icdev 0.0.3__py3-none-any.whl

tools/cloudforge/runbooks/snippet_library.py

@@ -0,0 +1,158 @@
+# CUI // SP-CTI
+"""Snippet library — reusable sub-DAG task sequences.
+
+Design decision D-CF-22: Snippets are self-contained sub-DAGs embedded by reference.
+Usage count tracked for popularity metrics.
+"""
+
+import json
+import logging
+import sqlite3
+import uuid
+from pathlib import Path
+from typing import Any, Dict, List, Optional
+
+from tools.cloudforge.runbooks.dag_validator import validate_dag
+from tools.cloudforge.runbooks.models import (
+    RunbookEdge,
+    RunbookTask,
+    edges_to_json,
+    tasks_to_json,
+)
+
+logger = logging.getLogger(__name__)
+
+BASE_DIR = Path(__file__).resolve().parent.parent.parent.parent
+DB_PATH = BASE_DIR / "data" / "icdev.db"
+
+
+def _get_db() -> sqlite3.Connection:
+    conn = sqlite3.connect(str(DB_PATH))
+    conn.row_factory = sqlite3.Row
+    return conn
+
+
+def create_snippet(
+    name: str,
+    category: str,
+    tasks: List[Dict[str, Any]],
+    edges: List[Dict[str, Any]],
+    description: str = "",
+    tenant_id: str = "default",
+    created_by: str = "cloudforge",
+) -> Dict[str, Any]:
+    """Create a reusable snippet (sub-DAG)."""
+    task_objs = [RunbookTask.from_dict(t) for t in tasks]
+    edge_objs = [RunbookEdge.from_dict(e) for e in edges]
+
+    validation = validate_dag(task_objs, edge_objs)
+    if not validation["valid"]:
+        return {"status": "error", "errors": validation["errors"]}
+
+    snippet_id = f"snp-{uuid.uuid4().hex[:8]}"
+    conn = _get_db()
+    try:
+        conn.execute(
+            """INSERT INTO cf_runbook_snippets
+               (id, name, description, category, tasks_json, edges_json,
+                classification, tenant_id, created_by,
+                created_at, updated_at)
+               VALUES (?, ?, ?, ?, ?, ?, 'CUI // SP-CTI', ?, ?,
+                       datetime('now'), datetime('now'))""",
+            (
+                snippet_id, name, description, category,
+                tasks_to_json(task_objs), edges_to_json(edge_objs),
+                tenant_id, created_by,
+            ),
+        )
+        conn.commit()
+        return {"status": "ok", "id": snippet_id, "name": name, "category": category}
+    except sqlite3.IntegrityError as exc:
+        return {"status": "error", "errors": [str(exc)]}
+    finally:
+        conn.close()
+
+
+def list_snippets(
+    tenant_id: str = "default",
+    category: Optional[str] = None,
+) -> List[Dict[str, Any]]:
+    """List all snippets, optionally filtered by category."""
+    conn = _get_db()
+    try:
+        query = "SELECT * FROM cf_runbook_snippets WHERE tenant_id = ?"
+        params: list = [tenant_id]
+        if category:
+            query += " AND category = ?"
+            params.append(category)
+        query += " ORDER BY usage_count DESC, name ASC"
+        rows = conn.execute(query, params).fetchall()
+        return [dict(r) for r in rows]
+    finally:
+        conn.close()
+
+
+def get_snippet(snippet_id: str) -> Optional[Dict[str, Any]]:
+    """Get a snippet by ID with parsed tasks/edges."""
+    conn = _get_db()
+    try:
+        row = conn.execute(
+            "SELECT * FROM cf_runbook_snippets WHERE id = ?", (snippet_id,)
+        ).fetchone()
+        if not row:
+            return None
+        d = dict(row)
+        d["tasks"] = json.loads(d["tasks_json"])
+        d["edges"] = json.loads(d["edges_json"])
+        return d
+    finally:
+        conn.close()
+
+
+def embed_snippet(
+    snippet_id: str,
+    runbook_tasks: List[Dict[str, Any]],
+    runbook_edges: List[Dict[str, Any]],
+    prefix: str = "",
+) -> Dict[str, Any]:
+    """Embed a snippet's tasks/edges into a runbook, with ID prefixing to avoid collisions.
+
+    Returns updated tasks and edges lists ready for runbook creation.
+    """
+    snippet = get_snippet(snippet_id)
+    if not snippet:
+        return {"status": "error", "errors": ["Snippet not found"]}
+
+    pfx = prefix or f"snp-{snippet_id[-8:]}-"
+
+    # Prefix snippet task IDs
+    new_tasks = []
+    for t in snippet["tasks"]:
+        t_copy = dict(t)
+        t_copy["id"] = pfx + t_copy["id"]
+        new_tasks.append(t_copy)
+
+    new_edges = []
+    for e in snippet["edges"]:
+        e_copy = dict(e)
+        e_copy["source"] = pfx + e_copy["source"]
+        e_copy["target"] = pfx + e_copy["target"]
+        new_edges.append(e_copy)
+
+    # Increment usage count
+    conn = _get_db()
+    try:
+        conn.execute(
+            "UPDATE cf_runbook_snippets SET usage_count = usage_count + 1, updated_at = datetime('now') WHERE id = ?",
+            (snippet_id,),
+        )
+        conn.commit()
+    finally:
+        conn.close()
+
+    return {
+        "status": "ok",
+        "tasks": runbook_tasks + new_tasks,
+        "edges": runbook_edges + new_edges,
+        "snippet_tasks_added": len(new_tasks),
+    }

tools/cloudforge/runbooks/template_loader.py

@@ -0,0 +1,122 @@
+# CUI // SP-CTI
+"""Template loader — load YAML runbook templates from args/cloudforge_runbook_templates/.
+
+Design decision D-CF-29: YAML templates in args/ directory (GOTCHA args layer).
+Follows blueprint_loader.py pattern.
+"""
+
+import json
+import logging
+from pathlib import Path
+from typing import Any, Dict, List, Optional
+
+logger = logging.getLogger(__name__)
+
+try:
+    import yaml
+except ImportError:
+    yaml = None
+
+BASE_DIR = Path(__file__).resolve().parent.parent.parent.parent
+TEMPLATE_DIR = BASE_DIR / "args" / "cloudforge_runbook_templates"
+
+
+def _load_yaml(path: Path) -> Dict[str, Any]:
+    """Load a YAML file, with fallback for missing PyYAML."""
+    if yaml:
+        with open(path, encoding="utf-8") as f:
+            return yaml.safe_load(f) or {}
+    logger.warning("PyYAML not available — returning empty config for %s", path.name)
+    return {}
+
+
+def list_templates() -> List[Dict[str, str]]:
+    """List all available runbook templates."""
+    if not TEMPLATE_DIR.exists():
+        return []
+    templates = []
+    for f in sorted(TEMPLATE_DIR.glob("*.yaml")):
+        data = _load_yaml(f)
+        templates.append({
+            "name": f.stem,
+            "file": str(f),
+            "description": data.get("description", ""),
+            "category": data.get("category", "custom"),
+            "tasks_count": len(data.get("tasks", [])),
+            "estimated_duration_minutes": data.get("estimated_duration_minutes", 0),
+        })
+    return templates
+
+
+def load_template(name: str) -> Optional[Dict[str, Any]]:
+    """Load a specific runbook template by name (without .yaml extension)."""
+    path = TEMPLATE_DIR / f"{name}.yaml"
+    if not path.exists():
+        logger.error("Template not found: %s", path)
+        return None
+    data = _load_yaml(path)
+    data["_template_name"] = name
+    data["_template_path"] = str(path)
+    return data
+
+
+def instantiate_template(
+    name: str,
+    overrides: Optional[Dict[str, Any]] = None,
+) -> Optional[Dict[str, Any]]:
+    """Load a template and apply parameter overrides.
+
+    Returns dict ready for create_runbook() with tasks and edges.
+    """
+    template = load_template(name)
+    if not template:
+        return None
+
+    params = template.get("parameters", {})
+    if overrides:
+        params.update(overrides)
+
+    # Apply parameter substitution to task fields
+    tasks = template.get("tasks", [])
+    edges = template.get("edges", [])
+
+    for task in tasks:
+        for key, value in task.get("parameters", {}).items():
+            if isinstance(value, str) and value.startswith("${") and value.endswith("}"):
+                param_name = value[2:-1]
+                if param_name in params:
+                    task["parameters"][key] = params[param_name]
+
+    return {
+        "name": template.get("name", name),
+        "description": template.get("description", ""),
+        "template_source": name,
+        "tasks": tasks,
+        "edges": edges,
+        "tags": template.get("tags", ""),
+    }
+
+
+if __name__ == "__main__":
+    import argparse
+
+    parser = argparse.ArgumentParser(description="CloudForge Runbook Template Loader")
+    parser.add_argument("--list", action="store_true", help="List templates")
+    parser.add_argument("--load", help="Load template by name")
+    parser.add_argument("--json", action="store_true", help="JSON output")
+    args = parser.parse_args()
+
+    if args.list:
+        results = list_templates()
+        if args.json:
+            print(json.dumps(results, indent=2))
+        else:
+            print(f"Templates: {len(results)}")
+            for t in results:
+                print(f"  {t['name']}: {t['description']} ({t['tasks_count']} tasks)")
+    elif args.load:
+        tmpl = load_template(args.load)
+        print(json.dumps(tmpl, indent=2) if tmpl else "Not found")
+    else:
+        results = list_templates()
+        print(json.dumps(results, indent=2) if args.json else f"Templates: {len(results)}")

tools/cloudforge/runbooks/visualization.py

@@ -0,0 +1,108 @@
+# CUI // SP-CTI
+"""DAG visualization — convert runbook DAG to JSON node-map for dashboard rendering."""
+
+import json
+import logging
+from typing import Any, Dict, List
+
+from tools.cloudforge.runbooks.models import edges_from_json, tasks_from_json
+
+logger = logging.getLogger(__name__)
+
+
+def runbook_to_vis_json(runbook: Dict[str, Any]) -> Dict[str, Any]:
+    """Convert a runbook dict to a visualization-ready JSON structure.
+
+    Output format suitable for D3.js force-directed graph or dagre layout:
+    {
+        "nodes": [{"id": "t1", "name": "...", "action": "...", "level": 0}, ...],
+        "links": [{"source": "t1", "target": "t2", "label": "..."}, ...],
+        "levels": [[task_ids at level 0], [task_ids at level 1], ...]
+    }
+    """
+    tasks = tasks_from_json(runbook.get("tasks_json", "[]"))
+    edges = edges_from_json(runbook.get("edges_json", "[]"))
+
+    # Build adjacency and compute levels via BFS
+    in_degree: Dict[str, int] = {t.id: 0 for t in tasks}
+    adjacency: Dict[str, List[str]] = {t.id: [] for t in tasks}
+
+    for e in edges:
+        if e.source in adjacency and e.target in in_degree:
+            adjacency[e.source].append(e.target)
+            in_degree[e.target] += 1
+
+    # BFS level assignment
+    levels: Dict[str, int] = {}
+    queue = [t.id for t in tasks if in_degree[t.id] == 0]
+    current_level = 0
+    level_groups: List[List[str]] = []
+
+    while queue:
+        level_groups.append(list(queue))
+        next_queue = []
+        for node in queue:
+            levels[node] = current_level
+            for neighbor in adjacency.get(node, []):
+                in_degree[neighbor] -= 1
+                if in_degree[neighbor] == 0:
+                    next_queue.append(neighbor)
+        queue = next_queue
+        current_level += 1
+
+    # Build nodes
+    task_map = {t.id: t for t in tasks}
+    nodes = []
+    for t in tasks:
+        nodes.append({
+            "id": t.id,
+            "name": t.name,
+            "action": t.action,
+            "description": t.description,
+            "level": levels.get(t.id, 0),
+            "on_failure": t.on_failure,
+            "has_condition": t.condition is not None,
+        })
+
+    # Build links
+    links = []
+    for e in edges:
+        links.append({
+            "source": e.source,
+            "target": e.target,
+            "label": e.label,
+            "has_condition": e.condition is not None,
+        })
+
+    return {
+        "nodes": nodes,
+        "links": links,
+        "levels": level_groups,
+        "total_tasks": len(nodes),
+        "total_edges": len(links),
+        "max_depth": len(level_groups),
+    }
+
+
+def execution_to_vis_json(execution: Dict[str, Any]) -> Dict[str, Any]:
+    """Convert execution detail to visualization-ready JSON with task statuses."""
+    task_log = execution.get("task_log", [])
+    task_status: Dict[str, str] = {}
+    task_duration: Dict[str, int] = {}
+
+    for log in task_log:
+        tid = log["task_id"]
+        action = log["action"]
+        if action in ("completed", "failed", "skipped"):
+            task_status[tid] = action
+            task_duration[tid] = log.get("duration_ms", 0)
+        elif action == "started" and tid not in task_status:
+            task_status[tid] = "running"
+
+    return {
+        "execution_id": execution.get("id", ""),
+        "status": execution.get("status", ""),
+        "task_statuses": task_status,
+        "task_durations": task_duration,
+        "duration_ms": execution.get("duration_ms", 0),
+    }

tools/cloudforge/siem/__init__.py

@@ -0,0 +1,2 @@
+# CUI // SP-CTI
+"""CloudForge Cross-Cloud SIEM — log aggregation, correlation, alerting."""

tools/cloudforge/siem/alert_rules.py

@@ -0,0 +1,86 @@
+# CUI // SP-CTI
+"""Alert rules — rule-based alerting for SIEM events."""
+
+import json
+import logging
+from typing import Any, Dict, List
+
+logger = logging.getLogger(__name__)
+
+DEFAULT_RULES: List[Dict[str, Any]] = [
+    {
+        "id": "ALERT-001",
+        "name": "Critical Security Event",
+        "condition": "severity == 'critical'",
+        "action": "immediate_notify",
+        "enabled": True,
+    },
+    {
+        "id": "ALERT-002",
+        "name": "Unauthorized Access Attempt",
+        "condition": "event_type == 'unauthorized_access'",
+        "action": "notify_and_block",
+        "enabled": True,
+    },
+    {
+        "id": "ALERT-003",
+        "name": "Configuration Change",
+        "condition": "event_type == 'config_change' AND severity >= 'medium'",
+        "action": "notify",
+        "enabled": True,
+    },
+    {
+        "id": "ALERT-004",
+        "name": "Cross-Cloud Correlation",
+        "condition": "correlated_event_id IS NOT NULL AND severity >= 'high'",
+        "action": "escalate",
+        "enabled": True,
+    },
+]
+
+
+def evaluate_rules(event: Dict[str, Any]) -> List[Dict[str, Any]]:
+    """Evaluate alert rules against an event."""
+    fired = []
+    severity = event.get("severity", "info")
+    event_type = event.get("event_type", "")
+
+    for rule in DEFAULT_RULES:
+        if not rule["enabled"]:
+            continue
+
+        matched = False
+        if rule["id"] == "ALERT-001" and severity == "critical":
+            matched = True
+        elif rule["id"] == "ALERT-002" and event_type == "unauthorized_access":
+            matched = True
+        elif rule["id"] == "ALERT-003" and event_type == "config_change" and severity in ("medium", "high", "critical"):
+            matched = True
+        elif rule["id"] == "ALERT-004" and event.get("correlated_event_id") and severity in ("high", "critical"):
+            matched = True
+
+        if matched:
+            fired.append({
+                "rule_id": rule["id"],
+                "rule_name": rule["name"],
+                "action": rule["action"],
+            })
+
+    return fired
+
+
+def list_rules() -> List[Dict[str, Any]]:
+    """List all alert rules."""
+    return DEFAULT_RULES
+
+
+if __name__ == "__main__":
+    import argparse
+    parser = argparse.ArgumentParser(description="CloudForge Alert Rules")
+    parser.add_argument("--list", action="store_true")
+    parser.add_argument("--json", action="store_true")
+    args = parser.parse_args()
+    if args.list:
+        print(json.dumps(list_rules(), indent=2))
+    else:
+        parser.print_help()

tools/cloudforge/siem/correlation_engine.py

@@ -0,0 +1,61 @@
+# CUI // SP-CTI
+"""Correlation engine — cross-cloud event correlation."""
+
+import json
+import logging
+import sqlite3
+from pathlib import Path
+from typing import Any, Dict, List
+
+logger = logging.getLogger(__name__)
+
+BASE_DIR = Path(__file__).resolve().parent.parent.parent.parent
+DB_PATH = BASE_DIR / "data" / "icdev.db"
+
+
+def _get_db() -> sqlite3.Connection:
+    conn = sqlite3.connect(str(DB_PATH))
+    conn.row_factory = sqlite3.Row
+    return conn
+
+
+def correlate_events(window_minutes: int = 15) -> List[Dict[str, Any]]:
+    """Find correlated events within a time window across clouds."""
+    conn = _get_db()
+    try:
+        # Find events from different clouds within the time window
+        rows = conn.execute(
+            """SELECT a.id as event_a, b.id as event_b,
+                      a.cloud_type as cloud_a, b.cloud_type as cloud_b,
+                      a.event_type as type_a, b.event_type as type_b,
+                      a.severity as sev_a, b.severity as sev_b,
+                      a.event_time as time_a, b.event_time as time_b
+               FROM cf_siem_events a
+               JOIN cf_siem_events b ON a.id < b.id
+               WHERE a.cloud_type != b.cloud_type
+               AND abs(julianday(a.event_time) - julianday(b.event_time)) * 1440 <= ?
+               AND (a.severity IN ('high', 'critical') OR b.severity IN ('high', 'critical'))
+               ORDER BY a.event_time DESC
+               LIMIT 50""",
+            (window_minutes,),
+        ).fetchall()
+
+        correlations = [dict(r) for r in rows]
+        return correlations
+    except Exception:
+        return []
+    finally:
+        conn.close()
+
+
+if __name__ == "__main__":
+    import argparse
+    parser = argparse.ArgumentParser(description="CloudForge Correlation Engine")
+    parser.add_argument("--correlate", action="store_true")
+    parser.add_argument("--window", type=int, default=15)
+    parser.add_argument("--json", action="store_true")
+    args = parser.parse_args()
+    if args.correlate:
+        print(json.dumps(correlate_events(args.window), indent=2, default=str))
+    else:
+        parser.print_help()

tools/cloudforge/siem/log_aggregator.py

@@ -0,0 +1,113 @@
+# CUI // SP-CTI
+"""Log aggregator — aggregate logs from all CSPs via DataBridge connectors (D-CF-10)."""
+
+import json
+import logging
+import sqlite3
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any, Dict, List
+
+logger = logging.getLogger(__name__)
+
+BASE_DIR = Path(__file__).resolve().parent.parent.parent.parent
+DB_PATH = BASE_DIR / "data" / "icdev.db"
+
+
+def _get_db() -> sqlite3.Connection:
+    conn = sqlite3.connect(str(DB_PATH))
+    conn.row_factory = sqlite3.Row
+    return conn
+
+
+def ingest_event(
+    zone_id: str,
+    cloud_type: str,
+    event_source: str,
+    event_type: str,
+    severity: str = "info",
+    raw_event: Dict[str, Any] = None,
+) -> Dict[str, Any]:
+    """Ingest a SIEM event (append-only)."""
+    now = datetime.now(timezone.utc).isoformat()
+    conn = _get_db()
+    try:
+        conn.execute(
+            """INSERT INTO cf_siem_events
+               (zone_id, cloud_type, event_source, event_type, severity,
+                raw_event_json, event_time, classification, ingested_at)
+               VALUES (?, ?, ?, ?, ?, ?, ?, 'CUI // SP-CTI', datetime('now'))""",
+            (zone_id, cloud_type, event_source, event_type, severity,
+             json.dumps(raw_event or {}), now),
+        )
+        conn.commit()
+        return {"status": "ok", "event_time": now, "severity": severity}
+    finally:
+        conn.close()
+
+
+def query_events(
+    zone_id: str = "",
+    severity: str = "",
+    limit: int = 100,
+) -> List[Dict[str, Any]]:
+    """Query SIEM events with optional filters."""
+    conn = _get_db()
+    try:
+        query = "SELECT * FROM cf_siem_events WHERE 1=1"
+        params: list = []
+        if zone_id:
+            query += " AND zone_id = ?"
+            params.append(zone_id)
+        if severity:
+            query += " AND severity = ?"
+            params.append(severity)
+        query += " ORDER BY event_time DESC LIMIT ?"
+        params.append(limit)
+
+        rows = conn.execute(query, params).fetchall()
+        return [dict(r) for r in rows]
+    except Exception:
+        return []
+    finally:
+        conn.close()
+
+
+def get_event_summary() -> Dict[str, Any]:
+    """Get SIEM event summary by severity."""
+    conn = _get_db()
+    try:
+        rows = conn.execute(
+            """SELECT severity, COUNT(*) as count
+               FROM cf_siem_events GROUP BY severity"""
+        ).fetchall()
+        summary = {r["severity"]: r["count"] for r in rows}
+        return {
+            "status": "ok",
+            "total_events": sum(summary.values()),
+            "by_severity": summary,
+            "classification": "CUI // SP-CTI",
+        }
+    except Exception:
+        return {"status": "ok", "total_events": 0, "by_severity": {}}
+    finally:
+        conn.close()
+
+
+if __name__ == "__main__":
+    import argparse
+    parser = argparse.ArgumentParser(description="CloudForge Log Aggregator")
+    parser.add_argument("--query", action="store_true")
+    parser.add_argument("--summary", action="store_true")
+    parser.add_argument("--zone-id", default="")
+    parser.add_argument("--severity", default="")
+    parser.add_argument("--limit", type=int, default=100)
+    parser.add_argument("--json", action="store_true")
+    args = parser.parse_args()
+
+    if args.query:
+        print(json.dumps(query_events(args.zone_id, args.severity, args.limit), indent=2, default=str))
+    elif args.summary:
+        print(json.dumps(get_event_summary(), indent=2))
+    else:
+        parser.print_help()

tools/cloudforge/siem/siem_dashboard_data.py

@@ -0,0 +1,28 @@
+# CUI // SP-CTI
+"""SIEM dashboard data — aggregate data for dashboard charts."""
+
+import json
+import logging
+from typing import Any, Dict
+
+from tools.cloudforge.siem.log_aggregator import get_event_summary
+from tools.cloudforge.siem.alert_rules import list_rules
+
+logger = logging.getLogger(__name__)
+
+
+def get_dashboard_data() -> Dict[str, Any]:
+    """Get all SIEM data needed for the dashboard."""
+    summary = get_event_summary()
+    rules = list_rules()
+    return {
+        "status": "ok",
+        "event_summary": summary,
+        "alert_rules": rules,
+        "active_rule_count": sum(1 for r in rules if r["enabled"]),
+        "classification": "CUI // SP-CTI",
+    }
+
+
+if __name__ == "__main__":
+    print(json.dumps(get_dashboard_data(), indent=2))

tools/cloudforge/supply_chain/__init__.py

@@ -0,0 +1,2 @@
+# CUI // SP-CTI
+"""CloudForge Supply Chain Intel — IaC dependency scanning, provider trust scoring."""