154 lines
6.1 KiB
Bash
Executable File
154 lines
6.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# CASAN Level 5 tool registry gate.
|
|
# Usage:
|
|
# tool-registry-gate.sh <tool-id>
|
|
|
|
TOOL_ID="${1:-}"
|
|
if [[ -z "$TOOL_ID" ]]; then
|
|
echo "Usage: tool-registry-gate.sh <tool-id>" >&2
|
|
exit 64
|
|
fi
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
source "$SCRIPT_DIR/casan-paths.sh"
|
|
PROJECT_ROOT="$CASAN_APP_ROOT"
|
|
REGISTRY="$CASAN_HARNESS_ROOT/config/tool-registry.yaml"
|
|
LOG_DIR="$CASAN_STATE_ROOT/logs/level5"
|
|
AUDIT_DIR="$CASAN_STATE_ROOT/logs/audit"
|
|
mkdir -p "$LOG_DIR" "$AUDIT_DIR"
|
|
TRACE_ID="$(uuidgen 2>/dev/null | tr '[:upper:]' '[:lower:]' || printf 'tool-%s-%s' "$(date +%s)" "$$")"
|
|
|
|
# shellcheck source=tool-audit-lib.sh
|
|
source "$SCRIPT_DIR/tool-audit-lib.sh"
|
|
|
|
AUDIT_TMP="$(mktemp)"
|
|
trap 'rm -f "$AUDIT_TMP"' EXIT
|
|
|
|
# SEC-10 (M-05): the effective agent identity used for least-privilege authz.
|
|
# Dev (default) trusts CASAN_AGENT (backward compatible). In enforced mode the env
|
|
# is NOT trusted — the caller must present a signed token proving it is that agent
|
|
# (bound to agent id + run id); otherwise it is treated as UNAUTHENTICATED (empty),
|
|
# which denies any restricted tool. This stops `CASAN_AGENT=release-manager` spoofing.
|
|
RUN_ID="${CASAN_RUN_ID:-adhoc-$$}"
|
|
EFFECTIVE_AGENT="${CASAN_AGENT:-}"
|
|
if [[ "${CASAN_PROFILE:-}" == "prod" || "${CASAN_IDENTITY_STRICT:-}" == "1" ]]; then
|
|
EFFECTIVE_AGENT="" # unauthenticated until a valid token proves otherwise
|
|
CLAIM="${CASAN_AGENT:-}"
|
|
SIG="${CASAN_AGENT_SIG:-}"
|
|
REG="${CASAN_AGENT_REGISTRY:-$CASAN_GOVERNANCE_ROOT/agent-identities.registry}"
|
|
KEYS_DIR="${CASAN_AGENT_KEYS_DIR:-$CASAN_GOVERNANCE_ROOT/agents}"
|
|
if [[ -n "$CLAIM" && -n "$SIG" && -f "$SIG" && -f "$REG" ]] && command -v openssl >/dev/null 2>&1; then
|
|
PUB_REL="$(awk -v id="$CLAIM" '$1=="agent" && $2==id {print $3; exit}' "$REG")"
|
|
if [[ -n "$PUB_REL" ]]; then
|
|
PUB="$PUB_REL"; [[ "$PUB" = /* ]] || PUB="$KEYS_DIR/$PUB_REL"
|
|
TMPM="$(mktemp)"; printf '%s' "casan-agent|v1|$CLAIM|$RUN_ID" > "$TMPM"
|
|
if [[ -f "$PUB" ]] && openssl dgst -sha256 -verify "$PUB" -signature "$SIG" "$TMPM" >/dev/null 2>&1; then
|
|
EFFECTIVE_AGENT="$CLAIM"
|
|
fi
|
|
rm -f "$TMPM"
|
|
fi
|
|
fi
|
|
fi
|
|
|
|
DECISION_LINE="$(python - "$REGISTRY" "$TOOL_ID" "${CASAN_IDEMPOTENCY_KEY:-}" "$LOG_DIR/tool-registry.jsonl" "$TRACE_ID" "$EFFECTIVE_AGENT" "$AUDIT_TMP" "$RUN_ID" <<'PY'
|
|
import json
|
|
import os
|
|
import re
|
|
import sys
|
|
from datetime import datetime, timezone
|
|
|
|
registry_path, tool_id, idempotency_key, log_path, trace_id, agent, audit_tmp, run_id = sys.argv[1:]
|
|
text = open(registry_path, encoding="utf-8").read()
|
|
blocks = re.split(r"\n\s*-\s+id:\s+", text)
|
|
tools = {}
|
|
for block in blocks[1:]:
|
|
lines = block.splitlines()
|
|
current_id = lines[0].strip()
|
|
attrs = {"id": current_id, "has_rollback": "strategy:" in block}
|
|
for line in lines[1:]:
|
|
if ":" in line and not line.startswith(" "):
|
|
key, value = line.split(":", 1)
|
|
attrs[key.strip()] = value.strip().strip('"')
|
|
tools[current_id] = attrs
|
|
|
|
tool = tools.get(tool_id)
|
|
decision, reason = "approved", "registered"
|
|
|
|
if not tool:
|
|
decision, reason = "denied", "unknown_tool"
|
|
side_effect = idem_required = False
|
|
owner = risk = ""
|
|
allowed = ""
|
|
else:
|
|
side_effect = tool.get("side_effect", "false") == "true"
|
|
idem_required = tool.get("idempotency_required", "false") == "true"
|
|
owner = tool.get("owner", "")
|
|
risk = tool.get("risk_level", "")
|
|
allowed = tool.get("allowed_agents", "")
|
|
allowed_list = [a.strip() for a in allowed.split(",") if a.strip()]
|
|
|
|
# 1. Per-agent least-privilege: restricted tools require an authorized caller.
|
|
if allowed_list:
|
|
if not agent:
|
|
decision, reason = "denied", "missing_agent_identity"
|
|
elif agent not in allowed_list:
|
|
decision, reason = "denied", "unauthorized_agent"
|
|
# 2. Side-effecting + idempotency-required tools must carry an idempotency key.
|
|
if decision == "approved" and side_effect and idem_required and not idempotency_key:
|
|
decision, reason = "denied", "missing_idempotency_key"
|
|
# 3. Every side-effecting tool must declare a rollback strategy.
|
|
if decision == "approved" and side_effect and not tool.get("has_rollback"):
|
|
decision, reason = "denied", "missing_rollback_strategy"
|
|
# 4. Runtime rate limit: count prior APPROVED calls for this tool in this run.
|
|
if decision == "approved" and tool.get("rate_limit_per_run", "").isdigit():
|
|
limit = int(tool["rate_limit_per_run"])
|
|
prior = 0
|
|
if os.path.exists(log_path):
|
|
for line in open(log_path, encoding="utf-8"):
|
|
try:
|
|
r = json.loads(line)
|
|
except ValueError:
|
|
continue
|
|
if (r.get("tool_id") == tool_id and r.get("run_id") == run_id
|
|
and r.get("decision") == "approved"):
|
|
prior += 1
|
|
if prior >= limit:
|
|
decision, reason = "denied", f"rate_limit_exceeded(limit={limit})"
|
|
|
|
ts = datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
|
|
record = {
|
|
"timestamp": ts, "trace_id": trace_id, "harness": "L5-tool-registry",
|
|
"tool_id": tool_id, "agent": agent, "run_id": run_id, "owner": owner, "risk_level": risk,
|
|
"side_effect": side_effect, "idempotency_required": idem_required,
|
|
"idempotency_key_present": bool(idempotency_key),
|
|
"decision": decision, "reason": reason,
|
|
}
|
|
with open(log_path, "a", encoding="utf-8") as f:
|
|
f.write(json.dumps(record) + "\n")
|
|
|
|
# Tamper-evident central audit record (appended + signed by the bash caller).
|
|
with open(audit_tmp, "w", encoding="utf-8") as f:
|
|
f.write(json.dumps({
|
|
"timestamp": ts, "trace_id": trace_id, "tool": tool_id, "agent": agent,
|
|
"idempotency_key": idempotency_key, "decision": decision, "reason": reason,
|
|
"risk_level": risk, "owner": owner,
|
|
}))
|
|
|
|
print(f"{decision} {reason}")
|
|
PY
|
|
)"
|
|
|
|
DECISION="${DECISION_LINE%% *}"
|
|
REASON="${DECISION_LINE#* }"
|
|
|
|
append_tool_audit "$(cat "$AUDIT_TMP")" "$PROJECT_ROOT"
|
|
|
|
if [[ "$DECISION" == "approved" ]]; then
|
|
echo "TOOL_APPROVED tool=$TOOL_ID reason=$REASON"
|
|
else
|
|
echo "TOOL_DENIED tool=$TOOL_ID reason=$REASON" >&2
|
|
exit 2
|
|
fi
|