Add governed encryption administration

2026-08-04 01:27:52 +02:00
parent 42f35f8d00
commit ba92d8bf32
15 changed files with 1472 additions and 4 deletions
@@ -377,6 +377,79 @@ class EncryptionTests(unittest.TestCase):
        self.assertEqual(2, second.approvals)
        self.assertFalse(second.provenance["key_material_released"])

+    def test_operator_queries_are_bounded_tenant_scoped_and_secret_free(self) -> None:
+        self.create_vault()
+        self.service.register_envelope(
+            self.session,
+            self.principal,
+            request=ProtectionRegistrationRequest(
+                envelope=self.envelope("files", "operator-query"),
+                idempotency_key="register-operator-query",
+                policy_decision_ref="policy:protect",
+            ),
+        )
+        migration = self.service.request_migration(
+            self.session,
+            self.principal,
+            request=ProtectionMigrationRequest(
+                tenant_id="tenant-1",
+                envelope_id="envelope-operator-query",
+                target_provider_id="test",
+                target_vault_id="vault-1",
+                target_key_version=1,
+                target_algorithm_suite="AES-256-GCM",
+                mode="destroy",
+                policy_decision_ref="policy:destroy",
+                assurance_evidence_ref="assurance:destroy",
+                idempotency_key="migration-operator-query",
+            ),
+        )
+        recovery = self.service.request_recovery(
+            self.session,
+            self.principal,
+            request=RecoveryRequest(
+                tenant_id="tenant-1",
+                vault_id="vault-1",
+                reason="operator query fixture",
+                requested_scope="vault-status",
+                policy_decision_ref="policy:recovery",
+                assurance_evidence_ref="assurance:requester",
+                idempotency_key="recovery-operator-query",
+                expires_at=utcnow() + timedelta(hours=1),
+            ),
+        )
+
+        vaults = self.service.list_vaults(
+            self.session, self.principal, tenant_id="tenant-1", limit=1000
+        )
+        envelopes = self.service.list_envelopes(
+            self.session, self.principal, tenant_id="tenant-1", limit=1000
+        )
+        migrations = self.service.list_migrations(
+            self.session, self.principal, tenant_id="tenant-1", limit=1000
+        )
+        recoveries = self.service.list_recoveries(
+            self.session, self.principal, tenant_id="tenant-1", limit=1000
+        )
+
+        self.assertEqual(["vault-1"], [item.vault_id for item in vaults])
+        self.assertEqual(
+            ["envelope-operator-query"],
+            [item.envelope_id for item in envelopes],
+        )
+        self.assertEqual(migration.migration_id, migrations[0].migration_id)
+        self.assertEqual(recovery.recovery_id, recoveries[0].recovery_id)
+        self.assertEqual("operator query fixture", recoveries[0].reason)
+        self.assertFalse(hasattr(vaults[0], "provider_key_ref"))
+        self.assertFalse(hasattr(envelopes[0], "wrapped_key_refs"))
+        self.assertFalse(hasattr(envelopes[0], "ciphertext_ref"))
+        with self.assertRaisesRegex(EncryptionError, "Cross-tenant"):
+            self.service.list_vaults(
+                self.session,
+                Principal("account-1", "tenant-2"),
+                tenant_id="tenant-1",
+            )
+
    def test_contract_rejects_secret_bearing_envelope_metadata(self) -> None:
        with self.assertRaisesRegex(ValueError, "secret material"):
            replace(