aios/active-runtime/app/aios_owner_merge_authorization_server.py

"""Restricted issuance service for ``aios.owner-merge-approval.v2``.

The service has one Owner-only operation.  It accepts an empty request payload,
loads one immutable policy, generates approval identifiers and nonces itself,
and stores one exact issuance response.  It deliberately does not expose a
generic signing, payload, or policy-selection API.
"""
from __future__ import annotations

import json
import os
from pathlib import Path
import sqlite3
import stat
import time
from typing import Any, Callable, Mapping

from aios_owner_merge_authorization import (
    OwnerMergeApprovalAuthority,
    OwnerMergeApprovalError,
    OwnerMergeApprovalPolicy,
    OwnerMergeApprovalVerifier,
)
from aios_single_host_authority import RegistryOwnerApprovalVerifier, SignedArtifact


ISSUE_OPERATION = "issue_owner_merge_approval"


def _fail(code: str) -> None:
    raise OwnerMergeApprovalError(code)


def _secure_regular(path: Path, *, require_root_owner: bool) -> None:
    try:
        metadata = path.lstat()
    except OSError as exc:
        raise OwnerMergeApprovalError("OWNER_MERGE_ISSUER_FILE_MISSING") from exc
    if path.is_symlink() or not stat.S_ISREG(metadata.st_mode):
        _fail("OWNER_MERGE_ISSUER_FILE_INVALID")
    if stat.S_IMODE(metadata.st_mode) & 0o022:
        _fail("OWNER_MERGE_ISSUER_FILE_WRITABLE")
    if require_root_owner and metadata.st_uid != 0:
        _fail("OWNER_MERGE_ISSUER_FILE_NOT_ROOT_OWNED")


def _read_policy(path: Path, *, require_root_owner: bool) -> OwnerMergeApprovalPolicy:
    _secure_regular(path, require_root_owner=require_root_owner)
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (OSError, UnicodeDecodeError, json.JSONDecodeError) as exc:
        raise OwnerMergeApprovalError("OWNER_MERGE_ISSUER_POLICY_INVALID") from exc
    if not isinstance(value, Mapping):
        _fail("OWNER_MERGE_ISSUER_POLICY_INVALID")
    expected = set(OwnerMergeApprovalPolicy.__dataclass_fields__)
    if set(value) != expected or not isinstance(value.get("required_checks"), list):
        _fail("OWNER_MERGE_ISSUER_POLICY_INVALID")
    try:
        policy = OwnerMergeApprovalPolicy(
            repository=value["repository"],
            pr_number=value["pr_number"],
            pr_head_oid=value["pr_head_oid"],
            expected_main_oid=value["expected_main_oid"],
            operation=value["operation"],
            required_check_contract_digest=value["required_check_contract_digest"],
            required_checks=tuple(value["required_checks"]),
            owner_identity=value["owner_identity"],
            audit_lineage_digest=value["audit_lineage_digest"],
            maximum_ttl_seconds=value["maximum_ttl_seconds"],
            policy_version=value["policy_version"],
            schema=value["schema"],
        )
        policy.validate()
    except (KeyError, TypeError, OwnerMergeApprovalError) as exc:
        if isinstance(exc, OwnerMergeApprovalError):
            raise OwnerMergeApprovalError("OWNER_MERGE_ISSUER_POLICY_INVALID") from exc
        raise OwnerMergeApprovalError("OWNER_MERGE_ISSUER_POLICY_INVALID") from exc
    return policy


def _artifact_dict(artifact: SignedArtifact) -> dict[str, Any]:
    return {
        "payload": dict(artifact.payload),
        "signature": artifact.signature,
        "key_id": artifact.key_id,
        "namespace": artifact.namespace,
    }


class SQLiteOwnerMergeIssuanceLedger:
    """Durably replay a current approval and retain expired issuance history."""

    def __init__(self, path: Path) -> None:
        self.path = Path(path)

    def _connect(self) -> sqlite3.Connection:
        if self.path.is_symlink() or self.path.parent.is_symlink():
            _fail("OWNER_MERGE_ISSUER_LEDGER_PATH_INVALID")
        self.path.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
        connection = sqlite3.connect(self.path, timeout=5, isolation_level=None)
        connection.execute(
            "CREATE TABLE IF NOT EXISTS owner_merge_issuance ("
            "nonce TEXT PRIMARY KEY, policy_digest TEXT NOT NULL, response_json TEXT NOT NULL, "
            "issued_at INTEGER NOT NULL, expires_at INTEGER NOT NULL)"
        )
        connection.execute(
            "CREATE INDEX IF NOT EXISTS owner_merge_issuance_policy_expiry "
            "ON owner_merge_issuance(policy_digest, expires_at)"
        )
        return connection

    def issue_once(
        self,
        *,
        policy_digest: str,
        now: int,
        issuer: Callable[[], dict[str, Any]],
        validate_current: Callable[[dict[str, Any]], None],
        expiry_of: Callable[[dict[str, Any]], int],
    ) -> tuple[dict[str, Any], bool]:
        connection = self._connect()
        try:
            connection.execute("BEGIN IMMEDIATE")
            rows = connection.execute(
                "SELECT response_json, expires_at FROM owner_merge_issuance "
                "WHERE policy_digest=? AND expires_at>? ORDER BY issued_at DESC",
                (policy_digest, now),
            ).fetchall()
            if len(rows) > 1:
                connection.rollback()
                _fail("OWNER_MERGE_ISSUER_LEDGER_INVALID")
            if rows:
                try:
                    response = json.loads(rows[0][0])
                except (TypeError, json.JSONDecodeError) as exc:
                    connection.rollback()
                    raise OwnerMergeApprovalError("OWNER_MERGE_ISSUER_LEDGER_INVALID") from exc
                if not isinstance(response, dict):
                    connection.rollback()
                    _fail("OWNER_MERGE_ISSUER_LEDGER_INVALID")
                if type(rows[0][1]) is not int or expiry_of(response) != rows[0][1]:
                    connection.rollback()
                    _fail("OWNER_MERGE_ISSUER_LEDGER_INVALID")
                validate_current(response)
                connection.rollback()
                return response, True
            response = issuer()
            expires_at = expiry_of(response)
            if expires_at <= now:
                connection.rollback()
                _fail("OWNER_MERGE_ISSUER_RESPONSE_EXPIRED")
            artifact = response.get("artifact")
            if not isinstance(artifact, Mapping):
                connection.rollback()
                _fail("OWNER_MERGE_ISSUER_LEDGER_INVALID")
            payload = artifact.get("payload")
            if not isinstance(payload, Mapping) or not isinstance(payload.get("nonce"), str):
                connection.rollback()
                _fail("OWNER_MERGE_ISSUER_LEDGER_INVALID")
            encoded = json.dumps(
                response,
                ensure_ascii=False,
                sort_keys=True,
                separators=(",", ":"),
                allow_nan=False,
            )
            connection.execute(
                "INSERT INTO owner_merge_issuance(nonce,policy_digest,response_json,issued_at,expires_at) "
                "VALUES(?,?,?,?,?)",
                (payload["nonce"], policy_digest, encoded, now, expires_at),
            )
            connection.commit()
            return response, False
        except OwnerMergeApprovalError:
            raise
        except sqlite3.IntegrityError as exc:
            try:
                connection.rollback()
            except sqlite3.Error:
                pass
            raise OwnerMergeApprovalError("OWNER_MERGE_ISSUER_NONCE_CONFLICT") from exc
        except sqlite3.Error as exc:
            try:
                connection.rollback()
            except sqlite3.Error:
                pass
            raise OwnerMergeApprovalError("OWNER_MERGE_ISSUER_LEDGER_UNAVAILABLE") from exc
        finally:
            connection.close()


class OwnerMergeApprovalService:
    """A formal structured adapter, not an arbitrary signing oracle."""

    def __init__(
        self,
        *,
        policy_path: Path,
        registry_path: Path,
        owner_key_path: Path,
        issuance_ledger_path: Path,
        allowed_uids: tuple[int, ...],
        require_root_owner: bool = True,
        clock: Callable[[], float] = time.time,
        token_urlsafe: Callable[[int], str] | None = None,
    ) -> None:
        if not allowed_uids or any(type(uid) is not int or uid < 0 for uid in allowed_uids):
            _fail("OWNER_MERGE_ISSUER_ALLOWED_UIDS_INVALID")
        self.policy_path = Path(policy_path)
        self.registry_path = Path(registry_path)
        self.owner_key_path = Path(owner_key_path)
        self.allowed_uids = tuple(allowed_uids)
        self.require_root_owner = require_root_owner
        self.clock = clock
        self.token_urlsafe = token_urlsafe
        self.ledger = SQLiteOwnerMergeIssuanceLedger(issuance_ledger_path)

    def handle(self, request: Mapping[str, Any], *, peer_uid: int) -> dict[str, Any]:
        if peer_uid not in self.allowed_uids:
            _fail("OWNER_MERGE_ISSUER_PEER_UID_FORBIDDEN")
        if not isinstance(request, Mapping) or set(request) != {"operation", "payload"}:
            _fail("OWNER_MERGE_ISSUER_REQUEST_INVALID")
        if request.get("operation") != ISSUE_OPERATION:
            _fail("OWNER_MERGE_ISSUER_OPERATION_FORBIDDEN")
        if request.get("payload") != {}:
            _fail("OWNER_MERGE_ISSUER_REQUEST_FIELDS_INVALID")

        policy = _read_policy(
            self.policy_path,
            require_root_owner=self.require_root_owner,
        )
        _secure_regular(
            self.owner_key_path,
            require_root_owner=self.require_root_owner,
        )
        primary = RegistryOwnerApprovalVerifier(
            self.registry_path,
            require_root_owner=self.require_root_owner,
        )
        verifier = OwnerMergeApprovalVerifier(primary=primary, clock=self.clock)

        def expiry_of(response: dict[str, Any]) -> int:
            if set(response) != {"status", "artifact"} or response.get("status") != "PASS":
                _fail("OWNER_MERGE_ISSUER_LEDGER_INVALID")
            artifact = response.get("artifact")
            if not isinstance(artifact, Mapping):
                _fail("OWNER_MERGE_ISSUER_LEDGER_INVALID")
            payload = artifact.get("payload")
            if not isinstance(payload, Mapping) or type(payload.get("expires_at")) is not int:
                _fail("OWNER_MERGE_ISSUER_LEDGER_INVALID")
            return payload["expires_at"]

        def validate_current(response: dict[str, Any]) -> None:
            expiry_of(response)
            artifact = response["artifact"]
            if not isinstance(artifact, Mapping):
                _fail("OWNER_MERGE_ISSUER_LEDGER_INVALID")
            try:
                verifier.verify(artifact, policy)
            except OwnerMergeApprovalError as exc:
                raise OwnerMergeApprovalError("OWNER_MERGE_ISSUER_LEDGER_INVALID") from exc

        def issue() -> dict[str, Any]:
            kwargs: dict[str, Any] = {}
            if self.token_urlsafe is not None:
                kwargs["token_urlsafe"] = self.token_urlsafe
            artifact = OwnerMergeApprovalAuthority(
                self.owner_key_path,
                policy,
                require_root_owner=self.require_root_owner,
                clock=self.clock,
                **kwargs,
            ).issue()
            value = _artifact_dict(artifact)
            verifier.verify(value, policy)
            return {"status": "PASS", "artifact": value}

        response, idempotent = self.ledger.issue_once(
            policy_digest=policy.digest,
            now=int(self.clock()),
            issuer=issue,
            validate_current=validate_current,
            expiry_of=expiry_of,
        )
        if set(response) != {"status", "artifact"} or response.get("status") != "PASS":
            _fail("OWNER_MERGE_ISSUER_LEDGER_INVALID")
        return {**response, "idempotent": idempotent}