thanhnvandClaude Opus 4.8
3adc48ed82
Resolve every root by marker walk-up instead of a fixed depth that only lands on the app via the .specify compat symlink, so the harness runs correctly when invoked by its real packages/casan-harness path — proven by a full gate run via that path: 64/0/0. - 95 scripts/tests: PROJECT_ROOT/ROOT "$SCRIPT_DIR/../.."-style computations -> $CASAN_APP_ROOT. - 6 leaf scripts (infra-lab, context-validate, secrets-scan, path-guard, toolchain-verify, phase2-sourcegen) now source casan-paths + use CASAN_APP_ROOT. - run-casan4: source casan-paths as a package sibling (facade-independent), PROJECT_ROOT=CASAN_APP_ROOT. - 8 Python files: project_root()/REPO_ROOT/bundle_root walk UP for the .specify marker (control-plane-settings, loop_common, model-call, context-compress, test-integrity, bundle-integrity, traceability-matrix; generate-* fixed earlier). - evidence-pack-build.py + traceability-matrix.py: domain refs -> apps/okr/domain (input/, corpus/redteam-vectors.jsonl, traceability-map.json). - ci-harness-gate.sh: export CASAN_TESTS_DIR/CASAN_TEST_MANIFEST/CASAN_BUNDLE_ROOT so the integrity Python resolves via the harness root regardless of invocation path; ROOT=CASAN_APP_ROOT. - Remove the domain compat symlinks from packages/casan-harness/security (redteam-corpus, redteam-vectors, benign-corpus) — packages now holds NO domain data. Both invocation paths pass (compat facade still present): .specify/... and packages/... Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
92 lines
3.0 KiB
Bash
92 lines
3.0 KiB
Bash
#!/usr/bin/env bash
|
|
set -uo pipefail
|
|
|
|
# CASAN Plan-16 SEC-23 (MT-01) — tenant-partitioned state store + cross-tenant guard.
|
|
#
|
|
# Harness state (audit chains, control-plane settings, telemetry, logs, kill-switch)
|
|
# used to live in SHARED global files, so a run for tenant A could read/modify
|
|
# tenant B's state directly — bypassing RBAC (which only guarded the API, not the
|
|
# files). This resolves every state path under a per-tenant root and refuses any
|
|
# access that escapes the caller's own tenant partition (reusing the SEC-28 realpath
|
|
# guard). Deny-by-default; secure-by-default in prod (missing tenant = fail-closed).
|
|
#
|
|
# Tenant id: CASAN_TENANT_ID (allowlist [A-Za-z0-9_-]+, no path traversal). Unset →
|
|
# 'default' in dev, but REFUSED under CASAN_PROFILE=prod.
|
|
#
|
|
# Usage:
|
|
# tenant-store.sh id # print resolved tenant id
|
|
# tenant-store.sh root # print this tenant's state root (0700)
|
|
# tenant-store.sh init # create tenant root with 0700 perms
|
|
# tenant-store.sh resolve <logical-name> # print tenant-scoped path for a state file
|
|
# tenant-store.sh guard <path> # exit 0 if path is inside own tenant root, else DENY
|
|
# Env: CASAN_TENANT_STATE_ROOT (default .specify/state/tenants)
|
|
# Exit: 0 ok · 3 denied (reason on stderr) · 64 usage.
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
source "$SCRIPT_DIR/casan-paths.sh"
|
|
PROJECT_ROOT="$CASAN_APP_ROOT"
|
|
STATE_ROOT="${CASAN_TENANT_STATE_ROOT:-$CASAN_STATE_ROOT/state/tenants}"
|
|
|
|
die() { echo "TENANT_DENIED reason=$1" >&2; exit 3; }
|
|
|
|
resolve_tenant_id() {
|
|
local t="${CASAN_TENANT_ID:-}"
|
|
if [[ -z "$t" ]]; then
|
|
[[ "${CASAN_PROFILE:-}" == "prod" ]] && die "tenant_id_required_in_prod"
|
|
t="default"
|
|
fi
|
|
[[ "$t" =~ ^[A-Za-z0-9_-]+$ ]] || die "tenant_id_invalid(${t})"
|
|
printf '%s' "$t"
|
|
}
|
|
|
|
tenant_root() {
|
|
local t; t="$(resolve_tenant_id)" || exit 3
|
|
printf '%s/%s' "$STATE_ROOT" "$t"
|
|
}
|
|
|
|
ensure_root() {
|
|
local root="$1"
|
|
mkdir -p "$root" || die "mkdir_failed(${root})"
|
|
chmod 700 "$STATE_ROOT" 2>/dev/null || true
|
|
chmod 700 "$root" 2>/dev/null || true
|
|
}
|
|
|
|
CMD="${1:-}"; shift || true
|
|
case "$CMD" in
|
|
id)
|
|
resolve_tenant_id; echo
|
|
;;
|
|
root)
|
|
tenant_root; echo
|
|
;;
|
|
init)
|
|
root="$(tenant_root)" || exit 3
|
|
ensure_root "$root"
|
|
echo "$root"
|
|
;;
|
|
resolve)
|
|
name="${1:-}"; [[ -n "$name" ]] || die "logical_name_required"
|
|
case "$name" in
|
|
/*|*..*) die "logical_name_invalid(${name})" ;;
|
|
esac
|
|
root="$(tenant_root)" || exit 3
|
|
ensure_root "$root"
|
|
mkdir -p "$(dirname "$root/$name")" 2>/dev/null || true
|
|
printf '%s/%s\n' "$root" "$name"
|
|
;;
|
|
guard)
|
|
target="${1:-}"; [[ -n "$target" ]] || die "target_required"
|
|
root="$(tenant_root)" || exit 3
|
|
ensure_root "$root"
|
|
if bash "$SCRIPT_DIR/path-guard.sh" "$target" "$root" >/dev/null 2>&1; then
|
|
echo "TENANT_OK path within own tenant root"
|
|
exit 0
|
|
fi
|
|
die "cross_tenant_access(target=${target})"
|
|
;;
|
|
*)
|
|
echo "Usage: tenant-store.sh {id|root|init|resolve <name>|guard <path>}" >&2
|
|
exit 64
|
|
;;
|
|
esac
|