528 lines
18 KiB
Python
528 lines
18 KiB
Python
from __future__ import annotations
|
|
|
|
from collections.abc import Sequence
|
|
from dataclasses import dataclass
|
|
from datetime import datetime, timezone
|
|
|
|
from sqlalchemy import or_
|
|
from sqlalchemy.orm import Session
|
|
|
|
from govoplan_core.core.dsar import (
|
|
DsarErasureActionRef,
|
|
DsarExecutionResultRef,
|
|
DsarRecordRef,
|
|
DsarSubjectRef,
|
|
dsar_capability_name,
|
|
)
|
|
from govoplan_encryption.backend.db.models import (
|
|
ContentProtectionRecord,
|
|
EncryptionKeyOperation,
|
|
EncryptionVault,
|
|
ProtectionMigration,
|
|
RecoveryApproval,
|
|
RecoveryCeremony,
|
|
)
|
|
|
|
|
|
ENCRYPTION_DSAR_CAPABILITY = dsar_capability_name("encryption")
|
|
_MAX_RECORDS = 5_000
|
|
_CONFLICT = object()
|
|
|
|
|
|
@dataclass(frozen=True, slots=True)
|
|
class _SubjectSelectors:
|
|
account_id: str
|
|
vault_id: str | None
|
|
key_operation_id: str | None
|
|
envelope_id: str | None
|
|
migration_id: str | None
|
|
recovery_id: str | None
|
|
|
|
@property
|
|
def narrowed(self) -> bool:
|
|
return any(
|
|
(
|
|
self.vault_id,
|
|
self.key_operation_id,
|
|
self.envelope_id,
|
|
self.migration_id,
|
|
self.recovery_id,
|
|
)
|
|
)
|
|
|
|
|
|
class EncryptionDsarProvider:
|
|
provider_id = "encryption"
|
|
module_id = "encryption"
|
|
|
|
def search_subject(
|
|
self,
|
|
session: object,
|
|
*,
|
|
tenant_id: str,
|
|
subject: DsarSubjectRef,
|
|
) -> Sequence[DsarRecordRef]:
|
|
db = _session(session)
|
|
selectors = _subject_selectors(subject)
|
|
if selectors is None:
|
|
return ()
|
|
|
|
records: list[DsarRecordRef] = []
|
|
if not selectors.narrowed or selectors.vault_id:
|
|
query = db.query(EncryptionVault).filter(
|
|
EncryptionVault.tenant_id == tenant_id,
|
|
or_(
|
|
EncryptionVault.created_by == selectors.account_id,
|
|
EncryptionVault.updated_by == selectors.account_id,
|
|
),
|
|
)
|
|
if selectors.vault_id:
|
|
query = query.filter(EncryptionVault.vault_id == selectors.vault_id)
|
|
records.extend(
|
|
_vault_attribution(row, selectors.account_id)
|
|
for row in _limited(
|
|
query,
|
|
EncryptionVault.created_at,
|
|
EncryptionVault.id,
|
|
label="vault attribution",
|
|
)
|
|
)
|
|
|
|
if not selectors.narrowed or selectors.vault_id or selectors.key_operation_id:
|
|
query = db.query(EncryptionKeyOperation).filter(
|
|
EncryptionKeyOperation.tenant_id == tenant_id,
|
|
EncryptionKeyOperation.requested_by == selectors.account_id,
|
|
)
|
|
if selectors.vault_id:
|
|
query = query.filter(
|
|
EncryptionKeyOperation.vault_id == selectors.vault_id
|
|
)
|
|
if selectors.key_operation_id:
|
|
query = query.filter(
|
|
EncryptionKeyOperation.id == selectors.key_operation_id
|
|
)
|
|
records.extend(
|
|
_key_operation_attribution(row)
|
|
for row in _limited(
|
|
query,
|
|
EncryptionKeyOperation.created_at,
|
|
EncryptionKeyOperation.id,
|
|
label="key-operation attribution",
|
|
)
|
|
)
|
|
|
|
if not selectors.narrowed or selectors.vault_id or selectors.envelope_id:
|
|
query = db.query(ContentProtectionRecord).filter(
|
|
ContentProtectionRecord.tenant_id == tenant_id,
|
|
ContentProtectionRecord.registered_by == selectors.account_id,
|
|
)
|
|
if selectors.vault_id:
|
|
query = query.filter(
|
|
ContentProtectionRecord.vault_id == selectors.vault_id
|
|
)
|
|
if selectors.envelope_id:
|
|
query = query.filter(
|
|
ContentProtectionRecord.envelope_id == selectors.envelope_id
|
|
)
|
|
records.extend(
|
|
_protection_attribution(row)
|
|
for row in _limited(
|
|
query,
|
|
ContentProtectionRecord.created_at,
|
|
ContentProtectionRecord.id,
|
|
label="content-protection attribution",
|
|
)
|
|
)
|
|
|
|
if not selectors.narrowed or selectors.vault_id or selectors.migration_id:
|
|
query = db.query(ProtectionMigration).filter(
|
|
ProtectionMigration.tenant_id == tenant_id,
|
|
ProtectionMigration.requested_by == selectors.account_id,
|
|
)
|
|
if selectors.vault_id:
|
|
query = query.filter(
|
|
ProtectionMigration.target_vault_id == selectors.vault_id
|
|
)
|
|
if selectors.migration_id:
|
|
query = query.filter(ProtectionMigration.id == selectors.migration_id)
|
|
records.extend(
|
|
_migration_attribution(row)
|
|
for row in _limited(
|
|
query,
|
|
ProtectionMigration.created_at,
|
|
ProtectionMigration.id,
|
|
label="migration attribution",
|
|
)
|
|
)
|
|
|
|
if not selectors.narrowed or selectors.vault_id or selectors.recovery_id:
|
|
ceremonies = db.query(RecoveryCeremony).filter(
|
|
RecoveryCeremony.tenant_id == tenant_id,
|
|
RecoveryCeremony.requester_account_id == selectors.account_id,
|
|
)
|
|
if selectors.vault_id:
|
|
ceremonies = ceremonies.filter(
|
|
RecoveryCeremony.vault_id == selectors.vault_id
|
|
)
|
|
if selectors.recovery_id:
|
|
ceremonies = ceremonies.filter(
|
|
RecoveryCeremony.id == selectors.recovery_id
|
|
)
|
|
records.extend(
|
|
_recovery_request_attribution(row)
|
|
for row in _limited(
|
|
ceremonies,
|
|
RecoveryCeremony.created_at,
|
|
RecoveryCeremony.id,
|
|
label="recovery-request attribution",
|
|
)
|
|
)
|
|
|
|
approvals = db.query(RecoveryApproval).filter(
|
|
RecoveryApproval.tenant_id == tenant_id,
|
|
RecoveryApproval.approver_account_id == selectors.account_id,
|
|
)
|
|
if selectors.recovery_id:
|
|
approvals = approvals.filter(
|
|
RecoveryApproval.recovery_id == selectors.recovery_id
|
|
)
|
|
elif selectors.vault_id:
|
|
approvals = approvals.filter(
|
|
RecoveryApproval.recovery_id.in_(
|
|
db.query(RecoveryCeremony.id).filter(
|
|
RecoveryCeremony.tenant_id == tenant_id,
|
|
RecoveryCeremony.vault_id == selectors.vault_id,
|
|
)
|
|
)
|
|
)
|
|
records.extend(
|
|
_recovery_approval_attribution(row)
|
|
for row in _limited(
|
|
approvals,
|
|
RecoveryApproval.created_at,
|
|
RecoveryApproval.id,
|
|
label="recovery-approval attribution",
|
|
)
|
|
)
|
|
|
|
if len(records) > _MAX_RECORDS:
|
|
raise ValueError("Encryption DSAR result limit exceeded; narrow selectors.")
|
|
return tuple(
|
|
sorted(records, key=lambda item: (item.resource_type, item.resource_id))
|
|
)
|
|
|
|
def plan_erasure(
|
|
self,
|
|
session: object,
|
|
*,
|
|
tenant_id: str,
|
|
subject: DsarSubjectRef,
|
|
records: Sequence[DsarRecordRef],
|
|
) -> Sequence[DsarErasureActionRef]:
|
|
del tenant_id
|
|
_session(session)
|
|
if _subject_selectors(subject) is None:
|
|
raise ValueError("Encryption DSAR subject selectors conflict.")
|
|
actions: list[DsarErasureActionRef] = []
|
|
for record in records:
|
|
_validate_record(record)
|
|
actions.append(
|
|
DsarErasureActionRef(
|
|
action_id=(
|
|
f"encryption:retain:{record.resource_type}:{record.resource_id}"
|
|
),
|
|
provider_id=self.provider_id,
|
|
module_id=self.module_id,
|
|
kind="retain",
|
|
resource_type=record.resource_type,
|
|
resource_id=record.resource_id,
|
|
title=f"Retain {record.title}",
|
|
rationale=(
|
|
record.retention_reason
|
|
or "Cryptographic custody evidence remains immutable."
|
|
),
|
|
executable=False,
|
|
)
|
|
)
|
|
return tuple(actions)
|
|
|
|
def execute_erasure(
|
|
self,
|
|
session: object,
|
|
*,
|
|
tenant_id: str,
|
|
subject: DsarSubjectRef,
|
|
actions: Sequence[DsarErasureActionRef],
|
|
request_id: str,
|
|
) -> Sequence[DsarExecutionResultRef]:
|
|
del tenant_id
|
|
_session(session)
|
|
if _subject_selectors(subject) is None:
|
|
raise ValueError("Encryption DSAR subject selectors conflict.")
|
|
results: list[DsarExecutionResultRef] = []
|
|
for action in actions:
|
|
_validate_action(action)
|
|
if action.executable or action.kind != "retain":
|
|
raise ValueError("Encryption DSAR publishes retain actions only.")
|
|
results.append(
|
|
DsarExecutionResultRef(
|
|
action_id=action.action_id,
|
|
status="blocked",
|
|
summary=(
|
|
"Cryptographic lifecycle and custody attribution remains "
|
|
"immutable security evidence."
|
|
),
|
|
evidence={"request_id": request_id},
|
|
)
|
|
)
|
|
return tuple(results)
|
|
|
|
|
|
def _subject_selectors(subject: DsarSubjectRef) -> _SubjectSelectors | None:
|
|
references = subject.external_references
|
|
account = _coalesce(
|
|
subject.account_id,
|
|
references.get("encryption.account"),
|
|
references.get("access.account"),
|
|
)
|
|
values = {
|
|
"vault_id": _coalesce(
|
|
references.get("encryption.vault"),
|
|
references.get("encryption.vault_id"),
|
|
),
|
|
"key_operation_id": _coalesce(
|
|
references.get("encryption.key_operation"),
|
|
references.get("encryption.key_operation_id"),
|
|
),
|
|
"envelope_id": _coalesce(
|
|
references.get("encryption.envelope"),
|
|
references.get("encryption.envelope_id"),
|
|
),
|
|
"migration_id": _coalesce(
|
|
references.get("encryption.migration"),
|
|
references.get("encryption.migration_id"),
|
|
),
|
|
"recovery_id": _coalesce(
|
|
references.get("encryption.recovery"),
|
|
references.get("encryption.recovery_id"),
|
|
),
|
|
}
|
|
if account is _CONFLICT or any(value is _CONFLICT for value in values.values()):
|
|
return None
|
|
account_id = _optional_string(account)
|
|
if not account_id:
|
|
return None
|
|
return _SubjectSelectors(
|
|
account_id=account_id,
|
|
vault_id=_optional_string(values["vault_id"]),
|
|
key_operation_id=_optional_string(values["key_operation_id"]),
|
|
envelope_id=_optional_string(values["envelope_id"]),
|
|
migration_id=_optional_string(values["migration_id"]),
|
|
recovery_id=_optional_string(values["recovery_id"]),
|
|
)
|
|
|
|
|
|
def _vault_attribution(row: EncryptionVault, account_id: str) -> DsarRecordRef:
|
|
activities = []
|
|
if row.created_by == account_id:
|
|
activities.append("created_vault")
|
|
if row.updated_by == account_id:
|
|
activities.append("updated_vault")
|
|
return _record(
|
|
resource_type="vault_actor_attribution",
|
|
resource_id=row.id,
|
|
title="Encryption vault actor attribution",
|
|
data={
|
|
"vault_id": row.vault_id,
|
|
"purpose": row.purpose[:255],
|
|
"profile_kind": row.profile_kind,
|
|
"scope_type": row.scope_type,
|
|
"state": row.state,
|
|
"revision": row.revision,
|
|
"current_key_version": row.current_key_version,
|
|
"recovery_quorum": row.recovery_quorum,
|
|
"activities": activities,
|
|
"created_at": _iso(row.created_at),
|
|
"updated_at": _iso(row.updated_at),
|
|
},
|
|
observed_at=row.updated_at,
|
|
)
|
|
|
|
|
|
def _key_operation_attribution(row: EncryptionKeyOperation) -> DsarRecordRef:
|
|
return _record(
|
|
resource_type="key_operation_actor_attribution",
|
|
resource_id=row.id,
|
|
title="Encryption key-operation actor attribution",
|
|
data={
|
|
"key_operation_id": row.id,
|
|
"vault_id": row.vault_id,
|
|
"key_version": row.key_version,
|
|
"operation": row.operation,
|
|
"state": row.state,
|
|
"activity": "requested_key_operation",
|
|
"created_at": _iso(row.created_at),
|
|
"completed_at": _iso(row.completed_at),
|
|
},
|
|
observed_at=row.completed_at or row.created_at,
|
|
)
|
|
|
|
|
|
def _protection_attribution(row: ContentProtectionRecord) -> DsarRecordRef:
|
|
return _record(
|
|
resource_type="content_protection_actor_attribution",
|
|
resource_id=row.id,
|
|
title="Content-protection registration attribution",
|
|
data={
|
|
"protection_record_id": row.id,
|
|
"owner_module": row.owner_module,
|
|
"resource_type": row.resource_type,
|
|
"profile_kind": row.profile_kind,
|
|
"state": row.state,
|
|
"activity": "registered_content_protection",
|
|
"created_at": _iso(row.created_at),
|
|
"updated_at": _iso(row.updated_at),
|
|
},
|
|
observed_at=row.updated_at,
|
|
)
|
|
|
|
|
|
def _migration_attribution(row: ProtectionMigration) -> DsarRecordRef:
|
|
return _record(
|
|
resource_type="protection_migration_actor_attribution",
|
|
resource_id=row.id,
|
|
title="Protection-migration actor attribution",
|
|
data={
|
|
"migration_id": row.id,
|
|
"mode": row.mode,
|
|
"state": row.state,
|
|
"activity": "requested_protection_migration",
|
|
"created_at": _iso(row.created_at),
|
|
"completed_at": _iso(row.completed_at),
|
|
},
|
|
observed_at=row.completed_at or row.created_at,
|
|
)
|
|
|
|
|
|
def _recovery_request_attribution(row: RecoveryCeremony) -> DsarRecordRef:
|
|
return _record(
|
|
resource_type="recovery_request_actor_attribution",
|
|
resource_id=row.id,
|
|
title="Encryption recovery-request attribution",
|
|
data={
|
|
"recovery_id": row.id,
|
|
"vault_id": row.vault_id,
|
|
"state": row.state,
|
|
"quorum": row.quorum,
|
|
"revision": row.revision,
|
|
"expires_at": _iso(row.expires_at),
|
|
"activity": "requested_recovery_ceremony",
|
|
"created_at": _iso(row.created_at),
|
|
"updated_at": _iso(row.updated_at),
|
|
},
|
|
observed_at=row.updated_at,
|
|
)
|
|
|
|
|
|
def _recovery_approval_attribution(row: RecoveryApproval) -> DsarRecordRef:
|
|
return _record(
|
|
resource_type="recovery_approval_actor_attribution",
|
|
resource_id=row.id,
|
|
title="Encryption recovery-approval attribution",
|
|
data={
|
|
"recovery_approval_id": row.id,
|
|
"recovery_id": row.recovery_id,
|
|
"decision": row.decision,
|
|
"activity": "decided_recovery_approval",
|
|
"created_at": _iso(row.created_at),
|
|
},
|
|
observed_at=row.created_at,
|
|
)
|
|
|
|
|
|
def _record(
|
|
*,
|
|
resource_type: str,
|
|
resource_id: str,
|
|
title: str,
|
|
data: dict[str, object],
|
|
observed_at: datetime | None,
|
|
) -> DsarRecordRef:
|
|
return DsarRecordRef(
|
|
provider_id="encryption",
|
|
module_id="encryption",
|
|
resource_type=resource_type,
|
|
resource_id=resource_id,
|
|
category="cryptographic_custody_attribution",
|
|
title=title,
|
|
data=data,
|
|
observed_at=_aware(observed_at),
|
|
immutable_evidence=True,
|
|
retention_reason=(
|
|
"Cryptographic lifecycle and custody attribution is retained as immutable "
|
|
"security and accountability evidence."
|
|
),
|
|
)
|
|
|
|
|
|
def _limited(query, first, second, *, label: str):
|
|
rows = query.order_by(first, second).limit(_MAX_RECORDS + 1).all()
|
|
if len(rows) > _MAX_RECORDS:
|
|
raise ValueError(f"Encryption DSAR {label} limit exceeded; narrow selectors.")
|
|
return rows
|
|
|
|
|
|
def _coalesce(*values: str | None) -> str | None | object:
|
|
normalized = {str(value).strip() for value in values if str(value or "").strip()}
|
|
if len(normalized) > 1:
|
|
return _CONFLICT
|
|
return next(iter(normalized), None)
|
|
|
|
|
|
def _optional_string(value: object) -> str | None:
|
|
return value if isinstance(value, str) and value else None
|
|
|
|
|
|
def _iso(value: datetime | None) -> str | None:
|
|
aware = _aware(value)
|
|
return aware.isoformat() if aware else None
|
|
|
|
|
|
def _aware(value: datetime | None) -> datetime | None:
|
|
if value is None or value.tzinfo is not None:
|
|
return value
|
|
return value.replace(tzinfo=timezone.utc)
|
|
|
|
|
|
def _session(value: object) -> Session:
|
|
if not isinstance(value, Session):
|
|
raise TypeError("Encryption DSAR requires a SQLAlchemy Session.")
|
|
return value
|
|
|
|
|
|
_RESOURCE_TYPES = {
|
|
"vault_actor_attribution",
|
|
"key_operation_actor_attribution",
|
|
"content_protection_actor_attribution",
|
|
"protection_migration_actor_attribution",
|
|
"recovery_request_actor_attribution",
|
|
"recovery_approval_actor_attribution",
|
|
}
|
|
|
|
|
|
def _validate_record(record: DsarRecordRef) -> None:
|
|
if record.provider_id != "encryption" or record.module_id != "encryption":
|
|
raise ValueError("Encryption DSAR cannot plan a foreign provider record.")
|
|
if record.resource_type not in _RESOURCE_TYPES or not record.resource_id:
|
|
raise ValueError("Encryption DSAR record identity is invalid.")
|
|
|
|
|
|
def _validate_action(action: DsarErasureActionRef) -> None:
|
|
if action.provider_id != "encryption" or action.module_id != "encryption":
|
|
raise ValueError("Encryption DSAR cannot execute a foreign provider action.")
|
|
if not action.action_id.startswith("encryption:retain:"):
|
|
raise ValueError("Encryption DSAR action identity is invalid.")
|
|
|
|
|
|
__all__ = ["ENCRYPTION_DSAR_CAPABILITY", "EncryptionDsarProvider"]
|