143 lines
3.7 KiB
Python
143 lines
3.7 KiB
Python
from __future__ import annotations
|
|
|
|
from govoplan_core.core.modules import (
|
|
DocumentationTopic,
|
|
ModuleInterfaceProvider,
|
|
ModuleManifest,
|
|
PermissionDefinition,
|
|
RoleTemplate,
|
|
)
|
|
|
|
|
|
MODULE_ID = "encryption"
|
|
MODULE_NAME = "Encryption"
|
|
MODULE_VERSION = "0.1.14"
|
|
|
|
USE_SCOPE = "encryption:vault:use"
|
|
ADMIN_SCOPE = "encryption:vault:admin"
|
|
RECOVERY_SCOPE = "encryption:recovery:approve"
|
|
|
|
OPTIONAL_DEPENDENCIES = (
|
|
"access",
|
|
"audit",
|
|
"policy",
|
|
"notifications",
|
|
"files",
|
|
"postbox",
|
|
"campaigns",
|
|
"workflow_engine",
|
|
)
|
|
|
|
|
|
def _permission(
|
|
scope: str,
|
|
label: str,
|
|
description: str,
|
|
) -> PermissionDefinition:
|
|
module_id, resource, action = scope.split(":", 2)
|
|
return PermissionDefinition(
|
|
scope=scope,
|
|
label=label,
|
|
description=description,
|
|
category="Encryption",
|
|
level="tenant",
|
|
module_id=module_id,
|
|
resource=resource,
|
|
action=action,
|
|
)
|
|
|
|
|
|
PERMISSIONS = (
|
|
_permission(
|
|
USE_SCOPE,
|
|
"Use encryption profiles",
|
|
"Protect and decrypt authorized content through an available profile.",
|
|
),
|
|
_permission(
|
|
ADMIN_SCOPE,
|
|
"Administer encryption",
|
|
"Manage vaults, protection profiles, key rotation, and provider policy.",
|
|
),
|
|
_permission(
|
|
RECOVERY_SCOPE,
|
|
"Approve key recovery",
|
|
"Participate in an auditable recovery ceremony without gaining content ownership.",
|
|
),
|
|
)
|
|
|
|
ROLE_TEMPLATES = (
|
|
RoleTemplate(
|
|
slug="encryption_user",
|
|
name="Encryption user",
|
|
description="Use configured content-protection profiles.",
|
|
permissions=(USE_SCOPE,),
|
|
),
|
|
RoleTemplate(
|
|
slug="encryption_custodian",
|
|
name="Encryption custodian",
|
|
description="Administer encryption and participate in key recovery.",
|
|
permissions=(USE_SCOPE, ADMIN_SCOPE, RECOVERY_SCOPE),
|
|
),
|
|
)
|
|
|
|
manifest = ModuleManifest(
|
|
id=MODULE_ID,
|
|
name=MODULE_NAME,
|
|
version=MODULE_VERSION,
|
|
optional_dependencies=OPTIONAL_DEPENDENCIES,
|
|
provides_interfaces=(
|
|
ModuleInterfaceProvider(name="encryption.key_vault", version="1.0.0"),
|
|
ModuleInterfaceProvider(
|
|
name="encryption.content_protection",
|
|
version="1.0.0",
|
|
),
|
|
ModuleInterfaceProvider(
|
|
name="encryption.recovery_ceremony",
|
|
version="1.0.0",
|
|
),
|
|
ModuleInterfaceProvider(
|
|
name="encryption.disable_preflight",
|
|
version="1.0.0",
|
|
),
|
|
),
|
|
permissions=PERMISSIONS,
|
|
role_templates=ROLE_TEMPLATES,
|
|
documentation=(
|
|
DocumentationTopic(
|
|
id="encryption.boundary",
|
|
title="Encryption and key-custody boundary",
|
|
summary=(
|
|
"Optional vault, content-protection, rotation, recovery, and "
|
|
"disable-assurance capabilities."
|
|
),
|
|
body=(
|
|
"Encryption protects feature-owned content without taking over "
|
|
"its business ownership. Resource ownership recovery never "
|
|
"implicitly grants cryptographic keys. Disabling the module is "
|
|
"blocked until protected objects are decrypted, rewrapped, "
|
|
"explicitly exported, or cryptographically deleted."
|
|
),
|
|
layer="available",
|
|
documentation_types=("admin",),
|
|
audience=("administrator", "security_officer", "product_owner"),
|
|
related_modules=OPTIONAL_DEPENDENCIES,
|
|
order=100,
|
|
),
|
|
),
|
|
)
|
|
|
|
|
|
def get_manifest() -> ModuleManifest:
|
|
return manifest
|
|
|
|
|
|
__all__ = [
|
|
"ADMIN_SCOPE",
|
|
"MODULE_ID",
|
|
"MODULE_VERSION",
|
|
"RECOVERY_SCOPE",
|
|
"USE_SCOPE",
|
|
"get_manifest",
|
|
"manifest",
|
|
]
|