, headers=h(token("dana@contoso.com", roles=["Approver"]))).status_code == 400
+    # A group qualifies too.
+    c2, _ = _app(tmp_path / "g", groups=["grp-approvers"])
+    assert c2.post("/approvers/enroll", json={"public_key_hex": pub_hex(key)}, headers=h(token("sam@contoso.com", groups=["grp-approvers"]))).json()["enrolled"]
+
+
+def test_an_enrolled_approver_releases_a_hold_and_the_middleware_trusts_the_published_key(tmp_path):
+    c, reg = _app(tmp_path, policy=Hold(2, ("dana@contoso.com", "lee@contoso.com")))
+    dana, lee = Ed25519PrivateKey.generate(), Ed25519PrivateKey.generate()
+    h = lambda t: {"Authorization": "Bearer " + t}
+    for upn, key in (("dana@contoso.com", dana), ("lee@contoso.com", lee)):
+        assert c.post("/approvers/enroll", json={"public_key_hex": pub_hex(key)}, headers=h(token(upn, roles=["Approver"]))).json()["enrolled"]
+    agent = token("agent@contoso.com")
+    env = c.post("/issue", json={"target_url": TARGET, "tool": "transfer_funds", "args": {"amount": 5}}, headers=h(agent)).json()["envelope"]
+    assert env["approval"] == {"required": 2, "approvers": ["dana@contoso.com", "lee@contoso.com"]}
+    arid = env["approval_request_id"]
+    g = lambda key, upn: sign_grant(build_grant(decision_sha256=env["decision_sha256"], approval_request_id=arid, grant_id="g-" + upn,
+                                                not_after=datetime.now(timezone.utc) + timedelta(minutes=5)), key, upn)
+    assert c.post("/grants", json=g(dana, "dana@contoso.com"), headers=h(agent)).json()["accepted"]
+    assert c.post("/grants", json=g(lee, "lee@contoso.com"), headers=h(agent)).json()["complete"] is True
+    grants = c.get("/grants/" + arid, headers=h(agent)).json()["grants"]
+    assert [x["approver_key_id"] for x in grants] == ["dana@contoso.com", "lee@contoso.com"]
+
+    # The middleware's consumer has no static approver keys; it learns them from the issuer.
+    from gargoyle.mcp_server import IssuerClient
+    class Shim:
+        def post(self, url, json=None, headers=None, timeout=None): return c.post(url.replace("http://i", ""), json=json, headers=headers)
+        def get(self, url, headers=None, timeout=None): return c.get(url.replace("http://i", ""), headers=headers)
+    ic = IssuerClient("http://i", agent, http=Shim())
+    assert set(ic.approver_keys()) == {"dana@contoso.com", "lee@contoso.com"}
+    consumer = Consumer(target_id=TARGET, pinned_public_keys={"issuer-1": issuer.public_key()}, record=PIN,
+                        approver_key_source=ic.approver_keys)
+    assert consumer.check(env, {"tool": "transfer_funds", "args": {"amount": 5}, "principal": "agent@contoso.com"}, grant=grants).honored
+    # The audit command merges approvers.json from the deploy folder.
+    assert json.loads((tmp_path / "approvers.json").read_text())["approvers"]["lee@contoso.com"]["public_key_hex"] == pub_hex(lee)

{gargoyle_receipts-0.5.3.dev0 → gargoyle_receipts-0.6.1.dev0}/tests/test_cli.py

@@ -112,6 +112,7 @@ def test_init_for_a_windows_client_and_audit_log_verification(tmp_path, monkeypa
     assert "4 entries (3 honored, 1 refused), 0 failed; chain EVIDENCE_VERIFIED" in out_text
     assert out_text.count(" ok ") == 4 and "refused  delete_file" in out_text
     assert "ENTRY_VERIFIED (DESTRUCTIVE_TOOL)" in out_text
+    assert "released by approver-1" in out_text          # the held write names who released it
     # A tampered entry is caught, and the hash-chain names it: editing the
     # execution receipt inside entry 2 changes its hash.
     lines = log.read_text().splitlines(); e = json.loads(lines[1]); e["execution"]["outputs_sha256"] = "0" * 64

{gargoyle_receipts-0.5.3.dev0 → gargoyle_receipts-0.6.1.dev0}/tests/test_console_js.py

@@ -37,3 +37,23 @@ def test_console_signing_matches_the_reference_vectors(tmp_path):
     assert out["args_sha256"] == vectors["args_sha256"]
     assert out["hash_region"] == vectors["hash_region"]
     assert out["grant"] == vectors["grant"]            # byte-equal signature from the browser-side code
+
+
+PKCE_SCRIPT = r'''
+import { pkceChallenge, authorizeUrl } from "%s";
+const challenge = await pkceChallenge("dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk");
+const url = authorizeUrl({ tenant: "t", clientId: "c", scope: "api://a/access", redirectUri: "https://g/approve", challenge, state: "s1" });
+console.log(JSON.stringify({ challenge, url }));
+'''
+
+
+def test_console_pkce_matches_rfc_7636(tmp_path):
+    """Appendix B of RFC 7636: the S256 challenge for the given verifier."""
+    if shutil.which("node") is None:
+        pytest.skip("node not installed")
+    script = tmp_path / "pkce.mjs"
+    script.write_text(PKCE_SCRIPT % (ROOT / "gargoyle" / "static" / "approve.js").as_uri())
+    out = json.loads(subprocess.run(["node", str(script)], capture_output=True, text=True, check=True).stdout)
+    assert out["challenge"] == "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM"
+    assert out["url"].startswith("https://login.microsoftonline.com/t/oauth2/v2.0/authorize?")
+    assert "code_challenge_method=S256" in out["url"] and "client_id=c" in out["url"] and "scope=api%3A%2F%2Fa%2Faccess+openid+profile" in out["url"]

gargoyle_receipts-0.5.3.dev0/gargoyle/static/approve.js

@@ -1,59 +0,0 @@
-// Gargoyle approval console: the browser-side half of a human approval.
-// The approver's Ed25519 key never leaves this page; the issuer receives only
-// the signed grant, exactly as it does from gargoyle-approver. canonicalJson,
-// argsSha256 and grant signing match SPEC.md byte for byte (tests/test_console_js.py
-// checks them against the conformance vectors under Node).
-
-// RFC 8785 canonical JSON. Scalars through JSON.stringify (its escaping and
-// number format are the JCS rules); objects emitted by hand, because
-// JSON.stringify moves integer-like member names to the front.
-export function canonicalJson(value) {
-  if (value === null || typeof value !== "object") {
-    if (typeof value === "number" && !Number.isFinite(value)) throw new TypeError("non-finite numbers are not JSON");
-    if (value === undefined) throw new TypeError("value is not JSON: undefined");
-    return JSON.stringify(value);
-  }
-  if (Array.isArray(value)) return "[" + value.map(canonicalJson).join(",") + "]";
-  const keys = Object.keys(value).sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
-  return "{" + keys.map((k) => JSON.stringify(k) + ":" + canonicalJson(value[k])).join(",") + "}";
-}
-
-const subtle = () => globalThis.crypto.subtle;
-const hex = (buf) => Array.from(new Uint8Array(buf), (b) => b.toString(16).padStart(2, "0")).join("");
-
-export async function sha256Hex(text) {
-  return hex(await subtle().digest("SHA-256", new TextEncoder().encode(text)));
-}
-
-export async function argsSha256(args) {
-  return sha256Hex(canonicalJson(args));
-}
-
-/** Import an approver key from the JSON `gargoyle init` wrote: {kty:"OKP", crv:"Ed25519", d, x}. */
-export async function importApproverKey(jwk) {
-  return subtle().importKey("jwk", { kty: "OKP", crv: "Ed25519", d: jwk.d, x: jwk.x }, { name: "Ed25519" }, false, ["sign"]);
-}
-
-export function buildGrant({ decisionSha256, approvalRequestId, grantId, notAfter }) {
-  if (!grantId) throw new Error("grant_id is mandatory");
-  return { grant_version: "1.0", decision_sha256: decisionSha256, approval_request_id: approvalRequestId, grant_id: grantId, not_after: notAfter };
-}
-
-export async function signGrant(grant, key, keyId) {
-  const signed = { ...grant, approver_key_id: keyId };
-  const region = {};
-  for (const [k, v] of Object.entries(signed)) if (k !== "approver_signature") region[k] = v;
-  const sig = await subtle().sign({ name: "Ed25519" }, key, new TextEncoder().encode(canonicalJson(region)));
-  signed.approver_signature = hex(sig);
-  return signed;
-}
-
-/** ISO-8601 with an explicit +00:00 offset, as the reference writes it. */
-export function isoUtc(date) {
-  return date.toISOString().replace(/\.\d{3}Z$/, "+00:00");
-}
-
-export function newGrantId() {
-  const b = new Uint8Array(16); globalThis.crypto.getRandomValues(b);
-  return hex(b.buffer);
-}