Implement identity trust module
This commit is contained in:
@@ -0,0 +1,222 @@
|
||||
from __future__ import annotations
|
||||
|
||||
from pathlib import Path
|
||||
|
||||
from govoplan_core.core.identity_trust import (
|
||||
CAPABILITY_IDENTITY_TRUST_ASSURANCE,
|
||||
CAPABILITY_IDENTITY_TRUST_DIRECTORY,
|
||||
)
|
||||
from govoplan_core.core.module_guards import (
|
||||
drop_table_retirement_provider,
|
||||
persistent_table_uninstall_guard,
|
||||
)
|
||||
from govoplan_core.core.modules import (
|
||||
CapabilityDocumentation,
|
||||
DocumentationLink,
|
||||
DocumentationTopic,
|
||||
MigrationSpec,
|
||||
ModuleContext,
|
||||
ModuleInterfaceProvider,
|
||||
ModuleManifest,
|
||||
PermissionDefinition,
|
||||
RoleTemplate,
|
||||
)
|
||||
from govoplan_core.core.provider_governance import declared_module_architecture
|
||||
from govoplan_core.db.base import Base
|
||||
from govoplan_identity_trust.backend.db import models
|
||||
from govoplan_identity_trust.backend.service import SqlIdentityTrustService
|
||||
|
||||
|
||||
MODULE_ID = "identity_trust"
|
||||
MODULE_NAME = "Identity Trust"
|
||||
MODULE_VERSION = "0.1.14"
|
||||
DEVICE_READ_SCOPE = "identity_trust:device:read"
|
||||
DEVICE_WRITE_SCOPE = "identity_trust:device:write"
|
||||
KEY_ACCESS_SCOPE = "identity_trust:key_access:approve"
|
||||
ASSURANCE_SCOPE = "identity_trust:assurance:record"
|
||||
ADMIN_SCOPE = "identity_trust:device:admin"
|
||||
|
||||
|
||||
def _permission(scope: str, label: str, description: str) -> PermissionDefinition:
|
||||
module_id, resource, action = scope.split(":", 2)
|
||||
return PermissionDefinition(
|
||||
scope=scope,
|
||||
label=label,
|
||||
description=description,
|
||||
category="Identity Trust",
|
||||
level="tenant",
|
||||
module_id=module_id,
|
||||
resource=resource,
|
||||
action=action,
|
||||
)
|
||||
|
||||
|
||||
def _router(_context: ModuleContext):
|
||||
from govoplan_identity_trust.backend.router import router
|
||||
|
||||
return router
|
||||
|
||||
|
||||
def _service(_context: ModuleContext) -> SqlIdentityTrustService:
|
||||
return SqlIdentityTrustService()
|
||||
|
||||
|
||||
manifest = ModuleManifest(
|
||||
id=MODULE_ID,
|
||||
name=MODULE_NAME,
|
||||
version=MODULE_VERSION,
|
||||
optional_dependencies=("access", "audit", "policy", "encryption", "postbox"),
|
||||
provides_interfaces=(
|
||||
ModuleInterfaceProvider(name="identity_trust.directory", version="1.0.0"),
|
||||
ModuleInterfaceProvider(name="identity_trust.assurance", version="1.0.0"),
|
||||
),
|
||||
permissions=(
|
||||
_permission(
|
||||
DEVICE_READ_SCOPE,
|
||||
"View device keys",
|
||||
"View public device-key and trust state.",
|
||||
),
|
||||
_permission(
|
||||
DEVICE_WRITE_SCOPE,
|
||||
"Manage own device keys",
|
||||
"Register and revoke public keys for the acting account.",
|
||||
),
|
||||
_permission(
|
||||
KEY_ACCESS_SCOPE,
|
||||
"Evaluate key access",
|
||||
"Evaluate device and key-epoch trust after Access has approved a resource action.",
|
||||
),
|
||||
_permission(
|
||||
ASSURANCE_SCOPE,
|
||||
"Record assurance evidence",
|
||||
"Record bounded assurance evidence from a trusted authentication provider.",
|
||||
),
|
||||
_permission(
|
||||
ADMIN_SCOPE,
|
||||
"Administer identity trust",
|
||||
"Administer device keys, trust epochs, and assurance evidence.",
|
||||
),
|
||||
),
|
||||
role_templates=(
|
||||
RoleTemplate(
|
||||
slug="identity_trust_user",
|
||||
name="Identity trust user",
|
||||
description="Manage own public device keys.",
|
||||
permissions=(DEVICE_READ_SCOPE, DEVICE_WRITE_SCOPE),
|
||||
),
|
||||
RoleTemplate(
|
||||
slug="identity_trust_officer",
|
||||
name="Identity trust officer",
|
||||
description="Administer trust epochs and assurance evidence.",
|
||||
permissions=(
|
||||
DEVICE_READ_SCOPE,
|
||||
KEY_ACCESS_SCOPE,
|
||||
ASSURANCE_SCOPE,
|
||||
ADMIN_SCOPE,
|
||||
),
|
||||
),
|
||||
),
|
||||
route_factory=_router,
|
||||
capability_factories={
|
||||
CAPABILITY_IDENTITY_TRUST_DIRECTORY: _service,
|
||||
CAPABILITY_IDENTITY_TRUST_ASSURANCE: _service,
|
||||
},
|
||||
capability_documentation={
|
||||
CAPABILITY_IDENTITY_TRUST_DIRECTORY: CapabilityDocumentation(
|
||||
label="Identity Trust directory",
|
||||
summary="Resolves public device keys, key epochs, and auditable release decisions without private key material.",
|
||||
contract_version="1.0.0",
|
||||
),
|
||||
CAPABILITY_IDENTITY_TRUST_ASSURANCE: CapabilityDocumentation(
|
||||
label="Identity Trust assurance",
|
||||
summary="Verifies bounded, recent assurance evidence for high-risk cryptographic operations.",
|
||||
contract_version="1.0.0",
|
||||
),
|
||||
},
|
||||
migration_spec=MigrationSpec(
|
||||
module_id=MODULE_ID,
|
||||
metadata=Base.metadata,
|
||||
script_location=str(Path(__file__).with_name("migrations") / "versions"),
|
||||
retirement_supported=True,
|
||||
retirement_provider=drop_table_retirement_provider(
|
||||
models.KeyAccessDecisionRecord,
|
||||
models.AssuranceEvidence,
|
||||
models.TrustKeyEpoch,
|
||||
models.DevicePublicKey,
|
||||
label="Identity Trust",
|
||||
),
|
||||
retirement_notes="Destructive retirement removes public-key, epoch, assurance, and key-access evidence after a database snapshot.",
|
||||
),
|
||||
uninstall_guard_providers=(
|
||||
persistent_table_uninstall_guard(
|
||||
models.DevicePublicKey,
|
||||
models.TrustKeyEpoch,
|
||||
models.AssuranceEvidence,
|
||||
models.KeyAccessDecisionRecord,
|
||||
label="Identity Trust",
|
||||
),
|
||||
),
|
||||
documentation=(
|
||||
DocumentationTopic(
|
||||
id="identity-trust.device-keys",
|
||||
title="Device keys and key epochs",
|
||||
summary="Separate login authority from public device-key and cryptographic-access trust.",
|
||||
body=(
|
||||
"Identity Trust stores public keys only. Access first decides whether an account may reach a protected resource; Identity Trust then verifies the current device and key epoch and records an auditable decision. Function and Postbox history grants are explicit epoch policy, and revocation cannot erase plaintext already obtained."
|
||||
),
|
||||
layer="available",
|
||||
documentation_types=("admin", "user"),
|
||||
audience=("user", "administrator", "security_officer", "auditor"),
|
||||
links=(
|
||||
DocumentationLink(
|
||||
label="Device-key trust and recovery boundary",
|
||||
href="govoplan-identity-trust/docs/DEVICE_KEY_TRUST_CONCEPT.md",
|
||||
kind="repository",
|
||||
),
|
||||
),
|
||||
),
|
||||
),
|
||||
architecture=declared_module_architecture(
|
||||
layer="institutional_foundation",
|
||||
kind="foundation",
|
||||
maturity="vertical_slice",
|
||||
documentation_ref="docs/DEVICE_KEY_TRUST_CONCEPT.md",
|
||||
test_ref="tests/test_identity_trust.py",
|
||||
known_limits=(
|
||||
"No private key custody, device attestation verifier, or cryptographic rewrap implementation is included.",
|
||||
),
|
||||
owned_concepts=(
|
||||
"public device key",
|
||||
"key epoch",
|
||||
"assurance evidence",
|
||||
"key-access trust decision",
|
||||
),
|
||||
non_owned_concepts=(
|
||||
"login session",
|
||||
"resource authorization",
|
||||
"private key",
|
||||
"content encryption",
|
||||
),
|
||||
migration_docs=("docs/DEVICE_KEY_TRUST_CONCEPT.md",),
|
||||
recovery_docs=("docs/DEVICE_KEY_TRUST_CONCEPT.md",),
|
||||
security_docs=("docs/DEVICE_KEY_TRUST_CONCEPT.md",),
|
||||
operations_docs=("README.md",),
|
||||
),
|
||||
)
|
||||
|
||||
|
||||
def get_manifest() -> ModuleManifest:
|
||||
return manifest
|
||||
|
||||
|
||||
__all__ = [
|
||||
"ADMIN_SCOPE",
|
||||
"ASSURANCE_SCOPE",
|
||||
"DEVICE_READ_SCOPE",
|
||||
"DEVICE_WRITE_SCOPE",
|
||||
"KEY_ACCESS_SCOPE",
|
||||
"MODULE_ID",
|
||||
"MODULE_VERSION",
|
||||
"get_manifest",
|
||||
"manifest",
|
||||
]
|
||||
Reference in New Issue
Block a user