msgctl 0.1.0a1__py3-none-any.whl

msg/admin/money.py

@@ -0,0 +1,322 @@
+"""Physical-console central bank operations. Never register these as network ops."""
+from __future__ import annotations
+
+import asyncio
+import getpass
+import re
+from decimal import Decimal
+from uuid import uuid4
+
+from msg.admin.root import require_local_console, root_envelope
+from msg.constants import ROOT_SUBJECT
+from msg.core.codec import canonical, digest, loads, wire
+from msg.core.errors import require
+from msg.core.models import AuditEvent, Event, ResourceRef
+from msg.plugins.money import (
+    CURRENCY_ID,
+    MAX_MINOR,
+    SCALE,
+    _balance,
+    _post_entry,
+    _supply,
+)
+from msg.plugins.offers import validate_local_offer
+from msg.security.crypto import Ed25519Signer, open_private_key
+
+
+def parse_amount(value: str) -> int:
+    """Parse a displayed MSG amount without binary floats or silent rounding."""
+    require(isinstance(value, str) and re.fullmatch(r'(?:0|[1-9][0-9]*)(?:\.[0-9]{1,6})?', value),
+            'invalid_money_amount')
+    minor = int(Decimal(value) * (10 ** SCALE))
+    require(0 < minor <= MAX_MINOR, 'invalid_money_amount')
+    return minor
+
+
+def _root_signer(app, signer):
+    require(isinstance(signer, Ed25519Signer) and
+            signer.public_key == app.certificates.root_public_key, 'root_key_mismatch')
+
+
+_OFFER_COLUMNS = ('offer_id', 'resource_kind', 'unit', 'price_minor', 'min_quantity',
+                  'max_quantity', 'entitlement_kind', 'duration_seconds', 'enabled',
+                  'price_revision')
+_UNSET = object()
+
+
+def _offer_snapshot(tx, offer_id):
+    row = tx.one('''SELECT offer_id,resource_kind,unit,price_minor,min_quantity,max_quantity,
+                         entitlement_kind,duration_seconds,enabled,price_revision
+                  FROM server_offers WHERE offer_id=?''', (offer_id,))
+    return dict(zip(_OFFER_COLUMNS, row)) if row else None
+
+
+async def apply_offer(app, signer, *, action: str, operator: str, offer_id: str,
+                      fields: dict | None = None, expected_offer=_UNSET):
+    """Root-signed local offer mutation; set remains Registry/fulfiller gated."""
+    _root_signer(app, signer)
+    require(action in {'set', 'disable'}, 'invalid_offer_action')
+    require(isinstance(offer_id, str) and
+            re.fullmatch(r'[a-zA-Z][a-zA-Z0-9_-]{0,79}', offer_id), 'invalid_offer_id')
+    if action == 'set':
+        require(isinstance(fields, dict) and set(fields) == {
+            'resource_kind', 'unit', 'price_minor', 'min_quantity',
+            'max_quantity', 'entitlement_kind', 'duration_seconds'}, 'invalid_offer_fields')
+        validate_local_offer(app, **fields)
+    else:
+        require(fields is None, 'invalid_offer_fields')
+    now = app.clock()
+    request_id = 'local_offer_' + uuid4().hex
+    async with app.metadata.transaction(write=True) as tx:
+        previous = _offer_snapshot(tx, offer_id)
+        if expected_offer is not _UNSET:
+            require(previous == expected_offer, 'offer_preview_stale')
+        if action == 'set':
+            validate_local_offer(app, **fields)
+            revision = 'price_' + uuid4().hex
+            tx.execute('''INSERT INTO server_offers
+                (offer_id,resource_kind,unit,price_minor,min_quantity,max_quantity,
+                 entitlement_kind,duration_seconds,enabled,price_revision)
+                VALUES (?,?,?,?,?,?,?,?,TRUE,?)
+                ON CONFLICT(offer_id) DO UPDATE SET
+                  resource_kind=excluded.resource_kind,unit=excluded.unit,
+                  price_minor=excluded.price_minor,min_quantity=excluded.min_quantity,
+                  max_quantity=excluded.max_quantity,entitlement_kind=excluded.entitlement_kind,
+                  duration_seconds=excluded.duration_seconds,enabled=TRUE,
+                  price_revision=excluded.price_revision''',
+                (offer_id, fields['resource_kind'], fields['unit'], fields['price_minor'],
+                 fields['min_quantity'], fields['max_quantity'], fields['entitlement_kind'],
+                 fields['duration_seconds'], revision), write=True)
+        else:
+            require(previous is not None, 'offer_not_found')
+            require(previous['enabled'], 'offer_already_disabled')
+            tx.execute('UPDATE server_offers SET enabled=FALSE WHERE offer_id=?',
+                       (offer_id,), write=True)
+        current = _offer_snapshot(tx, offer_id)
+        statement = {'action': 'offer_' + action, 'offer_id': offer_id,
+                     'before': previous, 'after': current, 'operator': operator,
+                     'request_id': request_id, 'time': wire(now)}
+        signature = wire(signer.sign(canonical(statement), purpose='money-admin'))
+        event = Event(id='audit_' + uuid4().hex, type='root.money.offer.' + action,
+                      time=now, request_id=request_id, actor=ROOT_SUBJECT,
+                      subject=ROOT_SUBJECT, resources=(ResourceRef(id=ROOT_SUBJECT),),
+                      data={**statement, 'root_signature': signature})
+        await tx.append_event(event)
+        await tx.append_audit(AuditEvent(event=event,
+            authority=(ResourceRef(id=app.certificates.root_certificate.resource_id),),
+            before_digest=digest(previous), after_digest=digest(current),
+            previous_digest=None, entry_digest='', result='offer_' + action))
+    return {'action': action, 'offer': current, 'audit_event_id': event.id}
+
+
+async def apply_money(app, signer, *, action: str, operator: str, amount_minor: int | None = None,
+                      subject_id: str | None = None, expected_state: dict | None = None):
+    """Internal local use case; callers must establish the OS-console boundary.
+
+    Each invocation creates a fresh local request id. PG serializes all writers,
+    so balance and supply checks are re-evaluated within the committing transaction.
+    """
+    _root_signer(app, signer)
+    require(action in {'mint', 'burn', 'transfer', 'bank_add', 'bank_remove', 'bank_fund'}, 'invalid_money_action')
+    if action in {'mint', 'burn', 'transfer', 'bank_fund'}:
+        require(type(amount_minor) is int and 0 < amount_minor <= MAX_MINOR, 'invalid_money_amount')
+    else:
+        require(amount_minor is None, 'invalid_money_amount')
+    if action in {'transfer', 'bank_add', 'bank_remove', 'bank_fund'}:
+        require(isinstance(subject_id, str) and subject_id not in {ROOT_SUBJECT, '@root'},
+                'invalid_money_recipient')
+    else:
+        require(subject_id is None, 'invalid_money_recipient')
+
+    request_id = 'local_money_' + uuid4().hex
+    now = app.clock()
+    async with app.metadata.transaction(write=True) as tx:
+        if subject_id is not None:
+            subject = await tx.subject(subject_id)
+            require(subject.kind in {'registered', 'custodial'} and not subject.local_only,
+                    'invalid_money_recipient')
+        before_supply = _supply(tx)
+        before_root = _balance(tx, ROOT_SUBJECT)
+        row = (tx.one('SELECT status FROM money_bank_roles WHERE subject_id=?', (subject_id,))
+               if action.startswith('bank_') else None)
+        before_role = row[0] if row else None
+        if expected_state is not None:
+            current = {'supply': before_supply, 'root': before_root,
+                       'subject': _balance(tx, subject_id) if subject_id else None,
+                       'role': before_role}
+            require(current == expected_state, 'money_preview_stale')
+        if action.startswith('bank_'):
+            require(action == 'bank_fund' or
+                    (action == 'bank_add' and before_role != 'active') or
+                    (action == 'bank_remove' and before_role == 'active'), 'bank_role_unchanged')
+            if action in {'bank_add', 'bank_fund'}:
+                tx.execute('''INSERT INTO money_bank_roles(subject_id,status,granted_at,granted_by,revoked_at)
+                    VALUES (?,?,?,?,NULL) ON CONFLICT(subject_id) DO UPDATE SET
+                    status='active',granted_at=excluded.granted_at,granted_by=excluded.granted_by,
+                    revoked_at=NULL''', (subject_id, 'active', wire(now), ROOT_SUBJECT), write=True)
+            else:
+                tx.execute("UPDATE money_bank_roles SET status='revoked',revoked_at=? WHERE subject_id=?",
+                           (wire(now), subject_id), write=True)
+            receipt = None
+        if action not in {'bank_add', 'bank_remove'}:
+            if action == 'mint':
+                require(before_supply + amount_minor <= MAX_MINOR and
+                        before_root + amount_minor <= MAX_MINOR, 'money_overflow')
+                debit, credit, kind = None, ROOT_SUBJECT, 'mint'
+            elif action == 'burn':
+                require(before_root >= amount_minor, 'insufficient_funds')
+                debit, credit, kind = ROOT_SUBJECT, None, 'burn'
+            else:
+                require(before_root >= amount_minor, 'insufficient_funds')
+                require(_balance(tx, subject_id) + amount_minor <= MAX_MINOR, 'money_overflow')
+                debit, credit, kind = ROOT_SUBJECT, subject_id, 'transfer'
+            receipt = _post_entry(tx, sender=debit, recipient=credit,
+                amount=amount_minor, actor=ROOT_SUBJECT, request_id=request_id,
+                now=now, receipt_signer=app.receipt_signer, kind=kind, _local_issuer=True)
+        statement = {'action': action, 'subject_id': subject_id, 'amount_minor': amount_minor,
+                     'currency_id': CURRENCY_ID, 'operator': operator, 'request_id': request_id,
+                     'time': wire(now), 'receipt_digest': digest(receipt) if receipt else None,
+                     'before_supply_minor': before_supply, 'after_supply_minor': _supply(tx),
+                     'before_root_minor': before_root, 'after_root_minor': _balance(tx, ROOT_SUBJECT),
+                     'before_role': before_role}
+        audit_ids = []
+        actions = ('bank_add', 'transfer') if action == 'bank_fund' else (action,)
+        for audit_action in actions:
+            fact = {**statement, 'action': audit_action, 'combined_action': action}
+            proof = wire(signer.sign(canonical(fact), purpose='money-admin'))
+            event = Event(id='audit_' + uuid4().hex, type='root.money.' + audit_action,
+                          time=now, request_id=request_id, actor=ROOT_SUBJECT,
+                          subject=ROOT_SUBJECT,
+                          resources=(ResourceRef(id=subject_id or ROOT_SUBJECT),),
+                          data={**fact, 'root_signature': proof})
+            await tx.append_event(event)
+            await tx.append_audit(AuditEvent(event=event,
+                authority=(ResourceRef(id=app.certificates.root_certificate.resource_id),),
+                before_digest=digest({'supply': before_supply, 'root': before_root, 'role': before_role}),
+                after_digest=digest(fact), previous_digest=None, entry_digest='', result=audit_action))
+            audit_ids.append(event.id)
+    return {'action': action, 'receipt': receipt, 'audit_event_id': audit_ids[-1],
+            'audit_event_ids': audit_ids,
+            'root_balance_minor': statement['after_root_minor'],
+            'total_supply_minor': statement['after_supply_minor'],
+            'subject_id': subject_id}
+
+
+
+async def _confirmed_money(app, action, *, operator, amount, subject_id,
+                           emit, confirm, unlock):
+    """The command's approval pipeline, shared with an isolated TestConsole.
+
+    The production caller must establish the physical-console boundary first.
+    There is no network operation, config option or command flag selecting IO
+    adapters. The diagnostic replaces only IO/unlock on its fresh Test Root.
+    """
+    require(action in {'mint','burn','transfer','bank_add','bank_remove','bank_fund'},
+            'invalid_money_action')
+    amount_minor = parse_amount(amount) if amount is not None else None
+    resolved_subject = subject_id
+    async with app.metadata.transaction(write=False) as tx:
+        if subject_id and subject_id.startswith('@'):
+            namespace = (await tx.path(app.namespace_root)).rstrip('/')
+            resolved_subject = await tx.resolve(namespace + '/' + subject_id)
+        if resolved_subject is not None:
+            subject = await tx.subject(resolved_subject)
+            require(subject.kind in {'registered','custodial'} and not subject.local_only,
+                    'invalid_money_recipient')
+        root_before = _balance(tx, ROOT_SUBJECT)
+        supply_before = _supply(tx)
+        subject_before = _balance(tx, resolved_subject) if resolved_subject else None
+        role_row = (tx.one('SELECT status FROM money_bank_roles WHERE subject_id=?',
+                          (resolved_subject,)) if action.startswith('bank_') else None)
+        role_before = role_row[0] if role_row else None
+    root_delta = (amount_minor if action == 'mint' else
+                  -amount_minor if action in {'burn','transfer','bank_fund'} else 0)
+    supply_delta = (amount_minor if action == 'mint' else
+                    -amount_minor if action == 'burn' else 0)
+    preview = {'action':action, 'amount_minor':amount_minor, 'currency_id':CURRENCY_ID,
+        'subject_id':resolved_subject,
+        'subject_handle':subject_id if subject_id != resolved_subject else None,
+        'root_balance_before_minor':root_before, 'root_balance_after_minor':root_before+root_delta,
+        'total_supply_before_minor':supply_before, 'total_supply_after_minor':supply_before+supply_delta,
+        'recipient_balance_before_minor':subject_before,
+        'recipient_balance_after_minor':subject_before+amount_minor
+            if action in {'transfer','bank_fund'} else subject_before,
+        'bank_role_before':role_before, 'bank_role_after':'active'
+            if action in {'bank_add','bank_fund'} else 'revoked' if action=='bank_remove' else role_before}
+    # Distinct confirmations, bound to one before/after snapshot. Unlock occurs
+    # only after BOTH role and funding approvals, before the atomic use case.
+    approvals = ('bank_add','transfer') if action == 'bank_fund' else (action,)
+    for approved_action in approvals:
+        part = {**preview, 'approval_for':approved_action}
+        emit(canonical(part).decode())  # Escaped JSON, never terminal control text.
+        approval = 'CONFIRM MONEY ' + digest(part)
+        require(confirm('Type ' + approval + ' to continue: ') == approval, 'approval_cancelled')
+    signer = unlock()
+    return await apply_money(app, signer, action=action, operator=operator,
+        amount_minor=amount_minor, subject_id=resolved_subject,
+        expected_state={'supply':supply_before, 'root':root_before,
+                        'subject':subject_before, 'role':role_before})
+
+
+class MoneyAdmin:
+    def __init__(self, config_dir):
+        self.config_dir = config_dir
+
+    def execute(self, action, *, amount=None, subject_id=None):
+        operator = require_local_console(self.config_dir)
+        from msg.admin.root import RootAdmin
+        app = RootAdmin(self.config_dir)._app()
+
+        def unlock():
+            pin = getpass.getpass('Root PIN/passphrase: ')
+            private = open_private_key(loads(root_envelope(self.config_dir).read_bytes()), pin)
+            return Ed25519Signer.from_bytes(private)
+
+        async def run():
+            await app.load()
+            try:
+                return await _confirmed_money(app, action, operator=operator, amount=amount,
+                    subject_id=subject_id, emit=print, confirm=input, unlock=unlock)
+            finally:
+                await app.close()
+        return asyncio.run(run())
+
+    def execute_offer(self, action, *, offer_id, fields=None):
+        operator = require_local_console(self.config_dir)
+        require(action in {'set', 'disable'}, 'invalid_offer_action')
+        require(isinstance(offer_id, str) and
+                re.fullmatch(r'[a-zA-Z][a-zA-Z0-9_-]{0,79}', offer_id), 'invalid_offer_id')
+        from msg.admin.root import RootAdmin
+        app = RootAdmin(self.config_dir)._app()
+
+        async def run():
+            await app.load()
+            try:
+                if action == 'set':
+                    require(isinstance(fields, dict) and set(fields) == {
+                        'resource_kind', 'unit', 'price', 'min_quantity',
+                        'max_quantity', 'entitlement_kind', 'duration_seconds'},
+                        'invalid_offer_fields')
+                    fields['price_minor'] = parse_amount(fields.pop('price'))
+                    validate_local_offer(app, **fields)
+                async with app.metadata.transaction(write=False) as tx:
+                    previous = _offer_snapshot(tx, offer_id)
+                if action == 'disable':
+                    require(previous is not None, 'offer_not_found')
+                    require(previous['enabled'], 'offer_already_disabled')
+                preview = {'action': 'offer_' + action, 'offer_id': offer_id,
+                           'before': previous, 'proposed': fields if action == 'set' else
+                           {**previous, 'enabled': False}}
+                print(canonical(preview).decode())
+                approval = 'CONFIRM MONEY ' + digest(preview)
+                require(input('Type ' + approval + ' to continue: ') == approval,
+                        'approval_cancelled')
+                pin = getpass.getpass('Root PIN/passphrase: ')
+                private = open_private_key(loads(root_envelope(self.config_dir).read_bytes()), pin)
+                signer = Ed25519Signer.from_bytes(private)
+                return await apply_offer(app, signer, action=action, operator=operator,
+                                         offer_id=offer_id, fields=fields,
+                                         expected_offer=previous)
+            finally:
+                await app.close()
+        return asyncio.run(run())

msg/admin/preflight.py

@@ -0,0 +1,142 @@
+"""Read-only installation/legacy-ledger inventory, not production acceptance.
+
+Unlike opening Application/initializing a metadata store, this command performs
+no DDL, migration, filesystem repair, Root unlock, effect emission or sequence
+allocation. It never supplies missing operational evidence with fixture results.
+"""
+from __future__ import annotations
+
+import argparse
+import hashlib
+from datetime import UTC, datetime
+from pathlib import Path
+
+import psycopg
+
+from msg.config import load_settings
+from msg.core.codec import canonical, decode, digest, loads
+from msg.core.errors import Failure, require
+from msg.core.models import Certificate
+
+_FIELD_EVIDENCE = (
+    ('installation_identity', '#64/#65', 'deployed source/configuration and authorized inventory'),
+    ('ingress_log_chain', '#64', 'CDN/proxy/APM/nginx/service redaction and listener evidence'),
+    ('protected_snapshot', '#65/#84', 'independent provenance and digest of the field backup'),
+    ('restore_conservation', '#65/#84', 'isolated old/new ledger and signed-history comparison'),
+    ('current_checkpoint', '#69', 'independently current signed revocation head outside the rollback set'),
+    ('physical_console', '#70', 'real authorized local VT/serial console and rejection evidence'),
+    ('ca_transition', '#70', 'finite old CA inventory and individually approved reissue/revoke'),
+    ('bank_fund_boundary', '#70/B', 'joint role versus injection gate evidence; no actual funding here'),
+    ('capacity_and_failure_drill', '#84', 'measured capacity and isolated install/crash/rollback drill'),
+)
+
+
+def inspect_database(connection):
+    require(connection.execute('SHOW transaction_read_only').fetchone() == ('on',),
+            'preflight_read_only_required')
+    tables = {row[0] for row in connection.execute(
+        'SELECT tablename FROM pg_tables WHERE schemaname=current_schema()')}
+    result = {'read_only': True, 'state': 'empty' if not tables else 'unclassified',
+              'table_count': len(tables), 'server_version': connection.info.server_version}
+    if not tables:
+        return result
+    required = {'money_ledger', 'money_accounts', 'store_orders', 'bounty_listings', 'identities'}
+    if required <= tables:
+        from msg.storage.ledger_migration import (
+            _escrow_sources,
+            _validate_identity_references,
+            _validate_ledger,
+        )
+        escrow = _escrow_sources(connection)
+        legacy = sum(connection.execute('SELECT 1 FROM identities WHERE id=%s', (key,)).fetchone()
+                     is not None for key in escrow)
+        ledger = {'escrow_accounts': len(escrow), 'legacy_escrow_identities': legacy,
+                  'checks': 'blocked', 'migration_performed': False}
+        result['state'] = 'typed_ledger' if 'ledger_accounts' in tables else 'legacy_ledger'
+        try:
+            _validate_identity_references(connection, escrow)
+            if 'ledger_accounts' in tables:
+                _validate_ledger(connection)
+                ledger['checks'] = 'passed'
+            else:
+                ledger['reason'] = 'isolated_typed_account_migration_required'
+        except RuntimeError:
+            ledger['reason'] = 'legacy_reference_or_conservation_review_required'
+        # Preserve exact text cells, including historical receipts: do not decode
+        # or re-sign them. A server cursor bounds memory for retained ledgers.
+        hasher = hashlib.sha256()
+        count = 0
+        with connection.cursor(name='msg_preflight_ledger') as rows:
+            rows.itersize = 256
+            rows.execute('SELECT * FROM money_ledger ORDER BY seq')
+            for row in rows:
+                raw = canonical(row)
+                hasher.update(len(raw).to_bytes(8, 'big'))
+                hasher.update(raw)
+                count += 1
+        ledger.update(rows=count, history_digest='sha256:' + hasher.hexdigest())
+        result['ledger'] = ledger
+    if 'settings' in tables:
+        gate = connection.execute("SELECT value FROM settings WHERE key='recovery_quarantine'").fetchone()
+        result['quarantine_present'] = gate is not None
+        row = connection.execute("SELECT value FROM settings WHERE key='active_root_certificate'").fetchone()
+        result['active_root_certificate'] = loads(row[0]) if row else None
+    if 'certificates' in tables:
+        inventory = []
+        for identifier, subject, parent, revoked, body in connection.execute(
+                'SELECT id,subject,parent,revoked,body FROM certificates ORDER BY id'):
+            certificate = decode(Certificate, loads(body))
+            require((certificate.resource_id, certificate.subject_id, certificate.parent_certificate_id) ==
+                    (identifier, subject, parent), 'preflight_certificate_mismatch')
+            if certificate.kind != 'ca':
+                continue
+            policy = certificate.issuance
+            grants = (*certificate.grants, *(policy.issue_grants if policy is not None else ()))
+            operations = sorted({operation for grant in grants for operation in grant.operations})
+            inventory.append({'id': identifier, 'subject': subject, 'parent': parent,
+                'revoked': bool(revoked), 'key_id': certificate.key_id,
+                'signed_grants_digest': digest(certificate.grants),
+                'issuance_digest': digest(policy), 'operation_count': len(operations),
+                'explicit_operations': all('*' not in operation for operation in operations),
+                'max_child_ca_depth': policy.max_child_ca_depth if policy is not None else None,
+                'max_cert_ttl_seconds': policy.max_cert_ttl_seconds if policy is not None else None,
+                'next_step': 'explicit_operator_review_only'})
+        result['ca_inventory'] = inventory
+    return result
+
+
+def preflight(config_dir):
+    """The config directory is explicit; no accidental default production probe."""
+    result = {'format': 'msg-preflight-v1', 'captured_at': datetime.now(UTC).isoformat(),
+              'decision': 'blocked', 'source_kind': 'unattested', 'mutation_performed': False,
+              'root_private_material': 'not_opened', 'outbound_effects': 'not_run',
+              'field_evidence': [{'id': key, 'issue': issue, 'required': description, 'status': 'missing'}
+                                 for key, issue, description in _FIELD_EVIDENCE]}
+    try:
+        settings = load_settings(Path(config_dir))
+        config = settings.config_dir / 'msgd.toml'
+        if not config.is_file():
+            config = settings.config_dir / 'server.toml'
+        result['config_digest'] = digest(config.read_bytes())
+    except (OSError, Failure, ValueError, KeyError):
+        return dict(result, error='preflight_configuration_unavailable')
+    try:
+        with psycopg.connect(settings.server.postgres_dsn, connect_timeout=5) as connection:
+            connection.execute('SET TRANSACTION ISOLATION LEVEL REPEATABLE READ, READ ONLY')
+            result['database'] = inspect_database(connection)
+    except (psycopg.Error, Failure, ValueError, KeyError):
+        result['error'] = 'preflight_database_unavailable_or_inconsistent'
+    return result
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--config', type=Path, required=True)
+    args = parser.parse_args()
+    report = preflight(args.config)
+    print(canonical(report).decode())
+    raise SystemExit(2 if report['decision'] == 'blocked' else 0)
+
+
+if __name__ == '__main__':
+    main()