ocean-basket-protocol 2.3.0__py3-none-any.whl

obp/__init__.py

@@ -0,0 +1,292 @@
+"""Ocean Basket Protocol (OBP)
+
+Physics-inspired self-protecting security framework.
+The ocean protects itself.
+
+Quick Start:
+    >>> from obp import obp, OBPConfig, ProtectionMode
+    >>> 
+    >>> config = OBPConfig(mode=ProtectionMode.DEFENSIVE)
+    >>> 
+    >>> @obp.protect(config)
+    ... def sensitive_operation(api_key: str):
+    ...     return {"status": "success"}
+
+Core Components:
+    - obp: Global OBP singleton instance
+    - OBPConfig: Configuration dataclass
+    - ProtectionMode: Protection level enum
+    - OceanBasketError: Base exception
+    - LeakGuard: Secret detection engine
+    - render_timeline: Visual timeline renderer
+
+Security Hardening:
+    - TPMManager: Hardware-backed cryptographic signing
+    - HoneypotManager: Active honeypot deception system
+    - SecureAuditLogger: Tamper-evident audit logging
+    - SessionHijackingProtection: Session security
+
+Protection Modes:
+    - GRACEFUL: Returns decoy values on threat detection
+    - DEFENSIVE: Adds viscosity and steam burn penalties
+    - PARANOID: Raises exceptions and triggers reversion
+
+Example:
+    from obp import obp, OBPConfig, ProtectionMode, render_timeline
+    
+    config = OBPConfig(
+        viscosity=0.8,
+        max_temperature=0.9,
+        mode=ProtectionMode.DEFENSIVE,
+        enable_leakguard=True
+    )
+    
+    @obp.protect(config)
+    def protected_function(secret_key: str, data: str):
+        # Protected execution
+        return {"processed": data}
+    
+    # View audit timeline
+    render_timeline(obp.audit_log)
+
+"""
+
+__version__ = "2.3.0"
+__author__ = "OBP Authors"
+__license__ = "PROPRIETARY - All Rights Reserved"
+
+from .config import (
+    LeakGuardConfig,
+    LogSanitizationConfig,
+    OBPConfig,
+    ProtectionMode,
+    ReversionSpeed,
+    TimelineConfig,
+)
+from .core import OBP, AntiPatchProtection, MemoryProtection, obp, reset_obp
+from .exceptions import (
+    ConfigurationError,
+    ContextViolationError,
+    LeakDetectedError,
+    OceanBasketError,
+    ProtectionModeError,
+    ResonanceError,
+    ReversionError,
+)
+from .honeypot import (
+    DecoyValue,
+    HoneypotAlertLevel,
+    HoneypotConfig,
+    HoneypotManager,
+    HoneypotType,
+    get_honeypot_manager,
+)
+from .leakguard import LeakGuard
+from .log_sanitizer import (
+    LogSanitizer,
+    disable_log_sanitization,
+    enable_log_sanitization,
+    redact_secrets,
+    sanitize_output,
+)
+
+# Rate limiting
+from .rate_limiter import (
+    RateLimitConfig,
+    RateLimiter,
+    SlidingWindowLog,
+    TokenBucket,
+    get_rate_limiter,
+)
+
+# Secrets manager integration
+from .secrets_manager import SecretConfig, SecretManagerType, SecretsManager, get_secrets_manager
+from .secure_audit import (
+    LogLevel,
+    SecureAuditConfig,
+    SecureAuditLogger,
+    SecureLogEntry,
+    TamperEvidence,
+    get_audit_logger,
+)
+from .session import (
+    Session,
+    SessionConfig,
+    SessionFingerprint,
+    SessionHijackingProtection,
+    SessionStatus,
+    get_session_protection,
+)
+from .timeline import get_timeline_stats, render_timeline
+
+# Security hardening modules
+from .tpm import TPMAvailability, TPMConfig, TPMManager, get_tpm_manager
+
+# Trap Engine - Attribution & Deception
+from .trap_engine import (
+    AlertChannel,
+    AttackerIntel,
+    ForensicEvidence,
+    ForensicLogger,
+    RealTimeReporter,
+    TrapEngine,
+    TrapLevel,
+    configure_trap_engine,
+    trap,
+    trap_access,
+    trap_engine,
+)
+
+# TLS Context Verification (NEW - v3.0)
+from .tls_context import (
+    TLSContextVerifier,
+    TLSContextInfo,
+    TLSVerificationStatus,
+    get_tls_verifier,
+    verify_tls_context,
+)
+
+# Input Sanitization (NEW - v3.0)
+from .input_sanitizer import (
+    InputSanitizer,
+    InjectionType,
+    SanitizationResult,
+    sanitize_input,
+    get_input_sanitizer,
+)
+
+
+# CLI and Middleware - lazy imports for optional dependencies
+def __getattr__(name: str):
+    """Lazy import for optional dependencies."""
+    if name == "cli":
+        import rich  # noqa: F401
+
+        from . import cli as cli_module
+        return cli_module
+    if name in ("OBPMiddleware", "create_fastapi_middleware"):
+        from .middleware import OBPMiddleware, create_fastapi_middleware
+        globals()["OBPMiddleware"] = OBPMiddleware
+        globals()["create_fastapi_middleware"] = create_fastapi_middleware
+        if name == "OBPMiddleware":
+            return OBPMiddleware
+        return create_fastapi_middleware
+    raise AttributeError(f"module 'obp' has no attribute '{name}'")
+
+__all__ = [
+    # Version
+    "__version__",
+    "__author__",
+    "__license__",
+
+    # Core
+    "obp",
+    "OBP",
+    "reset_obp",
+    "AntiPatchProtection",
+    "MemoryProtection",
+
+    # Configuration
+    "OBPConfig",
+    "ProtectionMode",
+    "ReversionSpeed",
+    "LeakGuardConfig",
+    "TimelineConfig",
+    "LogSanitizationConfig",
+
+    # Exceptions
+    "OceanBasketError",
+    "ContextViolationError",
+    "LeakDetectedError",
+    "ProtectionModeError",
+    "ConfigurationError",
+    "ReversionError",
+    "ResonanceError",
+
+    # CLI
+    "cli",
+
+    # Middleware
+    "OBPMiddleware",
+    "create_fastapi_middleware",
+
+    # Components
+    "LeakGuard",
+    "render_timeline",
+    "get_timeline_stats",
+    "LogSanitizer",
+    "enable_log_sanitization",
+    "disable_log_sanitization",
+    "sanitize_output",
+    "redact_secrets",
+
+    # TPM Integration
+    "TPMManager",
+    "TPMConfig",
+    "TPMAvailability",
+    "get_tpm_manager",
+
+    # Active Honeypots
+    "HoneypotManager",
+    "HoneypotConfig",
+    "HoneypotType",
+    "HoneypotAlertLevel",
+    "DecoyValue",
+    "get_honeypot_manager",
+
+    # Secure Audit Logging
+    "SecureAuditLogger",
+    "SecureAuditConfig",
+    "SecureLogEntry",
+    "LogLevel",
+    "TamperEvidence",
+    "get_audit_logger",
+
+    # Session Security
+    "SessionHijackingProtection",
+    "SessionConfig",
+    "SessionFingerprint",
+    "Session",
+    "SessionStatus",
+    "get_session_protection",
+
+    # Secrets Manager Integration
+    "SecretsManager",
+    "SecretConfig",
+    "SecretManagerType",
+    "get_secrets_manager",
+
+    # Rate Limiting
+    "RateLimiter",
+    "RateLimitConfig",
+    "TokenBucket",
+    "SlidingWindowLog",
+    "get_rate_limiter",
+
+    # Trap Engine - Attribution & Deception
+    "TrapEngine",
+    "TrapLevel",
+    "AlertChannel",
+    "AttackerIntel",
+    "ForensicEvidence",
+    "RealTimeReporter",
+    "ForensicLogger",
+    "trap_engine",
+    "trap",
+    "trap_access",
+    "configure_trap_engine",
+
+    # TLS Context Verification (NEW - v3.0)
+    "TLSContextVerifier",
+    "TLSContextInfo",
+    "TLSVerificationStatus",
+    "get_tls_verifier",
+    "verify_tls_context",
+
+    # Input Sanitization (NEW - v3.0)
+    "InputSanitizer",
+    "InjectionType",
+    "SanitizationResult",
+    "sanitize_input",
+    "get_input_sanitizer",
+]

obp/_rust_bridge.py

@@ -0,0 +1,81 @@
+"""Rust Bridge for OBP - Uses Rust core when available for performance.
+
+This module provides a drop-in replacement for Python implementations
+using the Rust core via PyO3 bindings.
+"""
+
+import logging
+
+logger = logging.getLogger(__name__)
+
+# Try to import Rust bindings
+_RUST_AVAILABLE = False
+_obp_core = None
+
+try:
+    import obp_core
+    _RUST_AVAILABLE = True
+    logger.info("Rust core available - using high-performance implementation")
+except ImportError:
+    logger.info("Rust core not available - using Python implementation")
+
+
+class RustCore:
+    """Wrapper around Rust core for consistent API."""
+
+    def __init__(self, entropy_threshold: float = 4.5):
+        if not _RUST_AVAILABLE:
+            raise ImportError("Rust core not available. Install with: pip install obp-core")
+
+        config = {"entropy_threshold": entropy_threshold}
+        self._engine = obp_core.PyOBPEngine(config)
+
+    def detect_leak(self, input_str: str) -> dict:
+        """Detect secrets in input string."""
+        result = self._engine.detect_leak(input_str)
+        return {
+            "detected": result["detected"],
+            "pattern_matched": result.get("pattern_matched"),
+            "entropy": result.get("entropy", 0.0)
+        }
+
+    def sign(self, key: str, data: str) -> str:
+        """Sign data with HMAC-SHA256."""
+        return self._engine.sign(key, data)
+
+    def verify(self, key: str, data: str, signature: str) -> bool:
+        """Verify HMAC signature."""
+        return self._engine.verify(key, data, signature)
+
+    def steam_burn(self, intensity: float) -> int:
+        """CPU-intensive work (fast in Rust)."""
+        return self._engine.steam_burn(intensity)
+
+
+def calculate_entropy_rust(data: str) -> float:
+    """Calculate entropy using Rust core."""
+    if not _RUST_AVAILABLE:
+        raise ImportError("Rust core not available")
+
+    return obp_core.calculate_entropy_fast(data)
+
+
+def steam_burn_rust(intensity: float) -> int:
+    """Steam burn using Rust core (much faster)."""
+    if not _RUST_AVAILABLE:
+        raise ImportError("Rust core not available")
+
+    return obp_core.steam_burn_fast(intensity)
+
+
+def is_rust_available() -> bool:
+    """Check if Rust core is available."""
+    return _RUST_AVAILABLE
+
+
+def get_rust_core(entropy_threshold: float = 4.5) -> RustCore | None:
+    """Get Rust core instance if available."""
+    if not _RUST_AVAILABLE:
+        return None
+
+    return RustCore(entropy_threshold)

obp/cli.py

@@ -0,0 +1,214 @@
+"""OBP CLI - Command-line interface for Ocean Basket Protocol."""
+
+from __future__ import annotations
+
+import argparse
+import sys
+
+from rich.console import Console
+from rich.table import Table
+
+from . import obp
+from .config import LeakGuardConfig, OBPConfig, ProtectionMode
+from .core import AntiPatchProtection, MemoryProtection
+from .leakguard import LeakGuard
+
+console = Console()
+
+
+def cmd_status(args: argparse.Namespace) -> int:
+    """Check OBP status."""
+    console.print("\n[bold cyan]🌊 Ocean Basket Protocol Status[/bold cyan]\n")
+    
+    # OBP instance status
+    console.print("[green]✓[/green] OBP Instance: Active")
+    console.print(f"  Config Mode: {obp._config.mode}")
+    console.print(f"  LeakGuard: {'Enabled' if obp._config.enable_leakguard else 'Disabled'}")
+    console.print(f"  Anti-Patch: {'Enabled' if obp._config.enable_anti_patch else 'Disabled'}")
+    console.print(f"  Memory Warning: {'Enabled' if obp._config.enable_memory_warning else 'Disabled'}")
+    
+    # Context fingerprint
+    console.print("\n[cyan]Context Fingerprint:[/cyan]")
+    console.print(f"  {obp.context_fingerprint[:32]}...")
+    
+    # Audit log count
+    console.print("\n[cyan]Audit Log:[/cyan]")
+    console.print(f"  Events logged: {len(obp.audit_log)}")
+    
+    return 0
+
+
+def cmd_integrity(args: argparse.Namespace) -> int:
+    """Check OBP integrity."""
+    console.print("\n[bold cyan]🔒 OBP Integrity Check[/bold cyan]\n")
+    
+    violations = AntiPatchProtection.check_integrity()
+    
+    if violations:
+        console.print("[red]✗ INTEGRITY COMPROMISED[/red]")
+        for v in violations:
+            console.print(f"  - {v}")
+        return 1
+    else:
+        console.print("[green]✓ OBP Integrity Verified[/green]")
+        return 0
+
+
+def cmd_memory(args: argparse.Namespace) -> int:
+    """Check memory protection warnings."""
+    console.print("\n[bold cyan]💾 Memory Protection Check[/bold cyan]\n")
+    
+    warnings = MemoryProtection.check_environment()
+    
+    if warnings:
+        console.print("[yellow]⚠ Security Warnings:[/yellow]")
+        for w in warnings:
+            console.print(f"  - {w}")
+    else:
+        console.print("[green]✓ No memory security issues detected[/green]")
+    
+    return 0
+
+
+def cmd_audit(args: argparse.Namespace) -> int:
+    """Display audit log."""
+    console.print("\n[bold cyan]📋 OBP Audit Log[/bold cyan]\n")
+    
+    if not obp.audit_log:
+        console.print("[dim]No audit events logged.[/dim]")
+        return 0
+    
+    table = Table(show_header=True)
+    table.add_column("Time", style="cyan")
+    table.add_column("Event", style="white")
+    table.add_column("Details", style="dim")
+    
+    for event in obp.audit_log[-20:]:  # Show last 20
+        timestamp = event.get("timestamp", "N/A")
+        event_type = event.get("event", "unknown")
+        details = event.get("details", "")
+        table.add_row(
+            timestamp[:19] if timestamp else "N/A",
+            event_type,
+            str(details)[:50]
+        )
+    
+    console.print(table)
+    return 0
+
+
+def cmd_scan(args: argparse.Namespace) -> int:
+    """Scan text for secrets."""
+    console.print("\n[bold cyan]🔍 Secret Scanner[/bold cyan]\n")
+    
+    text = args.text
+    if args.file:
+        try:
+            with open(args.file) as f:
+                text = f.read()
+        except Exception as e:
+            console.print(f"[red]Error reading file: {e}[/red]")
+            return 1
+    
+    if not text:
+        console.print("[yellow]No text to scan.[/yellow]")
+        return 1
+    
+    config = LeakGuardConfig(enabled=True)
+    scanner = LeakGuard(config)
+    
+    detected = scanner.scan(text)
+    
+    if detected:
+        console.print(f"[red]✗ Secrets detected ({len(detected)}):[/red]")
+        for d in detected[:10]:  # Show first 10
+            console.print(f"  - {d[0]}: {d[1][:30]}...")
+    else:
+        console.print("[green]✓ No secrets detected[/green]")
+    
+    return 0 if not detected else 1
+
+
+def cmd_protect(args: argparse.Namespace) -> int:
+    """Test protection decorator."""
+    console.print("\n[bold cyan]🛡️ Testing Protection[/bold cyan]\n")
+    
+    mode_map = {
+        "graceful": ProtectionMode.GRACEFUL,
+        "defensive": ProtectionMode.DEFENSIVE,
+        "paranoid": ProtectionMode.PARANOID,
+    }
+    
+    mode = mode_map.get(args.mode, ProtectionMode.DEFENSIVE)
+    config = OBPConfig(mode=mode, enable_leakguard=True)
+    
+    @obp.protect(config)
+    def test_function(api_key: str, data: str) -> dict:
+        return {"status": "ok", "key": api_key}
+    
+    try:
+        result = test_function("sk_live_test123", "hello")
+        console.print("[green]✓ Protection working[/green]")
+        console.print(f"  Result: {result}")
+    except Exception as e:
+        console.print(f"[red]✗ Error: {e}[/red]")
+        return 1
+    
+    return 0
+
+
+def main(argv: list[str] | None = None) -> int:
+    """Main CLI entry point."""
+    parser = argparse.ArgumentParser(
+        description="🌊 Ocean Basket Protocol CLI",
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+    )
+    
+    subparsers = parser.add_subparsers(dest="command", help="Commands")
+    
+    # status
+    subparsers.add_parser("status", help="Check OBP status")
+    
+    # integrity
+    subparsers.add_parser("integrity", help="Check OBP integrity")
+    
+    # memory
+    subparsers.add_parser("memory", help="Check memory protection")
+    
+    # audit
+    subparsers.add_parser("audit", help="Show audit log")
+    
+    # scan
+    scan_parser = subparsers.add_parser("scan", help="Scan text for secrets")
+    scan_parser.add_argument("text", nargs="?", help="Text to scan")
+    scan_parser.add_argument("-f", "--file", help="File to scan")
+    
+    # protect
+    protect_parser = subparsers.add_parser("protect", help="Test protection")
+    protect_parser.add_argument(
+        "-m", "--mode",
+        choices=["graceful", "defensive", "paranoid"],
+        default="defensive",
+        help="Protection mode"
+    )
+    
+    args = parser.parse_args(argv)
+    
+    commands = {
+        "status": cmd_status,
+        "integrity": cmd_integrity,
+        "memory": cmd_memory,
+        "audit": cmd_audit,
+        "scan": cmd_scan,
+        "protect": cmd_protect,
+    }
+    
+    if args.command in commands:
+        return commands[args.command](args)
+    
+    parser.print_help()
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())