150 lines
5.7 KiB
Bash
Executable File
150 lines
5.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -uo pipefail
|
|
|
|
# CASAN H5 — Signed/JWT approval verifier (Approval-identity MVP · C4 / V20).
|
|
#
|
|
# Problem: high-risk approval used to trust a plain env var (CASAN_APPROVER=bob) —
|
|
# anyone who can set the env can "approve". This binds an approval to a REGISTERED
|
|
# reviewer's cryptographic identity: the reviewer must SIGN this exact request with
|
|
# their private key, AND their role must be authorized for the action class.
|
|
#
|
|
# The signed assertion is: casan-approval|v1|<action>|<actor>|<input_sha256>|<approver_id>
|
|
# — so a signature for one request/reviewer cannot be replayed for another.
|
|
#
|
|
# Usage:
|
|
# approval-verify.sh <action> <actor> <input-file> <approver-id> <sig-file>
|
|
# CASAN_APPROVAL_JWT=<rs256-jwt> approval-verify.sh <action> <actor> <input-file> <approver-id> -
|
|
# Registry (line format, no yaml dep):
|
|
# reviewer <id> <role> <pubkey-file>
|
|
# action <action-name|default> <comma,roles>
|
|
# Env: CASAN_REVIEWERS_FILE (default governance/reviewers.registry)
|
|
# CASAN_REVIEWERS_DIR (default governance/reviewers) — base dir for pubkey-file
|
|
# CASAN_APPROVAL_JWT (optional RS256 IdP token)
|
|
# CASAN_IDP_PUBLIC_KEY (default central-governance/idp-public.pem)
|
|
# Exit: 0 ok (prints "APPROVAL_OK role=<role>"), 3 deny (reason on stderr), 64 usage.
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
|
|
GOV_DIR="$PROJECT_ROOT/.specify/level5/central-governance"
|
|
REVIEWERS_FILE="${CASAN_REVIEWERS_FILE:-$GOV_DIR/reviewers.registry}"
|
|
REVIEWERS_DIR="${CASAN_REVIEWERS_DIR:-$GOV_DIR/reviewers}"
|
|
|
|
ACTION="${1:-}"; ACTOR="${2:-}"; INPUT_FILE="${3:-}"; APPROVER="${4:-}"; SIG_FILE="${5:-}"
|
|
if [[ -z "$ACTION" || -z "$ACTOR" || -z "$INPUT_FILE" || -z "$APPROVER" ]]; then
|
|
echo "Usage: approval-verify.sh <action> <actor> <input-file> <approver-id> <sig-file>" >&2
|
|
exit 64
|
|
fi
|
|
|
|
deny() { echo "APPROVAL_DENIED reason=$1 approver=$APPROVER action=$ACTION" >&2; exit 3; }
|
|
|
|
[[ -f "$INPUT_FILE" ]] || deny "input_file_missing"
|
|
[[ -f "$REVIEWERS_FILE" ]] || deny "reviewer_registry_missing"
|
|
command -v openssl >/dev/null 2>&1 || deny "openssl_unavailable"
|
|
|
|
hash_file() {
|
|
if command -v sha256sum >/dev/null 2>&1; then sha256sum "$1" | awk '{print $1}'
|
|
else shasum -a 256 "$1" | awk '{print $1}'; fi
|
|
}
|
|
|
|
INPUT_SHA="$(hash_file "$INPUT_FILE")"
|
|
|
|
# Role authorization for this action (fallback to the "default" action policy).
|
|
ROLES="$(awk -v a="$ACTION" '$1=="action" && $2==a {print $3; exit}' "$REVIEWERS_FILE")"
|
|
[[ -n "$ROLES" ]] || ROLES="$(awk '$1=="action" && $2=="default" {print $3; exit}' "$REVIEWERS_FILE")"
|
|
|
|
if [[ -n "${CASAN_APPROVAL_JWT:-}" ]]; then
|
|
IDP_PUB="${CASAN_IDP_PUBLIC_KEY:-$GOV_DIR/idp-public.pem}"
|
|
[[ -f "$IDP_PUB" ]] || deny "idp_pubkey_missing($IDP_PUB)"
|
|
JWT_OUT="$(
|
|
python3 - "$CASAN_APPROVAL_JWT" "$IDP_PUB" "$APPROVER" "$ROLES" "$ACTION" "$ACTOR" "$INPUT_SHA" <<'PY'
|
|
import base64
|
|
import json
|
|
import os
|
|
import subprocess
|
|
import sys
|
|
import tempfile
|
|
import time
|
|
|
|
jwt, pub, approver, roles_csv, action, actor, input_sha = sys.argv[1:8]
|
|
|
|
def die(reason):
|
|
print(reason, file=sys.stderr)
|
|
sys.exit(3)
|
|
|
|
def b64u_decode(part):
|
|
try:
|
|
return base64.urlsafe_b64decode(part + "=" * (-len(part) % 4))
|
|
except Exception:
|
|
die("jwt_base64_invalid")
|
|
|
|
parts = jwt.split(".")
|
|
if len(parts) != 3:
|
|
die("jwt_shape_invalid")
|
|
header = json.loads(b64u_decode(parts[0]))
|
|
claims = json.loads(b64u_decode(parts[1]))
|
|
if header.get("alg") != "RS256":
|
|
die("jwt_alg_not_allowed")
|
|
if int(claims.get("exp", 0)) <= int(time.time()):
|
|
die("jwt_expired")
|
|
if claims.get("sub") != approver:
|
|
die("jwt_sub_mismatch")
|
|
role = claims.get("role", "")
|
|
roles = [r for r in roles_csv.split(",") if r]
|
|
if role not in roles:
|
|
die(f"jwt_role_not_authorized(role={role} allowed={roles_csv})")
|
|
if claims.get("action") != action:
|
|
die("jwt_action_mismatch")
|
|
if claims.get("actor") != actor:
|
|
die("jwt_actor_mismatch")
|
|
if claims.get("input_sha256") != input_sha:
|
|
die("jwt_input_hash_mismatch")
|
|
|
|
sig = b64u_decode(parts[2])
|
|
signing_input = ".".join(parts[:2]).encode()
|
|
with tempfile.TemporaryDirectory() as td:
|
|
sig_path = os.path.join(td, "sig.bin")
|
|
msg_path = os.path.join(td, "msg.txt")
|
|
open(sig_path, "wb").write(sig)
|
|
open(msg_path, "wb").write(signing_input)
|
|
rc = subprocess.run(
|
|
["openssl", "dgst", "-sha256", "-verify", pub, "-signature", sig_path, msg_path],
|
|
stdout=subprocess.DEVNULL,
|
|
stderr=subprocess.DEVNULL,
|
|
).returncode
|
|
if rc != 0:
|
|
die("jwt_signature_invalid")
|
|
print(f"OK role={role}")
|
|
PY
|
|
)" || deny "oidc_jwt_invalid(${JWT_OUT:-see_stderr})"
|
|
ROLE="${JWT_OUT#OK role=}"
|
|
echo "APPROVAL_OK mechanism=oidc role=$ROLE approver=$APPROVER action=$ACTION"
|
|
exit 0
|
|
fi
|
|
|
|
[[ -n "$SIG_FILE" && -f "$SIG_FILE" ]] || deny "signature_missing"
|
|
|
|
# Reviewer lookup (first matching registered reviewer).
|
|
REV_LINE="$(awk -v id="$APPROVER" '$1=="reviewer" && $2==id {print $3" "$4; exit}' "$REVIEWERS_FILE")"
|
|
[[ -n "$REV_LINE" ]] || deny "approver_not_registered"
|
|
ROLE="${REV_LINE%% *}"
|
|
PUB_REL="${REV_LINE##* }"
|
|
|
|
case ",$ROLES," in
|
|
*",$ROLE,"*) : ;;
|
|
*) deny "approver_role_not_authorized(role=$ROLE action=$ACTION allowed=$ROLES)" ;;
|
|
esac
|
|
|
|
# Resolve pubkey path (absolute or relative to reviewers dir).
|
|
PUB="$PUB_REL"; [[ "$PUB" = /* ]] || PUB="$REVIEWERS_DIR/$PUB_REL"
|
|
[[ -f "$PUB" ]] || deny "approver_pubkey_missing($PUB)"
|
|
|
|
# Rebuild the exact signed assertion and verify.
|
|
MSG="casan-approval|v1|$ACTION|$ACTOR|$INPUT_SHA|$APPROVER"
|
|
TMP="$(mktemp)"; trap 'rm -f "$TMP"' EXIT
|
|
printf '%s' "$MSG" > "$TMP"
|
|
openssl dgst -sha256 -verify "$PUB" -signature "$SIG_FILE" "$TMP" >/dev/null 2>&1 \
|
|
|| deny "approval_signature_invalid"
|
|
|
|
echo "APPROVAL_OK role=$ROLE approver=$APPROVER action=$ACTION"
|
|
exit 0
|