raxe 0.4.6__py3-none-any.whl

raxe/infrastructure/policies/validator.py

@@ -0,0 +1,227 @@
+"""Policy validation and security verification.
+
+Validates policies for security:
+- Cryptographic signature verification (for cloud policies)
+- Customer ID matching
+- Schema validation
+"""
+import hashlib
+import json
+
+from raxe.domain.policies.models import Policy
+from raxe.infrastructure.security.auth import APIKey
+from raxe.infrastructure.security.signatures import SignatureVerifier
+
+
+class PolicyValidationError(Exception):
+    """Policy validation failed."""
+    pass
+
+
+class PolicyValidator:
+    """Validate policies for security and correctness.
+
+    Performs multi-layer validation:
+    1. Schema validation (already done by domain models)
+    2. Customer ID matching (policy ownership)
+    3. Signature verification (for cloud policies)
+    """
+
+    def __init__(
+        self,
+        signature_verifier: SignatureVerifier | None = None,
+    ) -> None:
+        """Initialize validator.
+
+        Args:
+            signature_verifier: Signature verifier (None = create default)
+        """
+        self.signature_verifier = signature_verifier
+
+    def validate_policies(
+        self,
+        policies: list[Policy],
+        api_key: APIKey,
+        *,
+        require_signature: bool = False,
+        signature: str | None = None,
+    ) -> list[Policy]:
+        """Validate policies for customer.
+
+        Args:
+            policies: Policies to validate
+            api_key: API key (for customer ID matching)
+            require_signature: If True, signature verification required
+            signature: Cryptographic signature (for cloud policies)
+
+        Returns:
+            List of validated policies (may be filtered)
+
+        Raises:
+            PolicyValidationError: If validation fails
+        """
+        # 1. Verify signature if required
+        if require_signature:
+            if not signature:
+                raise PolicyValidationError(
+                    "Signature required but not provided"
+                )
+            self._verify_signature(policies, signature)
+
+        # 2. Filter policies by customer ID
+        customer_policies = self._filter_by_customer(
+            policies,
+            api_key.customer_id,
+        )
+
+        # 3. Validate individual policies (domain validation already done)
+        for policy in customer_policies:
+            self._validate_policy(policy, api_key)
+
+        return customer_policies
+
+    def validate_local_policies(
+        self,
+        policies: list[Policy],
+        api_key: APIKey | None = None,
+    ) -> list[Policy]:
+        """Validate locally loaded policies (no signature required).
+
+        Args:
+            policies: Policies from local file
+            api_key: Optional API key for customer filtering
+
+        Returns:
+            List of validated policies
+
+        Raises:
+            PolicyValidationError: If validation fails
+        """
+        # No signature verification for local files
+        # Customer can manage their own .raxe/policies.yaml
+
+        if api_key:
+            # Filter by customer if API key provided
+            return self._filter_by_customer(policies, api_key.customer_id)
+
+        # No filtering - return all policies
+        return policies
+
+    def _verify_signature(
+        self,
+        policies: list[Policy],
+        signature: str,
+    ) -> None:
+        """Verify cryptographic signature on policies.
+
+        Args:
+            policies: Policies to verify
+            signature: Signature string
+
+        Raises:
+            PolicyValidationError: If signature invalid
+        """
+        if not self.signature_verifier:
+            raise PolicyValidationError(
+                "Signature verification requested but no verifier available"
+            )
+
+        # Create canonical representation of policies for signing
+        policy_data = self._canonical_policy_data(policies)
+
+        # Hash the data
+        data_hash = hashlib.sha256(
+            json.dumps(policy_data, sort_keys=True).encode()
+        ).digest()
+
+        # Verify signature
+        try:
+            # Note: SignatureVerifier is designed for file-based verification
+            # We'll use a simpler approach for policy data
+            if not signature.startswith("ed25519:"):
+                raise PolicyValidationError(
+                    "Invalid signature format (must start with 'ed25519:')"
+                )
+
+            import base64
+            sig_b64 = signature.split(":", 1)[1]
+            signature_bytes = base64.b64decode(sig_b64)
+
+            # Verify using public key
+            self.signature_verifier.public_key.verify(signature_bytes, data_hash)
+
+        except Exception as e:
+            raise PolicyValidationError(
+                f"Policy signature verification failed: {e}"
+            ) from e
+
+    def _filter_by_customer(
+        self,
+        policies: list[Policy],
+        customer_id: str,
+    ) -> list[Policy]:
+        """Filter policies to only those owned by customer.
+
+        Args:
+            policies: All policies
+            customer_id: Customer ID to filter by
+
+        Returns:
+            Policies belonging to customer
+        """
+        return [
+            policy for policy in policies
+            if policy.customer_id == customer_id
+        ]
+
+    def _validate_policy(
+        self,
+        policy: Policy,
+        api_key: APIKey,
+    ) -> None:
+        """Validate single policy.
+
+        Args:
+            policy: Policy to validate
+            api_key: API key for context
+
+        Raises:
+            PolicyValidationError: If policy invalid for this customer
+        """
+        # Verify customer ID match
+        if policy.customer_id != api_key.customer_id:
+            raise PolicyValidationError(
+                f"Policy {policy.policy_id} customer_id mismatch: "
+                f"expected {api_key.customer_id}, got {policy.customer_id}"
+            )
+
+        # Additional validation could go here:
+        # - Check policy not expired
+        # - Validate webhook URLs are authorized
+        # - Check priority within allowed range
+
+    def _canonical_policy_data(
+        self,
+        policies: list[Policy],
+    ) -> dict:
+        """Create canonical representation of policies for signing.
+
+        Args:
+            policies: Policies to represent
+
+        Returns:
+            Dictionary representation suitable for hashing
+        """
+        return {
+            "version": "0.0.1",
+            "policies": [
+                {
+                    "id": p.policy_id,
+                    "customer_id": p.customer_id,
+                    "name": p.name,
+                    "action": p.action.value,
+                    "priority": p.priority,
+                }
+                for p in sorted(policies, key=lambda x: x.policy_id)
+            ],
+        }

raxe/infrastructure/policies/yaml_loader.py

@@ -0,0 +1,250 @@
+"""YAML policy file loader.
+
+Loads policies from local .raxe/policies.yaml files.
+Validates schema and converts to domain models.
+"""
+from pathlib import Path
+
+import yaml
+
+from raxe.domain.policies.models import (
+    Policy,
+    PolicyAction,
+    PolicyCondition,
+)
+from raxe.domain.rules.models import Severity
+
+
+class PolicyLoadError(Exception):
+    """Error loading or parsing policy file."""
+    pass
+
+
+class YAMLPolicyLoader:
+    """Load policies from YAML files.
+
+    Expected YAML format:
+    ```yaml
+    version: 1.0.0
+    policies:
+      - id: block-critical
+        customer_id: cust_abc123
+        name: "Block all critical threats"
+        description: "Zero tolerance for critical threats"
+        priority: 100
+        enabled: true
+        conditions:
+          - severity: critical
+        action: BLOCK
+        metadata:
+          created_by: admin
+    ```
+    """
+
+    def load_from_file(self, file_path: Path) -> list[Policy]:
+        """Load policies from YAML file.
+
+        Args:
+            file_path: Path to YAML policy file
+
+        Returns:
+            List of Policy objects
+
+        Raises:
+            PolicyLoadError: If file doesn't exist, invalid YAML, or schema error
+        """
+        if not file_path.exists():
+            raise PolicyLoadError(f"Policy file not found: {file_path}")
+
+        try:
+            with open(file_path) as f:
+                data = yaml.safe_load(f)
+        except yaml.YAMLError as e:
+            raise PolicyLoadError(f"Invalid YAML in {file_path}: {e}") from e
+        except OSError as e:
+            raise PolicyLoadError(f"Cannot read {file_path}: {e}") from e
+
+        if not data:
+            raise PolicyLoadError(f"Empty policy file: {file_path}")
+
+        return self._parse_yaml_data(data, str(file_path))
+
+    def load_from_string(self, yaml_content: str) -> list[Policy]:
+        """Load policies from YAML string.
+
+        Useful for testing and programmatic policy creation.
+
+        Args:
+            yaml_content: YAML content as string
+
+        Returns:
+            List of Policy objects
+
+        Raises:
+            PolicyLoadError: If invalid YAML or schema error
+        """
+        try:
+            data = yaml.safe_load(yaml_content)
+        except yaml.YAMLError as e:
+            raise PolicyLoadError(f"Invalid YAML: {e}") from e
+
+        if not data:
+            raise PolicyLoadError("Empty YAML content")
+
+        return self._parse_yaml_data(data, "<string>")
+
+    def _parse_yaml_data(
+        self,
+        data: dict,
+        source: str,
+    ) -> list[Policy]:
+        """Parse YAML data into Policy objects.
+
+        Args:
+            data: Parsed YAML data
+            source: Source description for error messages
+
+        Returns:
+            List of Policy objects
+
+        Raises:
+            PolicyLoadError: If schema validation fails
+        """
+        # Validate root structure
+        if not isinstance(data, dict):
+            raise PolicyLoadError(f"Policy file must be a YAML object, got {type(data)}")
+
+        # Check version
+        version = data.get("version")
+        if not version:
+            raise PolicyLoadError(f"Missing 'version' field in {source}")
+
+        if not isinstance(version, str):
+            raise PolicyLoadError(f"'version' must be string, got {type(version)}")
+
+        # Currently only support v1.0.0
+        if not version.startswith("1."):
+            raise PolicyLoadError(
+                f"Unsupported policy version {version} (expected 1.x.x)"
+            )
+
+        # Parse policies
+        policies_data = data.get("policies")
+        if not policies_data:
+            raise PolicyLoadError(f"Missing 'policies' field in {source}")
+
+        if not isinstance(policies_data, list):
+            raise PolicyLoadError(
+                f"'policies' must be a list, got {type(policies_data)}"
+            )
+
+        policies: list[Policy] = []
+        for idx, policy_data in enumerate(policies_data):
+            try:
+                policy = self._parse_policy(policy_data)
+                policies.append(policy)
+            except (ValueError, KeyError) as e:
+                raise PolicyLoadError(
+                    f"Invalid policy at index {idx} in {source}: {e}"
+                ) from e
+
+        # Validate policy count using PolicySet (enforces max 100 policies)
+        from raxe.domain.policies.models import PolicySet
+        try:
+            PolicySet(policies=policies)  # Validates count in __post_init__
+        except ValueError as e:
+            raise PolicyLoadError(f"Policy validation failed in {source}: {e}") from e
+
+        return policies
+
+    def _parse_policy(self, data: dict) -> Policy:
+        """Parse single policy from YAML data.
+
+        Args:
+            data: Policy data dictionary
+
+        Returns:
+            Policy object
+
+        Raises:
+            ValueError: If required fields missing or invalid
+            KeyError: If required fields missing
+        """
+        # Parse conditions
+        conditions_data = data["conditions"]
+        if not isinstance(conditions_data, list) or not conditions_data:
+            raise ValueError("'conditions' must be non-empty list")
+
+        conditions = [
+            self._parse_condition(cond_data)
+            for cond_data in conditions_data
+        ]
+
+        # Parse action
+        action_str = data["action"].upper()
+        try:
+            action = PolicyAction[action_str]
+        except KeyError:
+            raise ValueError(
+                f"Invalid action '{action_str}'. "
+                f"Must be one of: {', '.join(a.name for a in PolicyAction)}"
+            ) from None
+
+        # Parse optional severity override
+        override_severity = None
+        if "override_severity" in data:
+            severity_str = data["override_severity"].lower()
+            try:
+                override_severity = Severity[severity_str.upper()]
+            except KeyError:
+                raise ValueError(
+                    f"Invalid override_severity '{severity_str}'. "
+                    f"Must be one of: {', '.join(s.name.lower() for s in Severity)}"
+                ) from None
+
+        # Build Policy
+        return Policy(
+            policy_id=data["id"],
+            customer_id=data["customer_id"],
+            name=data["name"],
+            description=data.get("description", ""),
+            conditions=conditions,
+            action=action,
+            override_severity=override_severity,
+            priority=data.get("priority", 0),
+            enabled=data.get("enabled", True),
+            metadata=data.get("metadata", {}),
+        )
+
+    def _parse_condition(self, data: dict) -> PolicyCondition:
+        """Parse single condition from YAML data.
+
+        Args:
+            data: Condition data dictionary
+
+        Returns:
+            PolicyCondition object
+
+        Raises:
+            ValueError: If condition data invalid
+        """
+        # Parse optional severity threshold
+        severity_threshold = None
+        if "severity" in data:
+            severity_str = data["severity"].lower()
+            try:
+                severity_threshold = Severity[severity_str.upper()]
+            except KeyError:
+                raise ValueError(
+                    f"Invalid severity '{severity_str}'. "
+                    f"Must be one of: {', '.join(s.name.lower() for s in Severity)}"
+                ) from None
+
+        return PolicyCondition(
+            rule_ids=data.get("rule_ids"),
+            severity_threshold=severity_threshold,
+            threat_types=data.get("threat_types"),
+            min_confidence=data.get("min_confidence"),
+            max_confidence=data.get("max_confidence"),
+            custom_filter=data.get("custom_filter"),
+        )

raxe/infrastructure/rules/__init__.py

@@ -0,0 +1,18 @@
+"""Infrastructure layer for rule loading and management.
+
+Handles file I/O, YAML parsing, and version compatibility checking.
+"""
+from raxe.infrastructure.rules.versioning import (
+    Version,
+    VersionChecker,
+    VersionError,
+)
+from raxe.infrastructure.rules.yaml_loader import YAMLLoader, YAMLLoadError
+
+__all__ = [
+    "Version",
+    "VersionChecker",
+    "VersionError",
+    "YAMLLoadError",
+    "YAMLLoader",
+]