feat: add production deployment handoff controls

2026-07-10 16:41:14 +09:00
parent 7cea023dce
commit aa284e9bd4
14 changed files with 408 additions and 109 deletions
@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Contract tests for production handoff controls. Network calls are replaced by
+# a narrow aws stub so we test fail-closed command construction without cloud credentials.
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
+SHIP="$CASAN_HARNESS_ROOT/scripts/bash/audit-ship-s3.sh"
+WORK="$(mktemp -d)"; trap 'rm -rf "$WORK"' EXIT
+PASS=0; FAIL=0
+pass() { echo "PASS: $1"; PASS=$((PASS+1)); }
+fail() { echo "FAIL: $1"; FAIL=$((FAIL+1)); }
+rc() { set +e; "$@" >/dev/null 2>&1; local code=$?; set -e; echo "$code"; }
+
+mkdir -p "$WORK/bin"
+cat > "$WORK/bin/aws" <<'AWS'
+#!/usr/bin/env bash
+set -euo pipefail
+printf '%s\n' "$*" >> "${AWS_LOG:?}"
+if [[ "$1 $2" == "s3api get-object-lock-configuration" ]]; then
+  printf '%s\n' '{"ObjectLockConfiguration":{"ObjectLockEnabled":"Enabled","Rule":{"DefaultRetention":{"Mode":"COMPLIANCE","Days":365}}}}'
+fi
+if [[ "$1 $2" == "s3api head-object" ]]; then
+  exit 1
+fi
+AWS
+chmod +x "$WORK/bin/aws"
+printf '%064d\n' 0 > "$WORK/head.txt"
+
+AWS_LOG="$WORK/aws.log" PATH="$WORK/bin:$PATH" CASAN_PROFILE=prod \
+CASAN_S3_BUCKET=casan-production-audit CASAN_S3_REGION=ap-northeast-1 \
+CASAN_S3_RETENTION_DAYS=365 CASAN_S3_KMS_KEY_ID=alias/casan-audit bash "$SHIP" "$WORK/head.txt" >/dev/null 2>&1 \
+  && grep -q -- '--object-lock-mode COMPLIANCE' "$WORK/aws.log" \
+  && grep -q -- '--server-side-encryption aws:kms' "$WORK/aws.log" \
+  && grep -q -- '--ssekms-key-id alias/casan-audit' "$WORK/aws.log" \
+  && pass "S3 anchor uses COMPLIANCE Object Lock and SSE-KMS" || fail "S3 anchor missing immutable controls"
+
+[[ "$(rc env PATH="$WORK/bin:$PATH" CASAN_PROFILE=dev CASAN_S3_BUCKET=casan-production-audit CASAN_S3_REGION=ap-northeast-1 CASAN_S3_KMS_KEY_ID=alias/casan-audit bash "$SHIP" "$WORK/head.txt")" -ne 0 ]] \
+  && pass "non-production profile is refused" || fail "non-production profile accepted"
+
+cat > "$WORK/bin/aws" <<'AWS'
+#!/usr/bin/env bash
+if [[ "$1 $2" == "s3api get-object-lock-configuration" ]]; then
+  printf '%s\n' '{"ObjectLockConfiguration":{"ObjectLockEnabled":"Disabled","Rule":{"DefaultRetention":{"Mode":"COMPLIANCE","Days":365}}}}'
+fi
+AWS
+chmod +x "$WORK/bin/aws"
+[[ "$(rc env PATH="$WORK/bin:$PATH" CASAN_PROFILE=prod CASAN_S3_BUCKET=casan-production-audit CASAN_S3_REGION=ap-northeast-1 CASAN_S3_KMS_KEY_ID=alias/casan-audit bash "$SHIP" "$WORK/head.txt")" -ne 0 ]] \
+  && pass "bucket without Object Lock is refused" || fail "Object-Lock-free bucket accepted"
+
+printf 'not-a-digest\n' > "$WORK/bad-head.txt"
+[[ "$(rc env PATH="$WORK/bin:$PATH" CASAN_PROFILE=prod CASAN_S3_BUCKET=casan-production-audit CASAN_S3_REGION=ap-northeast-1 CASAN_S3_KMS_KEY_ID=alias/casan-audit bash "$SHIP" "$WORK/bad-head.txt")" -ne 0 ]] \
+  && pass "malformed audit head is refused" || fail "malformed audit head accepted"
+
+echo "===== PRODUCTION HANDOFF SUMMARY: PASS=$PASS FAIL=$FAIL ====="
+[[ "$FAIL" -eq 0 ]]