diff --git a/README.md b/README.md index d66acfb..4688763 100644 --- a/README.md +++ b/README.md @@ -9,13 +9,29 @@ authentication-assurance evidence, and auditable key-access trust decisions. It deliberately does not own login sessions, resource authorization, private keys, encryption, or plaintext. -The headless module exposes `identity_trust.directory` and +The backend exposes `identity_trust.directory` and `identity_trust.assurance`. Access or Policy must approve resource access first; Identity Trust then verifies the acting account, active public device key, current subject epoch, and assurance evidence. Encryption providers may consume that decision to rewrap a key, but no key material is returned by this module. +The WebUI contributes two optional surfaces: + +- **Settings > Device trust** lets an account inspect active/revoked public + device keys, revoke a current key with its expected revision, and inspect + assurance level, provider, device binding, expiry, and provenance. +- **Administration > Identity trust** lets an authorized security officer use + an Access-backed account selector when Access is available, inspect the same + bounded projections, rotate subject epochs with an upstream Access decision, + and review immutable key-access decisions. Explicit account references remain + usable when the optional Access directory is absent. + +Revocation and rotation are not retroactive: neither can recall plaintext, +exports, or key material already obtained by an endpoint. Stale revisions fail +closed and must be reloaded. The API and UI expose public JWK metadata only; +private JWK parameters are rejected by the capability contract. + Focused verification: ```bash diff --git a/docs/DEVICE_KEY_TRUST_CONCEPT.md b/docs/DEVICE_KEY_TRUST_CONCEPT.md index 64aaa8a..2600fb2 100644 --- a/docs/DEVICE_KEY_TRUST_CONCEPT.md +++ b/docs/DEVICE_KEY_TRUST_CONCEPT.md @@ -51,6 +51,13 @@ The SQL-backed module now provides: expiry, and maximum-age checks; - migrations, uninstall guards, permissions, APIs, capability contracts, and manifest-driven user/admin documentation. +- bounded user and security-officer projections for public device keys, + assurance provenance, subject epoch history, and immutable key-access + decisions; +- user key revocation and security-officer epoch rotation surfaces with stale + revision rejection and explicit non-retroactivity consequences; +- optional Access-backed account selection without making Access a hard module + dependency. Only public keys are accepted. JWK private parameters are rejected by the Core contract. Key-access decisions state explicitly that no cryptographic material @@ -81,5 +88,8 @@ and quorum recovery remain with `govoplan-encryption` and its selected provider. - There is no private-key custody or browser/device key generator. - Attestation references are retained but no WebAuthn/OIDC attestation adapter is selected yet. +- Device key generation and registration remains provider/browser driven; the + administration UI deliberately does not ask an operator to paste private or + manually generated key material. - The module decides trust eligibility; it does not perform encryption, decryption, signing, or rewrapping. diff --git a/src/govoplan_identity_trust/backend/manifest.py b/src/govoplan_identity_trust/backend/manifest.py index 291a599..cff51ae 100644 --- a/src/govoplan_identity_trust/backend/manifest.py +++ b/src/govoplan_identity_trust/backend/manifest.py @@ -14,12 +14,14 @@ from govoplan_core.core.modules import ( CapabilityDocumentation, DocumentationLink, DocumentationTopic, + FrontendModule, MigrationSpec, ModuleContext, ModuleInterfaceProvider, ModuleManifest, PermissionDefinition, RoleTemplate, + ViewSurface, ) from govoplan_core.core.provider_governance import declared_module_architecture from govoplan_core.db.base import Base @@ -34,6 +36,7 @@ DEVICE_READ_SCOPE = "identity_trust:device:read" DEVICE_WRITE_SCOPE = "identity_trust:device:write" KEY_ACCESS_SCOPE = "identity_trust:key_access:approve" ASSURANCE_SCOPE = "identity_trust:assurance:record" +ASSURANCE_READ_SCOPE = "identity_trust:assurance:read" ADMIN_SCOPE = "identity_trust:device:admin" @@ -86,6 +89,11 @@ manifest = ModuleManifest( "Evaluate key access", "Evaluate device and key-epoch trust after Access has approved a resource action.", ), + _permission( + ASSURANCE_READ_SCOPE, + "View assurance evidence", + "View bounded assurance state and provenance for the acting account or, with administrative authority, another account.", + ), _permission( ASSURANCE_SCOPE, "Record assurance evidence", @@ -102,7 +110,7 @@ manifest = ModuleManifest( slug="identity_trust_user", name="Identity trust user", description="Manage own public device keys.", - permissions=(DEVICE_READ_SCOPE, DEVICE_WRITE_SCOPE), + permissions=(DEVICE_READ_SCOPE, DEVICE_WRITE_SCOPE, ASSURANCE_READ_SCOPE), ), RoleTemplate( slug="identity_trust_officer", @@ -110,6 +118,7 @@ manifest = ModuleManifest( description="Administer trust epochs and assurance evidence.", permissions=( DEVICE_READ_SCOPE, + ASSURANCE_READ_SCOPE, KEY_ACCESS_SCOPE, ASSURANCE_SCOPE, ADMIN_SCOPE, @@ -117,6 +126,42 @@ manifest = ModuleManifest( ), ), route_factory=_router, + frontend=FrontendModule( + module_id=MODULE_ID, + package_name="@govoplan/identity-trust-webui", + view_surfaces=( + ViewSurface( + id="identity_trust.settings.devices", + module_id=MODULE_ID, + kind="section", + label="Device trust", + order=10, + ), + ViewSurface( + id="identity_trust.admin.trust", + module_id=MODULE_ID, + kind="section", + label="Identity trust administration", + order=20, + ), + ViewSurface( + id="identity_trust.admin.epochs", + module_id=MODULE_ID, + kind="section", + label="Key epoch administration", + parent_id="identity_trust.admin.trust", + order=30, + ), + ViewSurface( + id="identity_trust.admin.decisions", + module_id=MODULE_ID, + kind="section", + label="Key-access decisions", + parent_id="identity_trust.admin.trust", + order=40, + ), + ), + ), capability_factories={ CAPABILITY_IDENTITY_TRUST_DIRECTORY: _service, CAPABILITY_IDENTITY_TRUST_ASSURANCE: _service, @@ -162,7 +207,7 @@ manifest = ModuleManifest( title="Device keys and key epochs", summary="Separate login authority from public device-key and cryptographic-access trust.", body=( - "Identity Trust stores public keys only. Access first decides whether an account may reach a protected resource; Identity Trust then verifies the current device and key epoch and records an auditable decision. Function and Postbox history grants are explicit epoch policy, and revocation cannot erase plaintext already obtained." + "Identity Trust stores public keys only. Users can review and revoke their device keys and inspect assurance provenance in Settings. Security officers can select an authorized account, inspect revoked or compromised-device evidence, rotate subject key epochs, and review key-access decisions in Administration. Access first decides whether an account may reach a protected resource; Identity Trust then verifies the current device and key epoch and records an auditable decision. Function and Postbox history grants are explicit epoch policy, and revocation cannot erase plaintext already obtained. Every revoke and rotation is revision-bound and stale actions must be reloaded." ), layer="available", documentation_types=("admin", "user"), @@ -211,6 +256,7 @@ def get_manifest() -> ModuleManifest: __all__ = [ "ADMIN_SCOPE", + "ASSURANCE_READ_SCOPE", "ASSURANCE_SCOPE", "DEVICE_READ_SCOPE", "DEVICE_WRITE_SCOPE", diff --git a/src/govoplan_identity_trust/backend/router.py b/src/govoplan_identity_trust/backend/router.py index 7d1891f..e312164 100644 --- a/src/govoplan_identity_trust/backend/router.py +++ b/src/govoplan_identity_trust/backend/router.py @@ -1,6 +1,7 @@ from __future__ import annotations from dataclasses import asdict +from datetime import UTC, datetime from fastapi import APIRouter, Depends, HTTPException, Query, status from sqlalchemy.orm import Session @@ -13,9 +14,15 @@ from govoplan_core.core.identity_trust import ( KeyAccessRequest, KeyEpochRotationRequest, ) +from govoplan_core.core.references import ( + access_scope_reference_options, + access_scope_reference_provider_available, +) +from govoplan_core.core.runtime import get_registry from govoplan_core.db.session import get_session from govoplan_identity_trust.backend.manifest import ( ADMIN_SCOPE, + ASSURANCE_READ_SCOPE, ASSURANCE_SCOPE, DEVICE_READ_SCOPE, DEVICE_WRITE_SCOPE, @@ -23,18 +30,25 @@ from govoplan_identity_trust.backend.manifest import ( ) from govoplan_identity_trust.backend.schemas import ( AssuranceCheckPayload, + AssuranceEvidenceListResponse, AssuranceEvidencePayload, + AssuranceEvidenceResponse, AssuranceResponse, DeviceKeyListResponse, DeviceKeyRegisterPayload, DeviceKeyResponse, DeviceKeyRevokePayload, EpochResponse, + EpochListResponse, EpochRotatePayload, KeyAccessPayload, + KeyAccessDecisionItem, + KeyAccessDecisionListResponse, KeyAccessResponse, + ReferenceOptionsResponse, ) from govoplan_identity_trust.backend.service import ( + IdentityTrustAccessDenied, IdentityTrustError, SqlIdentityTrustService, record_assurance_evidence, @@ -55,7 +69,14 @@ def _require(principal: ApiPrincipal, *scopes: str) -> None: def _error(exc: IdentityTrustError) -> HTTPException: - return HTTPException(status_code=status.HTTP_409_CONFLICT, detail=str(exc)) + return HTTPException( + status_code=( + status.HTTP_403_FORBIDDEN + if isinstance(exc, IdentityTrustAccessDenied) + else status.HTTP_409_CONFLICT + ), + detail=str(exc), + ) def _device_response(value) -> DeviceKeyResponse: @@ -66,6 +87,25 @@ def _epoch_response(value) -> EpochResponse: return EpochResponse(**asdict(value)) +def _assurance_response(value) -> AssuranceEvidenceResponse: + expires_at = value.expires_at + if expires_at.tzinfo is None: + expires_at = expires_at.replace(tzinfo=UTC) + return AssuranceEvidenceResponse( + id=value.id, + tenant_id=value.tenant_id, + account_id=value.account_id, + device_key_id=value.device_key_id, + evidence_ref=value.evidence_ref, + assurance_level=value.assurance_level, + provider_id=value.provider_id, + verified_at=value.verified_at, + expires_at=value.expires_at, + active=expires_at >= datetime.now(UTC), + provenance=dict(value.provenance or {}), + ) + + @router.post("/device-keys", response_model=DeviceKeyResponse) def api_register_device_key( payload: DeviceKeyRegisterPayload, @@ -119,6 +159,64 @@ def api_list_device_keys( return DeviceKeyListResponse(keys=[_device_response(value) for value in values]) +@router.get( + "/account-options", + response_model=ReferenceOptionsResponse, +) +def api_account_options( + q: str = Query(default="", max_length=200), + selected: list[str] = Query(default=[]), + limit: int = Query(default=50, ge=1, le=200), + session: Session = Depends(get_session), + principal: ApiPrincipal = Depends(get_api_principal), +) -> ReferenceOptionsResponse: + _require(principal, ADMIN_SCOPE) + registry = get_registry() + options = access_scope_reference_options( + registry, + principal, + scope_type="user", + reference_kind="user", + query=q, + selected_values=selected, + limit=limit, + administrative=True, + session=session, + ) + return ReferenceOptionsResponse( + options=[option.to_dict() for option in options], + provider_available=access_scope_reference_provider_available(registry), + ) + + +@router.get( + "/assurance/evidence", + response_model=AssuranceEvidenceListResponse, +) +def api_list_assurance_evidence( + account_id: str, + active_only: bool = Query(default=False), + limit: int = Query(default=200, ge=1, le=500), + session: Session = Depends(get_session), + principal: ApiPrincipal = Depends(get_api_principal), +) -> AssuranceEvidenceListResponse: + _require(principal, ASSURANCE_READ_SCOPE, ADMIN_SCOPE) + try: + values = service.list_assurance_evidence( + session, + principal, + tenant_id=principal.tenant_id, + account_id=account_id, + active_only=active_only, + limit=limit, + ) + except IdentityTrustError as exc: + raise _error(exc) from exc + return AssuranceEvidenceListResponse( + evidence=[_assurance_response(value) for value in values] + ) + + @router.post("/device-keys/{key_id}/revoke", response_model=DeviceKeyResponse) def api_revoke_device_key( key_id: str, @@ -184,6 +282,29 @@ def api_rotate_epoch( return _epoch_response(value) +@router.get("/epochs", response_model=EpochListResponse) +def api_list_epochs( + subject_kind: str, + subject_id: str, + limit: int = Query(default=200, ge=1, le=500), + session: Session = Depends(get_session), + principal: ApiPrincipal = Depends(get_api_principal), +) -> EpochListResponse: + _require(principal, ADMIN_SCOPE) + try: + values = service.list_epochs( + session, + principal, + tenant_id=principal.tenant_id, + subject_kind=subject_kind, + subject_id=subject_id, + limit=limit, + ) + except IdentityTrustError as exc: + raise _error(exc) from exc + return EpochListResponse(epochs=[_epoch_response(value) for value in values]) + + @router.post("/key-access/decide", response_model=KeyAccessResponse) def api_decide_key_access( payload: KeyAccessPayload, @@ -208,6 +329,35 @@ def api_decide_key_access( return KeyAccessResponse(**data) +@router.get( + "/key-access/decisions", + response_model=KeyAccessDecisionListResponse, +) +def api_list_key_access_decisions( + account_id: str, + limit: int = Query(default=200, ge=1, le=500), + session: Session = Depends(get_session), + principal: ApiPrincipal = Depends(get_api_principal), +) -> KeyAccessDecisionListResponse: + _require(principal, KEY_ACCESS_SCOPE, ADMIN_SCOPE) + try: + values = service.list_key_access_decisions( + session, + principal, + tenant_id=principal.tenant_id, + account_id=account_id, + limit=limit, + ) + except IdentityTrustError as exc: + raise _error(exc) from exc + return KeyAccessDecisionListResponse( + decisions=[ + KeyAccessDecisionItem.model_validate(value, from_attributes=True) + for value in values + ] + ) + + @router.post("/assurance/evidence", response_model=dict[str, object]) def api_record_assurance( payload: AssuranceEvidencePayload, diff --git a/src/govoplan_identity_trust/backend/schemas.py b/src/govoplan_identity_trust/backend/schemas.py index f3b55e9..53df744 100644 --- a/src/govoplan_identity_trust/backend/schemas.py +++ b/src/govoplan_identity_trust/backend/schemas.py @@ -49,6 +49,28 @@ class DeviceKeyListResponse(BaseModel): keys: list[DeviceKeyResponse] +class AssuranceEvidenceResponse(BaseModel): + id: str + tenant_id: str + account_id: str + device_key_id: str | None = None + evidence_ref: str + assurance_level: str + provider_id: str + verified_at: datetime + expires_at: datetime + active: bool + provenance: dict[str, Any] = Field(default_factory=dict) + + +class AssuranceEvidenceListResponse(BaseModel): + evidence: list[AssuranceEvidenceResponse] + + +class EpochListResponse(BaseModel): + epochs: list[EpochResponse] + + class EpochRotatePayload(BaseModel): subject_kind: Literal[ "identity", "account", "function", "postbox", "external_recipient" @@ -102,6 +124,34 @@ class KeyAccessResponse(BaseModel): provenance: dict[str, Any] = Field(default_factory=dict) +class KeyAccessDecisionItem(BaseModel): + id: str + decision_ref: str + account_id: str + device_key_id: str + subject_kind: str + subject_id: str + key_epoch: int + access_decision_ref: str + purpose: str + allowed: bool + reason: str + resource_ref: str | None = None + function_assignment_id: str | None = None + delegation_id: str | None = None + provenance: dict[str, Any] = Field(default_factory=dict) + created_at: datetime + + +class KeyAccessDecisionListResponse(BaseModel): + decisions: list[KeyAccessDecisionItem] + + +class ReferenceOptionsResponse(BaseModel): + options: list[dict[str, Any]] = Field(default_factory=list) + provider_available: bool = False + + class AssuranceEvidencePayload(BaseModel): account_id: str = Field(min_length=1, max_length=255) evidence_ref: str = Field(min_length=1, max_length=1000) diff --git a/src/govoplan_identity_trust/backend/service.py b/src/govoplan_identity_trust/backend/service.py index d0d3d36..7582d2f 100644 --- a/src/govoplan_identity_trust/backend/service.py +++ b/src/govoplan_identity_trust/backend/service.py @@ -31,6 +31,10 @@ class IdentityTrustError(ValueError): pass +class IdentityTrustAccessDenied(IdentityTrustError): + pass + + class SqlIdentityTrustService: def register_device_key( self, @@ -148,10 +152,8 @@ class SqlIdentityTrustService: ) -> tuple[DeviceKeyRef, ...]: db = _session(session) _require_tenant(principal, tenant_id) - if account_id != _account_id(principal) and not _has_scope( - principal, "identity_trust:device:read_all" - ): - raise IdentityTrustError( + if not _may_read_account(principal, account_id): + raise IdentityTrustAccessDenied( "The acting account cannot inspect these device keys." ) statement = select(DevicePublicKey).where( @@ -170,6 +172,100 @@ class SqlIdentityTrustService: ) ) + def list_assurance_evidence( + self, + session: object, + principal: object, + *, + tenant_id: str, + account_id: str, + active_only: bool = False, + limit: int = 200, + ) -> tuple[AssuranceEvidence, ...]: + db = _session(session) + _require_tenant(principal, tenant_id) + if not _may_read_account(principal, account_id): + raise IdentityTrustAccessDenied( + "The acting account cannot inspect this assurance evidence." + ) + statement = select(AssuranceEvidence).where( + AssuranceEvidence.tenant_id == tenant_id, + AssuranceEvidence.account_id == account_id, + ) + if active_only: + statement = statement.where( + AssuranceEvidence.expires_at >= _as_utc(utcnow()) + ) + return tuple( + db.scalars( + statement.order_by( + AssuranceEvidence.verified_at.desc(), + AssuranceEvidence.id, + ).limit(max(1, min(int(limit), 500))) + ) + ) + + def list_epochs( + self, + session: object, + principal: object, + *, + tenant_id: str, + subject_kind: str, + subject_id: str, + limit: int = 200, + ) -> tuple[KeyEpochRef, ...]: + db = _session(session) + _require_tenant(principal, tenant_id) + if not _has_scope(principal, "identity_trust:device:admin"): + raise IdentityTrustAccessDenied( + "Identity Trust administration is required to inspect key epochs." + ) + values = db.scalars( + select(TrustKeyEpoch) + .where( + TrustKeyEpoch.tenant_id == tenant_id, + TrustKeyEpoch.subject_kind == subject_kind, + TrustKeyEpoch.subject_id == subject_id, + ) + .order_by(TrustKeyEpoch.epoch.desc()) + .limit(max(1, min(int(limit), 500))) + ) + return tuple(_epoch_ref(value) for value in values) + + def list_key_access_decisions( + self, + session: object, + principal: object, + *, + tenant_id: str, + account_id: str, + limit: int = 200, + ) -> tuple[KeyAccessDecisionRecord, ...]: + db = _session(session) + _require_tenant(principal, tenant_id) + if not ( + _has_scope(principal, "identity_trust:key_access:approve") + or _has_scope(principal, "identity_trust:device:admin") + ): + raise IdentityTrustAccessDenied( + "Key-access decision authority is required to inspect decisions." + ) + return tuple( + db.scalars( + select(KeyAccessDecisionRecord) + .where( + KeyAccessDecisionRecord.tenant_id == tenant_id, + KeyAccessDecisionRecord.account_id == account_id, + ) + .order_by( + KeyAccessDecisionRecord.created_at.desc(), + KeyAccessDecisionRecord.id, + ) + .limit(max(1, min(int(limit), 500))) + ) + ) + def rotate_epoch( self, session: object, @@ -592,7 +688,9 @@ def _session(value: object) -> Session: def _require_tenant(principal: object, tenant_id: str) -> None: if str(getattr(principal, "tenant_id", "")) != tenant_id: - raise IdentityTrustError("Cross-tenant identity-trust access is denied.") + raise IdentityTrustAccessDenied( + "Cross-tenant identity-trust access is denied." + ) def _account_id(principal: object) -> str: @@ -605,6 +703,14 @@ def _has_scope(principal: object, scope: str) -> bool: return scope in set(getattr(principal, "scopes", ())) +def _may_read_account(principal: object, account_id: str) -> bool: + return ( + account_id == _account_id(principal) + or _has_scope(principal, "identity_trust:device:read_all") + or _has_scope(principal, "identity_trust:device:admin") + ) + + def _required(value: str, label: str) -> str: cleaned = value.strip() if not cleaned: @@ -630,6 +736,7 @@ def _as_utc(value: datetime) -> datetime: __all__ = [ + "IdentityTrustAccessDenied", "IdentityTrustError", "SqlIdentityTrustService", "record_assurance_evidence", diff --git a/tests/test_identity_trust.py b/tests/test_identity_trust.py index 9d56839..4dd073e 100644 --- a/tests/test_identity_trust.py +++ b/tests/test_identity_trust.py @@ -19,6 +19,7 @@ from govoplan_identity_trust.backend.db.models import ( TrustKeyEpoch, ) from govoplan_identity_trust.backend.service import ( + IdentityTrustAccessDenied, IdentityTrustError, SqlIdentityTrustService, record_assurance_evidence, @@ -36,9 +37,18 @@ class Principal: return scope in { "identity_trust:device:admin", "identity_trust:device:read_all", + "identity_trust:key_access:approve", } +class RestrictedPrincipal: + tenant_id = "tenant-1" + account_id = "account-2" + + def has(self, scope: str) -> bool: + return False + + def registration(**changes) -> DeviceKeyRegistration: values = { "tenant_id": "tenant-1", @@ -220,6 +230,89 @@ class IdentityTrustTests(unittest.TestCase): self.assertTrue(allowed.allowed) self.assertFalse(stale.allowed) + def test_bounded_projections_enforce_subject_access_and_keep_provenance(self) -> None: + self.service.register_device_key( + self.session, + self.principal, + request=registration(), + ) + record_assurance_evidence( + self.session, + self.principal, + tenant_id="tenant-1", + account_id="account-1", + evidence_ref="webauthn:assertion-2", + assurance_level="hardware", + provider_id="webauthn", + verified_at=NOW, + expires_at=NOW + timedelta(minutes=10), + device_key_id="key-1", + provenance={"ceremony": "uv", "policy_ref": "policy:assurance:1"}, + ) + epoch = self.service.rotate_epoch( + self.session, + self.principal, + request=KeyEpochRotationRequest( + tenant_id="tenant-1", + subject_kind="postbox", + subject_id="postbox-1", + reason="Initial epoch.", + access_decision_ref="access:grant-1", + idempotency_key="epoch-list-1", + previous_epoch=None, + history_policy="all_retained", + ), + ) + self.service.decide_key_access( + self.session, + self.principal, + request=KeyAccessRequest( + tenant_id="tenant-1", + account_id="account-1", + device_key_id="key-1", + subject_kind="postbox", + subject_id="postbox-1", + key_epoch=epoch.epoch, + access_decision_ref="access:grant-1", + purpose="postbox.message.read", + requested_at=NOW, + ), + ) + + evidence = self.service.list_assurance_evidence( + self.session, + self.principal, + tenant_id="tenant-1", + account_id="account-1", + ) + epochs = self.service.list_epochs( + self.session, + self.principal, + tenant_id="tenant-1", + subject_kind="postbox", + subject_id="postbox-1", + ) + decisions = self.service.list_key_access_decisions( + self.session, + self.principal, + tenant_id="tenant-1", + account_id="account-1", + ) + + self.assertEqual(1, len(evidence)) + self.assertEqual("policy:assurance:1", evidence[0].provenance["policy_ref"]) + self.assertEqual((1,), tuple(item.epoch for item in epochs)) + self.assertEqual(1, len(decisions)) + self.assertFalse(decisions[0].provenance["cryptographic_material_released"]) + + with self.assertRaises(IdentityTrustAccessDenied): + self.service.list_assurance_evidence( + self.session, + RestrictedPrincipal(), + tenant_id="tenant-1", + account_id="account-1", + ) + if __name__ == "__main__": unittest.main() diff --git a/tests/test_manifest.py b/tests/test_manifest.py index 71e417b..7f94647 100644 --- a/tests/test_manifest.py +++ b/tests/test_manifest.py @@ -22,7 +22,19 @@ class IdentityTrustManifestTests(unittest.TestCase): CAPABILITY_IDENTITY_TRUST_ASSURANCE, manifest.capability_factories, ) - self.assertIsNone(manifest.frontend) + self.assertIsNotNone(manifest.frontend) + self.assertEqual( + "@govoplan/identity-trust-webui", + manifest.frontend.package_name, + ) + self.assertIn( + "identity_trust.settings.devices", + {surface.id for surface in manifest.frontend.view_surfaces}, + ) + self.assertIn( + "identity_trust:assurance:read", + {permission.scope for permission in manifest.permissions}, + ) self.assertIsNotNone(manifest.migration_spec) self.assertEqual("vertical_slice", manifest.architecture.maturity) diff --git a/webui/package.json b/webui/package.json new file mode 100644 index 0000000..1665bcc --- /dev/null +++ b/webui/package.json @@ -0,0 +1,25 @@ +{ + "name": "@govoplan/identity-trust-webui", + "version": "0.1.14", + "private": true, + "type": "module", + "main": "src/index.ts", + "module": "src/index.ts", + "types": "src/index.ts", + "exports": { + ".": { "types": "./src/index.ts", "import": "./src/index.ts" }, + "./styles/identity-trust.css": "./src/styles/identity-trust.css" + }, + "peerDependencies": { + "@govoplan/core-webui": "^0.1.14", + "lucide-react": "^1.23.0", + "react": ">=19.2.7 <20", + "react-dom": ">=19.2.7 <20" + }, + "peerDependenciesMeta": { + "@govoplan/core-webui": { "optional": true } + }, + "scripts": { + "test:identity-trust-ui": "node tests/identity-trust-ui-structure.test.mjs" + } +} diff --git a/webui/src/api/identityTrust.ts b/webui/src/api/identityTrust.ts new file mode 100644 index 0000000..946e5c5 --- /dev/null +++ b/webui/src/api/identityTrust.ts @@ -0,0 +1,123 @@ +import { + apiFetch, + apiReferenceOptionProvider, + type ApiSettings, + type ReferenceOptionProvider +} from "@govoplan/core-webui"; + +export type DeviceKey = { + tenant_id: string; + identity_id: string; + account_id: string; + device_id: string; + key_id: string; + algorithm: string; + purpose: string; + assurance_level: string; + status: string; + epoch: number; + registered_at: string; + attestation_ref?: string | null; + expires_at?: string | null; + revoked_at?: string | null; + revocation_reason?: string | null; + provenance: Record; +}; + +export type AssuranceEvidence = { + id: string; + account_id: string; + device_key_id?: string | null; + evidence_ref: string; + assurance_level: string; + provider_id: string; + verified_at: string; + expires_at: string; + active: boolean; + provenance: Record; +}; + +export type KeyEpoch = { + tenant_id: string; + subject_kind: string; + subject_id: string; + epoch: number; + state: string; + history_policy: string; + effective_at: string; + previous_epoch?: number | null; + reason?: string | null; + access_decision_ref?: string | null; + provenance: Record; +}; + +export type KeyAccessDecision = { + id: string; + decision_ref: string; + account_id: string; + device_key_id: string; + subject_kind: string; + subject_id: string; + key_epoch: number; + access_decision_ref: string; + purpose: string; + allowed: boolean; + reason: string; + resource_ref?: string | null; + function_assignment_id?: string | null; + delegation_id?: string | null; + provenance: Record; + created_at: string; +}; + +export type EpochRotatePayload = { + subject_kind: "identity" | "account" | "function" | "postbox" | "external_recipient"; + subject_id: string; + reason: string; + access_decision_ref: string; + idempotency_key: string; + history_policy: string; + previous_epoch?: number | null; +}; + +export async function listDeviceKeys(settings: ApiSettings, accountId: string, activeOnly = false): Promise { + const params = new URLSearchParams({ account_id: accountId, active_only: String(activeOnly) }); + const response = await apiFetch<{ keys: DeviceKey[] }>(settings, `/api/v1/identity-trust/device-keys?${params}`); + return response.keys; +} + +export async function revokeDeviceKey(settings: ApiSettings, keyId: string, expectedEpoch: number, reason: string): Promise { + return apiFetch(settings, `/api/v1/identity-trust/device-keys/${encodeURIComponent(keyId)}/revoke`, { + method: "POST", + body: JSON.stringify({ expected_epoch: expectedEpoch, reason }) + }); +} + +export async function listAssuranceEvidence(settings: ApiSettings, accountId: string, activeOnly = false): Promise { + const params = new URLSearchParams({ account_id: accountId, active_only: String(activeOnly) }); + const response = await apiFetch<{ evidence: AssuranceEvidence[] }>(settings, `/api/v1/identity-trust/assurance/evidence?${params}`); + return response.evidence; +} + +export async function listEpochs(settings: ApiSettings, subjectKind: string, subjectId: string): Promise { + const params = new URLSearchParams({ subject_kind: subjectKind, subject_id: subjectId }); + const response = await apiFetch<{ epochs: KeyEpoch[] }>(settings, `/api/v1/identity-trust/epochs?${params}`); + return response.epochs; +} + +export async function rotateEpoch(settings: ApiSettings, payload: EpochRotatePayload): Promise { + return apiFetch(settings, "/api/v1/identity-trust/epochs/rotate", { + method: "POST", + body: JSON.stringify(payload) + }); +} + +export async function listKeyAccessDecisions(settings: ApiSettings, accountId: string): Promise { + const params = new URLSearchParams({ account_id: accountId }); + const response = await apiFetch<{ decisions: KeyAccessDecision[] }>(settings, `/api/v1/identity-trust/key-access/decisions?${params}`); + return response.decisions; +} + +export function identityTrustAccountProvider(settings: ApiSettings): ReferenceOptionProvider { + return apiReferenceOptionProvider(settings, "/api/v1/identity-trust/account-options"); +} diff --git a/webui/src/features/IdentityTrustPanel.tsx b/webui/src/features/IdentityTrustPanel.tsx new file mode 100644 index 0000000..ed522aa --- /dev/null +++ b/webui/src/features/IdentityTrustPanel.tsx @@ -0,0 +1,332 @@ +import { useCallback, useEffect, useMemo, useState } from "react"; +import { Eye, RefreshCw, RotateCw, ShieldOff } from "lucide-react"; +import { + AdminPageLayout, + Button, + Card, + DataGrid, + Dialog, + DismissibleAlert, + FormField, + LoadingFrame, + MetricCard, + ReferenceSelect, + StatusBadge, + TableActionGroup, + ToggleSwitch, + hasScope, + type ApiSettings, + type AuthInfo, + type DataGridColumn +} from "@govoplan/core-webui"; +import { + identityTrustAccountProvider, + listAssuranceEvidence, + listDeviceKeys, + listEpochs, + listKeyAccessDecisions, + revokeDeviceKey, + rotateEpoch, + type AssuranceEvidence, + type DeviceKey, + type KeyAccessDecision, + type KeyEpoch +} from "../api/identityTrust"; + +type IdentityTrustPanelProps = { + settings: ApiSettings; + auth: AuthInfo; + administrative?: boolean; +}; + +type EpochDraft = { + subjectKind: "identity" | "account" | "function" | "postbox" | "external_recipient"; + subjectId: string; + reason: string; + accessDecisionRef: string; +}; + +const EMPTY_EPOCH_DRAFT: EpochDraft = { + subjectKind: "postbox", + subjectId: "", + reason: "", + accessDecisionRef: "" +}; + +export default function IdentityTrustPanel({ settings, auth, administrative = false }: IdentityTrustPanelProps) { + const ownAccountId = auth.principal?.account_id || auth.user.account_id; + const canRevokeDevice = hasScope(auth, "identity_trust:device:write") + || hasScope(auth, "identity_trust:device:admin"); + const [accountId, setAccountId] = useState(ownAccountId); + const [keys, setKeys] = useState([]); + const [evidence, setEvidence] = useState([]); + const [decisions, setDecisions] = useState([]); + const [epochs, setEpochs] = useState([]); + const [showRevoked, setShowRevoked] = useState(false); + const [loading, setLoading] = useState(false); + const [busy, setBusy] = useState(false); + const [error, setError] = useState(""); + const [success, setSuccess] = useState(""); + const [revoking, setRevoking] = useState(null); + const [revocationReason, setRevocationReason] = useState(""); + const [selectedEvidence, setSelectedEvidence] = useState(null); + const [selectedDecision, setSelectedDecision] = useState(null); + const [epochDraft, setEpochDraft] = useState(EMPTY_EPOCH_DRAFT); + const accountProvider = useMemo(() => identityTrustAccountProvider(settings), [settings]); + + const loadAccount = useCallback(async () => { + if (!accountId) return; + setLoading(true); + setError(""); + try { + const [nextKeys, nextEvidence, nextDecisions] = await Promise.all([ + listDeviceKeys(settings, accountId, false), + listAssuranceEvidence(settings, accountId, false), + administrative ? listKeyAccessDecisions(settings, accountId) : Promise.resolve([]) + ]); + setKeys(nextKeys); + setEvidence(nextEvidence); + setDecisions(nextDecisions); + } catch (caught) { + setError(errorMessage(caught)); + setKeys([]); + setEvidence([]); + setDecisions([]); + } finally { + setLoading(false); + } + }, [accountId, administrative, settings]); + + useEffect(() => { + void loadAccount(); + }, [loadAccount]); + + const visibleKeys = showRevoked ? keys : keys.filter((key) => key.status === "active"); + const activeEvidence = evidence.filter((item) => item.active); + const highestAssurance = activeEvidence + .map((item) => item.assurance_level) + .sort((left, right) => assuranceRank(right) - assuranceRank(left))[0] ?? "None"; + + const keyColumns = useMemo[]>(() => [ + { id: "device", header: "Device", width: 180, sortable: true, filterable: true, render: (row) => row.device_id, value: (row) => row.device_id }, + { id: "key", header: "Public key", width: 220, sortable: true, filterable: true, render: (row) => row.key_id, value: (row) => row.key_id }, + { id: "purpose", header: "Purpose", width: 170, sortable: true, filterable: true, render: (row) => humanize(row.purpose), value: (row) => row.purpose }, + { id: "algorithm", header: "Algorithm", width: 130, sortable: true, filterable: true, render: (row) => row.algorithm, value: (row) => row.algorithm }, + { id: "assurance", header: "Assurance", width: 140, sortable: true, filterable: true, render: (row) => humanize(row.assurance_level), value: (row) => row.assurance_level }, + { id: "status", header: "Status", width: 130, sortable: true, filterable: true, render: (row) => , value: (row) => row.status }, + { id: "epoch", header: "Revision", width: 100, sortable: true, filterable: true, filterType: "integer", render: (row) => row.epoch, value: (row) => row.epoch }, + { id: "expiry", header: "Expiry", width: 180, sortable: true, filterable: true, filterType: "date", render: (row) => formatDateTime(row.expires_at), value: (row) => row.expires_at ?? "" }, + { + id: "actions", + header: "Actions", + width: 90, + sticky: "end", + align: "right", + render: (row) =>