truthound-dashboard 1.3.1__py3-none-any.whl → 1.4.0__py3-none-any.whl

truthound_dashboard/core/plugins/security/policies.py

@@ -0,0 +1,311 @@
+"""Security Policy Presets.
+
+This module provides predefined security policies for different
+use cases and environments.
+"""
+
+from __future__ import annotations
+
+from enum import Enum
+from typing import Any
+
+from .protocols import (
+    IsolationLevel,
+    ResourceLimits,
+    SecurityPolicy,
+)
+
+
+class SecurityPolicyPresets(str, Enum):
+    """Predefined security policy presets."""
+
+    DEVELOPMENT = "development"   # No restrictions, for local dev
+    TESTING = "testing"           # Minimal restrictions for testing
+    STANDARD = "standard"         # Default production settings
+    ENTERPRISE = "enterprise"     # Enterprise security requirements
+    STRICT = "strict"             # High security environment
+    AIRGAPPED = "airgapped"       # Air-gapped/isolated environment
+
+
+# Policy definitions
+_PRESET_POLICIES: dict[SecurityPolicyPresets, SecurityPolicy] = {
+    SecurityPolicyPresets.DEVELOPMENT: SecurityPolicy(
+        name="development",
+        description="Development mode with minimal restrictions",
+        isolation_level=IsolationLevel.NONE,
+        resource_limits=ResourceLimits(
+            max_memory_mb=1024,
+            max_cpu_time_sec=300,
+            max_wall_time_sec=600,
+            max_file_size_mb=100,
+            max_open_files=100,
+            max_processes=10,
+            network_enabled=True,
+            filesystem_read=True,
+            filesystem_write=True,
+        ),
+        require_signature=False,
+        min_signatures=0,
+        blocked_modules=[],
+    ),
+    SecurityPolicyPresets.TESTING: SecurityPolicy(
+        name="testing",
+        description="Testing mode with relaxed restrictions",
+        isolation_level=IsolationLevel.NONE,
+        resource_limits=ResourceLimits(
+            max_memory_mb=512,
+            max_cpu_time_sec=120,
+            max_wall_time_sec=300,
+            max_file_size_mb=50,
+            max_open_files=50,
+            max_processes=5,
+            network_enabled=True,
+            filesystem_read=True,
+            filesystem_write=True,
+        ),
+        require_signature=False,
+        min_signatures=0,
+        blocked_modules=[],
+    ),
+    SecurityPolicyPresets.STANDARD: SecurityPolicy(
+        name="standard",
+        description="Standard production security",
+        isolation_level=IsolationLevel.PROCESS,
+        resource_limits=ResourceLimits(
+            max_memory_mb=256,
+            max_cpu_time_sec=30,
+            max_wall_time_sec=60,
+            max_file_size_mb=10,
+            max_open_files=10,
+            max_processes=1,
+            network_enabled=False,
+            filesystem_read=False,
+            filesystem_write=False,
+        ),
+        require_signature=True,
+        min_signatures=1,
+        blocked_modules=[
+            "os", "subprocess", "sys", "shutil", "socket",
+            "http", "urllib", "requests", "httpx",
+            "multiprocessing", "threading", "ctypes",
+            "pickle", "shelve", "sqlite3", "importlib",
+        ],
+    ),
+    SecurityPolicyPresets.ENTERPRISE: SecurityPolicy(
+        name="enterprise",
+        description="Enterprise security with signature requirements",
+        isolation_level=IsolationLevel.PROCESS,
+        resource_limits=ResourceLimits(
+            max_memory_mb=256,
+            max_cpu_time_sec=30,
+            max_wall_time_sec=60,
+            max_file_size_mb=10,
+            max_open_files=10,
+            max_processes=1,
+            network_enabled=False,
+            filesystem_read=False,
+            filesystem_write=False,
+        ),
+        require_signature=True,
+        min_signatures=1,
+        blocked_modules=[
+            "os", "subprocess", "sys", "shutil", "socket",
+            "http", "urllib", "requests", "httpx",
+            "multiprocessing", "threading", "ctypes",
+            "pickle", "shelve", "sqlite3", "importlib",
+            "builtins", "__builtin__",
+        ],
+    ),
+    SecurityPolicyPresets.STRICT: SecurityPolicy(
+        name="strict",
+        description="High security environment with container isolation",
+        isolation_level=IsolationLevel.CONTAINER,
+        resource_limits=ResourceLimits(
+            max_memory_mb=128,
+            max_cpu_time_sec=15,
+            max_wall_time_sec=30,
+            max_file_size_mb=5,
+            max_open_files=5,
+            max_processes=1,
+            network_enabled=False,
+            filesystem_read=False,
+            filesystem_write=False,
+        ),
+        require_signature=True,
+        min_signatures=2,
+        blocked_modules=[
+            "os", "subprocess", "sys", "shutil", "socket",
+            "http", "urllib", "requests", "httpx",
+            "multiprocessing", "threading", "ctypes",
+            "pickle", "shelve", "sqlite3", "importlib",
+            "builtins", "__builtin__", "code", "codeop",
+            "gc", "inspect", "traceback",
+        ],
+    ),
+    SecurityPolicyPresets.AIRGAPPED: SecurityPolicy(
+        name="airgapped",
+        description="Air-gapped environment with maximum restrictions",
+        isolation_level=IsolationLevel.CONTAINER,
+        resource_limits=ResourceLimits(
+            max_memory_mb=64,
+            max_cpu_time_sec=10,
+            max_wall_time_sec=20,
+            max_file_size_mb=1,
+            max_open_files=3,
+            max_processes=1,
+            network_enabled=False,
+            filesystem_read=False,
+            filesystem_write=False,
+        ),
+        require_signature=True,
+        min_signatures=2,
+        blocked_modules=[
+            "os", "subprocess", "sys", "shutil", "socket",
+            "http", "urllib", "requests", "httpx",
+            "multiprocessing", "threading", "ctypes",
+            "pickle", "shelve", "sqlite3", "importlib",
+            "builtins", "__builtin__", "code", "codeop",
+            "gc", "inspect", "traceback", "ast", "dis",
+            "types", "typing", "io", "tempfile",
+        ],
+    ),
+}
+
+
+def get_preset(preset: SecurityPolicyPresets | str) -> SecurityPolicy:
+    """Get a security policy preset.
+
+    Args:
+        preset: Preset name or enum value.
+
+    Returns:
+        SecurityPolicy for the preset.
+
+    Raises:
+        ValueError: If preset is not found.
+    """
+    if isinstance(preset, str):
+        try:
+            preset = SecurityPolicyPresets(preset)
+        except ValueError:
+            raise ValueError(f"Unknown security preset: {preset}")
+
+    if preset not in _PRESET_POLICIES:
+        raise ValueError(f"Unknown security preset: {preset}")
+
+    # Return a copy to prevent modification
+    original = _PRESET_POLICIES[preset]
+    return SecurityPolicy(
+        name=original.name,
+        description=original.description,
+        isolation_level=original.isolation_level,
+        resource_limits=ResourceLimits(
+            max_memory_mb=original.resource_limits.max_memory_mb,
+            max_cpu_time_sec=original.resource_limits.max_cpu_time_sec,
+            max_wall_time_sec=original.resource_limits.max_wall_time_sec,
+            max_file_size_mb=original.resource_limits.max_file_size_mb,
+            max_open_files=original.resource_limits.max_open_files,
+            max_processes=original.resource_limits.max_processes,
+            network_enabled=original.resource_limits.network_enabled,
+            filesystem_read=original.resource_limits.filesystem_read,
+            filesystem_write=original.resource_limits.filesystem_write,
+        ),
+        require_signature=original.require_signature,
+        min_signatures=original.min_signatures,
+        allowed_signers=original.allowed_signers.copy(),
+        blocked_modules=original.blocked_modules.copy(),
+        allowed_permissions=original.allowed_permissions.copy(),
+    )
+
+
+def list_presets() -> list[dict[str, Any]]:
+    """List all available security presets.
+
+    Returns:
+        List of preset information dictionaries.
+    """
+    return [
+        {
+            "name": preset.value,
+            "description": _PRESET_POLICIES[preset].description,
+            "isolation_level": _PRESET_POLICIES[preset].isolation_level.value,
+            "require_signature": _PRESET_POLICIES[preset].require_signature,
+            "min_signatures": _PRESET_POLICIES[preset].min_signatures,
+        }
+        for preset in SecurityPolicyPresets
+    ]
+
+
+def create_policy(
+    preset: SecurityPolicyPresets | str = SecurityPolicyPresets.STANDARD,
+    *,
+    isolation_level: IsolationLevel | str | None = None,
+    max_memory_mb: int | None = None,
+    max_cpu_time_sec: int | None = None,
+    max_wall_time_sec: int | None = None,
+    network_enabled: bool | None = None,
+    filesystem_read: bool | None = None,
+    filesystem_write: bool | None = None,
+    require_signature: bool | None = None,
+    min_signatures: int | None = None,
+    allowed_signers: list[str] | None = None,
+    blocked_modules: list[str] | None = None,
+    allowed_permissions: list[str] | None = None,
+) -> SecurityPolicy:
+    """Create a customized security policy based on a preset.
+
+    Args:
+        preset: Base preset to customize.
+        isolation_level: Override isolation level.
+        max_memory_mb: Override memory limit.
+        max_cpu_time_sec: Override CPU time limit.
+        max_wall_time_sec: Override wall time limit.
+        network_enabled: Override network access.
+        filesystem_read: Override filesystem read.
+        filesystem_write: Override filesystem write.
+        require_signature: Override signature requirement.
+        min_signatures: Override minimum signatures.
+        allowed_signers: Override allowed signers.
+        blocked_modules: Override blocked modules.
+        allowed_permissions: Override allowed permissions.
+
+    Returns:
+        Customized SecurityPolicy.
+    """
+    policy = get_preset(preset)
+
+    # Override isolation level
+    if isolation_level is not None:
+        if isinstance(isolation_level, str):
+            isolation_level = IsolationLevel(isolation_level)
+        policy.isolation_level = isolation_level
+
+    # Override resource limits
+    if max_memory_mb is not None:
+        policy.resource_limits.max_memory_mb = max_memory_mb
+    if max_cpu_time_sec is not None:
+        policy.resource_limits.max_cpu_time_sec = max_cpu_time_sec
+    if max_wall_time_sec is not None:
+        policy.resource_limits.max_wall_time_sec = max_wall_time_sec
+    if network_enabled is not None:
+        policy.resource_limits.network_enabled = network_enabled
+    if filesystem_read is not None:
+        policy.resource_limits.filesystem_read = filesystem_read
+    if filesystem_write is not None:
+        policy.resource_limits.filesystem_write = filesystem_write
+
+    # Override signature requirements
+    if require_signature is not None:
+        policy.require_signature = require_signature
+    if min_signatures is not None:
+        policy.min_signatures = min_signatures
+    if allowed_signers is not None:
+        policy.allowed_signers = allowed_signers
+
+    # Override module restrictions
+    if blocked_modules is not None:
+        policy.blocked_modules = blocked_modules
+    if allowed_permissions is not None:
+        policy.allowed_permissions = allowed_permissions
+
+    return policy

truthound_dashboard/core/plugins/security/protocols.py

@@ -0,0 +1,296 @@
+"""Security Protocol Definitions.
+
+This module defines the core protocols and data types for the
+enterprise plugin security system.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from datetime import datetime
+from enum import Enum
+from typing import Any, Protocol
+
+
+class IsolationLevel(str, Enum):
+    """Sandbox isolation levels."""
+
+    NONE = "none"           # No isolation (trusted plugins only)
+    PROCESS = "process"     # Subprocess isolation with resource limits
+    CONTAINER = "container" # Docker/Podman container isolation
+
+
+class TrustLevel(str, Enum):
+    """Plugin trust levels."""
+
+    TRUSTED = "trusted"         # Signed by trusted authority, no issues
+    VERIFIED = "verified"       # Signature valid but has warnings
+    UNVERIFIED = "unverified"   # No signature or invalid
+    SANDBOXED = "sandboxed"     # Must run in sandbox due to issues
+
+
+class SignatureAlgorithm(str, Enum):
+    """Supported signature algorithms."""
+
+    SHA256 = "sha256"           # Simple hash (integrity only)
+    SHA512 = "sha512"           # Simple hash (integrity only)
+    HMAC_SHA256 = "hmac_sha256" # Symmetric key
+    HMAC_SHA512 = "hmac_sha512" # Symmetric key
+    RSA_SHA256 = "rsa_sha256"   # Asymmetric (public key)
+    ED25519 = "ed25519"         # Modern asymmetric (recommended)
+
+
+@dataclass
+class ResourceLimits:
+    """Resource limits for sandbox execution.
+
+    Attributes:
+        max_memory_mb: Maximum memory in megabytes.
+        max_cpu_time_sec: Maximum CPU time in seconds.
+        max_wall_time_sec: Maximum wall clock time in seconds.
+        max_file_size_mb: Maximum file size in megabytes.
+        max_open_files: Maximum number of open files.
+        max_processes: Maximum number of processes.
+        network_enabled: Whether network access is allowed.
+        filesystem_read: Whether filesystem read is allowed.
+        filesystem_write: Whether filesystem write is allowed.
+    """
+
+    max_memory_mb: int = 256
+    max_cpu_time_sec: int = 30
+    max_wall_time_sec: int = 60
+    max_file_size_mb: int = 10
+    max_open_files: int = 10
+    max_processes: int = 1
+    network_enabled: bool = False
+    filesystem_read: bool = False
+    filesystem_write: bool = False
+
+
+@dataclass
+class SecurityPolicy:
+    """Security policy configuration.
+
+    Attributes:
+        name: Policy name.
+        description: Policy description.
+        isolation_level: Required isolation level.
+        resource_limits: Resource limits.
+        require_signature: Whether signature is required.
+        min_signatures: Minimum number of valid signatures.
+        allowed_signers: List of allowed signer IDs (empty = any).
+        blocked_modules: Blocked Python modules.
+        allowed_permissions: Allowed permission types.
+    """
+
+    name: str
+    description: str = ""
+    isolation_level: IsolationLevel = IsolationLevel.PROCESS
+    resource_limits: ResourceLimits = field(default_factory=ResourceLimits)
+    require_signature: bool = False
+    min_signatures: int = 0
+    allowed_signers: list[str] = field(default_factory=list)
+    blocked_modules: list[str] = field(default_factory=lambda: [
+        "os", "subprocess", "sys", "shutil", "socket",
+        "http", "urllib", "requests", "httpx",
+        "multiprocessing", "threading", "ctypes",
+        "pickle", "shelve", "sqlite3", "importlib",
+    ])
+    allowed_permissions: list[str] = field(default_factory=list)
+
+    def to_dict(self) -> dict[str, Any]:
+        """Convert to dictionary."""
+        return {
+            "name": self.name,
+            "description": self.description,
+            "isolation_level": self.isolation_level.value,
+            "resource_limits": {
+                "max_memory_mb": self.resource_limits.max_memory_mb,
+                "max_cpu_time_sec": self.resource_limits.max_cpu_time_sec,
+                "max_wall_time_sec": self.resource_limits.max_wall_time_sec,
+                "max_file_size_mb": self.resource_limits.max_file_size_mb,
+                "max_open_files": self.resource_limits.max_open_files,
+                "max_processes": self.resource_limits.max_processes,
+                "network_enabled": self.resource_limits.network_enabled,
+                "filesystem_read": self.resource_limits.filesystem_read,
+                "filesystem_write": self.resource_limits.filesystem_write,
+            },
+            "require_signature": self.require_signature,
+            "min_signatures": self.min_signatures,
+            "allowed_signers": self.allowed_signers,
+            "blocked_modules": self.blocked_modules,
+            "allowed_permissions": self.allowed_permissions,
+        }
+
+    @classmethod
+    def from_dict(cls, data: dict[str, Any]) -> "SecurityPolicy":
+        """Create from dictionary."""
+        limits_data = data.get("resource_limits", {})
+        return cls(
+            name=data["name"],
+            description=data.get("description", ""),
+            isolation_level=IsolationLevel(data.get("isolation_level", "process")),
+            resource_limits=ResourceLimits(
+                max_memory_mb=limits_data.get("max_memory_mb", 256),
+                max_cpu_time_sec=limits_data.get("max_cpu_time_sec", 30),
+                max_wall_time_sec=limits_data.get("max_wall_time_sec", 60),
+                max_file_size_mb=limits_data.get("max_file_size_mb", 10),
+                max_open_files=limits_data.get("max_open_files", 10),
+                max_processes=limits_data.get("max_processes", 1),
+                network_enabled=limits_data.get("network_enabled", False),
+                filesystem_read=limits_data.get("filesystem_read", False),
+                filesystem_write=limits_data.get("filesystem_write", False),
+            ),
+            require_signature=data.get("require_signature", False),
+            min_signatures=data.get("min_signatures", 0),
+            allowed_signers=data.get("allowed_signers", []),
+            blocked_modules=data.get("blocked_modules", []),
+            allowed_permissions=data.get("allowed_permissions", []),
+        )
+
+
+@dataclass
+class SignatureInfo:
+    """Information about a plugin signature.
+
+    Attributes:
+        algorithm: Signature algorithm used.
+        signature: The signature value (hex or base64).
+        signer_id: ID of the signer.
+        timestamp: When the signature was created.
+        certificate: Optional certificate chain.
+        metadata: Additional metadata.
+    """
+
+    algorithm: SignatureAlgorithm
+    signature: str
+    signer_id: str
+    timestamp: datetime = field(default_factory=datetime.utcnow)
+    certificate: str | None = None
+    metadata: dict[str, Any] = field(default_factory=dict)
+
+    def to_dict(self) -> dict[str, Any]:
+        """Convert to dictionary."""
+        return {
+            "algorithm": self.algorithm.value,
+            "signature": self.signature,
+            "signer_id": self.signer_id,
+            "timestamp": self.timestamp.isoformat(),
+            "certificate": self.certificate,
+            "metadata": self.metadata,
+        }
+
+    @classmethod
+    def from_dict(cls, data: dict[str, Any]) -> "SignatureInfo":
+        """Create from dictionary."""
+        return cls(
+            algorithm=SignatureAlgorithm(data["algorithm"]),
+            signature=data["signature"],
+            signer_id=data["signer_id"],
+            timestamp=datetime.fromisoformat(data["timestamp"]),
+            certificate=data.get("certificate"),
+            metadata=data.get("metadata", {}),
+        )
+
+
+@dataclass
+class VerificationResult:
+    """Result of signature verification.
+
+    Attributes:
+        is_valid: Whether verification succeeded.
+        trust_level: Determined trust level.
+        signer_id: ID of the verified signer.
+        algorithm: Algorithm used.
+        errors: List of error messages.
+        warnings: List of warning messages.
+        verified_at: When verification was performed.
+        metadata: Additional verification metadata.
+    """
+
+    is_valid: bool
+    trust_level: TrustLevel = TrustLevel.UNVERIFIED
+    signer_id: str | None = None
+    algorithm: SignatureAlgorithm | None = None
+    errors: list[str] = field(default_factory=list)
+    warnings: list[str] = field(default_factory=list)
+    verified_at: datetime = field(default_factory=datetime.utcnow)
+    metadata: dict[str, Any] = field(default_factory=dict)
+
+    def to_dict(self) -> dict[str, Any]:
+        """Convert to dictionary."""
+        return {
+            "is_valid": self.is_valid,
+            "trust_level": self.trust_level.value,
+            "signer_id": self.signer_id,
+            "algorithm": self.algorithm.value if self.algorithm else None,
+            "errors": self.errors,
+            "warnings": self.warnings,
+            "verified_at": self.verified_at.isoformat(),
+            "metadata": self.metadata,
+        }
+
+
+class ISigningService(Protocol):
+    """Protocol for signing services."""
+
+    def sign(
+        self,
+        data: bytes,
+        private_key: bytes,
+        signer_id: str,
+    ) -> SignatureInfo:
+        """Sign data and return signature info."""
+        ...
+
+    def verify(
+        self,
+        data: bytes,
+        signature_info: SignatureInfo,
+        public_key: bytes | None = None,
+    ) -> VerificationResult:
+        """Verify a signature."""
+        ...
+
+
+class ITrustStore(Protocol):
+    """Protocol for trust stores."""
+
+    def add_signer(
+        self,
+        signer_id: str,
+        public_key: bytes,
+        trust_level: TrustLevel,
+        metadata: dict[str, Any] | None = None,
+    ) -> None:
+        """Add a trusted signer."""
+        ...
+
+    def remove_signer(self, signer_id: str) -> None:
+        """Remove a signer."""
+        ...
+
+    def get_trust_level(self, signer_id: str) -> TrustLevel | None:
+        """Get trust level for a signer."""
+        ...
+
+    def get_public_key(self, signer_id: str) -> bytes | None:
+        """Get public key for a signer."""
+        ...
+
+    def is_trusted(self, signer_id: str) -> bool:
+        """Check if signer is trusted."""
+        ...
+
+
+class IVerificationChain(Protocol):
+    """Protocol for verification chains."""
+
+    def verify(
+        self,
+        data: bytes,
+        signatures: list[SignatureInfo],
+        context: dict[str, Any] | None = None,
+    ) -> VerificationResult:
+        """Verify signatures using the chain."""
+        ...