icdev 0.0.3__py3-none-any.whl

tools/scaffold/golden_path.py

@@ -0,0 +1,504 @@
+#!/usr/bin/env python3
+# CUI // SP-CTI
+"""Golden Path Self-Service Project Scaffolder.
+
+Provides built-in project templates (flask_api, fastapi_microservice, react_spa,
+freertos_firmware, data_pipeline) and scaffolds directory structures with stub
+files.  Records scaffold runs and project entries in icdev.db.
+"""
+
+import argparse
+import json
+import os
+import sqlite3
+import sys
+from datetime import datetime, timezone
+from pathlib import Path
+from uuid import uuid4
+
+BASE_DIR = Path(__file__).resolve().parent.parent.parent
+DB_PATH = BASE_DIR / "data" / "icdev.db"
+
+try:
+    from tools.compat.db_utils import get_db_connection
+except ImportError:
+    get_db_connection = None
+
+# ---------------------------------------------------------------------------
+# Template definitions (hardcoded)
+# ---------------------------------------------------------------------------
+
+TEMPLATES = {
+    "flask_api": {
+        "name": "flask_api",
+        "description": "Flask REST API with Dockerfile and test scaffolding",
+        "type": "webapp",
+        "default_il": "IL4",
+        "files": [
+            "src/app.py",
+            "src/routes/__init__.py",
+            "src/models/__init__.py",
+            "tests/__init__.py",
+            "tests/test_app.py",
+            "requirements.txt",
+            "Dockerfile",
+            "SECURITY.md",
+            ".well-known/security.txt",
+        ],
+    },
+    "fastapi_microservice": {
+        "name": "fastapi_microservice",
+        "description": "FastAPI microservice with routers, schemas, and Docker",
+        "type": "api",
+        "default_il": "IL4",
+        "files": [
+            "src/main.py",
+            "src/routers/__init__.py",
+            "src/schemas/__init__.py",
+            "tests/__init__.py",
+            "tests/test_main.py",
+            "requirements.txt",
+            "Dockerfile",
+            "SECURITY.md",
+            ".well-known/security.txt",
+        ],
+    },
+    "react_spa": {
+        "name": "react_spa",
+        "description": "React TypeScript single-page application",
+        "type": "webapp",
+        "default_il": "IL2",
+        "files": [
+            "src/App.tsx",
+            "src/components/.gitkeep",
+            "src/pages/.gitkeep",
+            "package.json",
+            "tsconfig.json",
+            "SECURITY.md",
+            ".well-known/security.txt",
+        ],
+    },
+    "freertos_firmware": {
+        "name": "freertos_firmware",
+        "description": "FreeRTOS firmware project with CMake and task scaffolding",
+        "type": "firmware",
+        "default_il": "IL4",
+        "files": [
+            "src/main.c",
+            "src/tasks/.gitkeep",
+            "include/.gitkeep",
+            "CMakeLists.txt",
+            "FreeRTOSConfig.h",
+            "SECURITY.md",
+            ".well-known/security.txt",
+        ],
+    },
+    "data_pipeline": {
+        "name": "data_pipeline",
+        "description": "Python data pipeline with transforms and connectors",
+        "type": "pipeline",
+        "default_il": "IL2",
+        "files": [
+            "src/pipeline.py",
+            "src/transforms/__init__.py",
+            "src/connectors/__init__.py",
+            "tests/__init__.py",
+            "tests/test_pipeline.py",
+            "requirements.txt",
+            "SECURITY.md",
+            ".well-known/security.txt",
+        ],
+    },
+}
+
+
+# ---------------------------------------------------------------------------
+# SbD Inheritance: SECURITY.md + security.txt + gate config generators
+# (Cloudyrion P2: Holistic Security — every child app inherits SbD baseline)
+# ---------------------------------------------------------------------------
+
+def _generate_security_md(project_name):
+    """Generate a CISA SbD-compliant vulnerability disclosure policy."""
+    return f"""# CUI // SP-CTI
+# Security Policy — {project_name}
+
+## Reporting a Vulnerability
+
+- **Email:** security@icdev.ai
+- **Subject:** `[SECURITY][{project_name}] Brief description`
+
+### Response Timeline
+
+| Action | SLA |
+|--------|-----|
+| Acknowledgment | 24 hours |
+| Triage | 48 hours |
+| Critical remediation | 72 hours |
+| High remediation | 30 days |
+
+### Safe Harbor
+
+We will not pursue legal action against individuals who act in good faith
+to discover and report vulnerabilities following this policy.
+
+### Scope
+
+All components of {project_name} and its dependencies.
+
+### Coordinated Disclosure
+
+Per ISO/IEC 29147. CVEs issued with accurate CWE/CPE fields (CISA SbD Commitment 6).
+
+////////////////////////////////////////////////////////////////////
+CUI // SP-CTI | Department of Defense
+////////////////////////////////////////////////////////////////////
+"""
+
+
+def _generate_security_txt(project_name):
+    """Generate RFC 9116 security.txt for .well-known/."""
+    return f"""# {project_name} Security Contact
+# Per RFC 9116 (security.txt)
+
+Contact: mailto:security@icdev.ai
+Preferred-Languages: en
+Policy: https://github.com/icdev-ai/{project_name}/blob/main/SECURITY.md
+"""
+
+
+def _generate_sbd_gate_config(impact_level):
+    """Generate SbD gate configuration for child app (YAML-formatted string)."""
+    return f"""# CUI // SP-CTI
+# Secure by Design Gate Configuration
+# Auto-generated by Golden Path Scaffolder
+# Impact Level: {impact_level}
+
+sbd:
+  blocking:
+    - critical_sbd_requirements_not_satisfied
+    - default_credentials_detected
+    - no_mfa_configured
+    - no_vulnerability_disclosure_policy
+    - stack_traces_in_production
+  thresholds:
+    min_satisfied_pct: 80
+    max_critical_not_satisfied: 0
+    sbom_max_age_days: 30
+    exception_max_age_days: 90
+"""
+
+
+# ---------------------------------------------------------------------------
+# Database helpers
+# ---------------------------------------------------------------------------
+
+def _get_connection(db_path=None):
+    """Get a database connection with row factory."""
+    if get_db_connection:
+        return get_db_connection(db_path or DB_PATH, validate=True)
+    path = db_path or DB_PATH
+    if not Path(path).exists():
+        raise FileNotFoundError(
+            f"Database not found: {path}\n"
+            "Run: python tools/db/init_icdev_db.py"
+        )
+    conn = sqlite3.connect(str(path))
+    conn.row_factory = sqlite3.Row
+    return conn
+
+
+def _ensure_tables(conn):
+    """Create tables if they do not exist."""
+    conn.execute("""
+        CREATE TABLE IF NOT EXISTS scaffold_runs (
+            id TEXT PRIMARY KEY,
+            project_name TEXT NOT NULL,
+            template TEXT NOT NULL,
+            impact_level TEXT NOT NULL,
+            output_dir TEXT NOT NULL,
+            files_created TEXT NOT NULL,
+            status TEXT NOT NULL DEFAULT 'pending',
+            created_at TEXT NOT NULL,
+            completed_at TEXT
+        )
+    """)
+    conn.execute("""
+        CREATE TABLE IF NOT EXISTS projects (
+            id TEXT PRIMARY KEY,
+            name TEXT NOT NULL,
+            impact_level TEXT,
+            status TEXT NOT NULL DEFAULT 'active',
+            created_at TEXT NOT NULL
+        )
+    """)
+    conn.commit()
+
+
+def _log_audit(conn, event_type, action, details, project_id=None):
+    """Append an audit trail entry (immutable — INSERT only)."""
+    try:
+        conn.execute(
+            """INSERT INTO audit_trail
+               (project_id, event_type, actor, action, details, classification)
+               VALUES (?, ?, ?, ?, ?, ?)""",
+            (
+                project_id or "",
+                event_type,
+                "icdev-scaffold-engine",
+                action,
+                json.dumps(details),
+                "CUI",
+            ),
+        )
+        conn.commit()
+    except Exception as exc:
+        print(f"Warning: audit log failed: {exc}", file=sys.stderr)
+
+
+# ---------------------------------------------------------------------------
+# Public API
+# ---------------------------------------------------------------------------
+
+def list_templates(db_path=None):
+    """Return built-in project templates.
+
+    Returns:
+        {"templates": [...], "count": 5}
+    """
+    templates = []
+    for tmpl in TEMPLATES.values():
+        templates.append({
+            "name": tmpl["name"],
+            "description": tmpl["description"],
+            "type": tmpl["type"],
+            "default_il": tmpl["default_il"],
+            "files": tmpl["files"],
+        })
+    return {"templates": templates, "count": len(templates)}
+
+
+def scaffold_project(template_name, project_name, impact_level="IL4",
+                     output_dir=None, db_path=None):
+    """Create project directory structure from a template.
+
+    Steps:
+      (a) Create output_dir/{project_name}/
+      (b) Create subdirs based on template
+      (c) Create stub files
+      (d) INSERT into scaffold_runs
+      (e) INSERT project record into projects table
+
+    Returns:
+        {"id", "project_name", "template", "output_dir", "files_created",
+         "status": "completed"}
+    """
+    if template_name not in TEMPLATES:
+        return {
+            "error": f"Unknown template: {template_name}",
+            "available": list(TEMPLATES.keys()),
+        }
+
+    tmpl = TEMPLATES[template_name]
+    now = datetime.now(timezone.utc).isoformat()
+    run_id = uuid4().hex[:12]
+
+    # Resolve output directory
+    if output_dir is None:
+        output_dir = str(BASE_DIR / ".tmp" / "scaffold")
+    project_root = Path(output_dir) / project_name
+    project_root.mkdir(parents=True, exist_ok=True)
+
+    # Create stub files and directories
+    files_created = []
+    for rel_path in tmpl["files"]:
+        full_path = project_root / rel_path
+        full_path.parent.mkdir(parents=True, exist_ok=True)
+        if not full_path.exists():
+            if rel_path == "SECURITY.md":
+                full_path.write_text(
+                    _generate_security_md(project_name),
+                    encoding="utf-8",
+                )
+            elif rel_path == ".well-known/security.txt":
+                full_path.write_text(
+                    _generate_security_txt(project_name),
+                    encoding="utf-8",
+                )
+            else:
+                full_path.write_text(
+                    f"# CUI // SP-CTI\n# Auto-generated stub: {rel_path}\n",
+                    encoding="utf-8",
+                )
+        files_created.append(rel_path)
+
+    # Also create standard dirs: goals/, tools/
+    for extra_dir in ["goals", "tools"]:
+        (project_root / extra_dir).mkdir(parents=True, exist_ok=True)
+
+    # Create .gitignore and README.md stubs
+    gitignore_path = project_root / ".gitignore"
+    if not gitignore_path.exists():
+        gitignore_path.write_text(
+            "__pycache__/\n*.pyc\n.env\n.tmp/\nnode_modules/\nbuild/\n",
+            encoding="utf-8",
+        )
+        files_created.append(".gitignore")
+
+    readme_path = project_root / "README.md"
+    if not readme_path.exists():
+        readme_path.write_text(
+            f"# {project_name}\n\nCUI // SP-CTI\n\n"
+            f"Generated from `{template_name}` template.\n",
+            encoding="utf-8",
+        )
+        files_created.append("README.md")
+
+    # SbD gate configuration (Cloudyrion P2: child app SbD inheritance)
+    args_dir = project_root / "args"
+    args_dir.mkdir(parents=True, exist_ok=True)
+    sbd_gate_path = args_dir / "sbd_gates.yaml"
+    if not sbd_gate_path.exists():
+        sbd_gate_path.write_text(
+            _generate_sbd_gate_config(impact_level),
+            encoding="utf-8",
+        )
+        files_created.append("args/sbd_gates.yaml")
+
+    # Database records
+    conn = _get_connection(db_path)
+    try:
+        _ensure_tables(conn)
+
+        # Insert scaffold run
+        conn.execute(
+            """INSERT INTO scaffold_runs
+               (id, project_name, template, impact_level, output_dir,
+                files_created, status, created_at, completed_at)
+               VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)""",
+            (
+                run_id,
+                project_name,
+                template_name,
+                impact_level,
+                str(project_root),
+                json.dumps(files_created),
+                "completed",
+                now,
+                now,
+            ),
+        )
+
+        # Insert project record (ignore if name already exists)
+        project_id = uuid4().hex[:12]
+        try:
+            conn.execute(
+                """INSERT INTO projects (id, name, impact_level, status, created_at)
+                   VALUES (?, ?, ?, ?, ?)""",
+                (project_id, project_name, impact_level, "active", now),
+            )
+        except sqlite3.IntegrityError:
+            # Project name already exists
+            project_id = None
+
+        conn.commit()
+
+        _log_audit(conn, "scaffold_created", "scaffold_project",
+                   {"run_id": run_id, "template": template_name,
+                    "project_name": project_name},
+                   project_id=project_id or project_name)
+        _log_audit(conn, "scaffold_completed", "scaffold_project",
+                   {"run_id": run_id, "files_created": len(files_created)},
+                   project_id=project_id or project_name)
+    finally:
+        conn.close()
+
+    return {
+        "id": run_id,
+        "project_name": project_name,
+        "template": template_name,
+        "output_dir": str(project_root),
+        "files_created": files_created,
+        "status": "completed",
+    }
+
+
+def get_run(run_id, db_path=None):
+    """Get scaffold run details.
+
+    Returns:
+        dict with run details or {"error": "..."} if not found.
+    """
+    conn = _get_connection(db_path)
+    try:
+        _ensure_tables(conn)
+        row = conn.execute(
+            "SELECT * FROM scaffold_runs WHERE id = ?", (run_id,)
+        ).fetchone()
+        if not row:
+            return {"error": f"Scaffold run not found: {run_id}"}
+        result = dict(row)
+        result["files_created"] = json.loads(result["files_created"])
+        return result
+    finally:
+        conn.close()
+
+
+# ---------------------------------------------------------------------------
+# CLI
+# ---------------------------------------------------------------------------
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="Golden Path Self-Service Project Scaffolder"
+    )
+    parser.add_argument("--json", action="store_true",
+                        help="Output as JSON")
+
+    group = parser.add_mutually_exclusive_group(required=True)
+    group.add_argument("--list", action="store_true",
+                       help="List available templates")
+    group.add_argument("--scaffold", action="store_true",
+                       help="Scaffold a new project")
+    group.add_argument("--get", action="store_true",
+                       help="Get scaffold run details")
+
+    parser.add_argument("--template", type=str,
+                        help="Template name (for --scaffold)")
+    parser.add_argument("--project-name", type=str,
+                        help="Project name (for --scaffold)")
+    parser.add_argument("--impact-level", type=str, default="IL4",
+                        help="Impact level (default: IL4)")
+    parser.add_argument("--output-dir", type=str, default=None,
+                        help="Output directory (for --scaffold)")
+    parser.add_argument("--run-id", type=str,
+                        help="Run ID (for --get)")
+
+    args = parser.parse_args()
+
+    if args.list:
+        result = list_templates()
+    elif args.scaffold:
+        if not args.template or not args.project_name:
+            parser.error("--scaffold requires --template and --project-name")
+        result = scaffold_project(
+            args.template, args.project_name,
+            impact_level=args.impact_level,
+            output_dir=args.output_dir,
+        )
+    elif args.get:
+        if not args.run_id:
+            parser.error("--get requires --run-id")
+        result = get_run(args.run_id)
+    else:
+        parser.print_help()
+        sys.exit(1)
+
+    if args.json:
+        print(json.dumps(result, indent=2, default=str))
+    else:
+        for key, val in result.items():
+            print(f"  {key}: {val}")
+
+
+if __name__ == "__main__":
+    main()

tools/security/__init__.py

@@ -0,0 +1 @@
+# [TEMPLATE: CUI // SP-CTI]