465 lines
22 KiB
Python
465 lines
22 KiB
Python
from __future__ import annotations
|
|
|
|
from pathlib import Path
|
|
|
|
from govoplan_core.core.identity_trust import (
|
|
CAPABILITY_IDENTITY_TRUST_ASSURANCE,
|
|
CAPABILITY_IDENTITY_TRUST_DIRECTORY,
|
|
)
|
|
from govoplan_core.core.module_guards import (
|
|
drop_table_retirement_provider,
|
|
persistent_table_uninstall_guard,
|
|
)
|
|
from govoplan_core.core.modules import (
|
|
CapabilityDocumentation,
|
|
DocumentationCondition,
|
|
DocumentationLink,
|
|
DocumentationTopic,
|
|
FrontendModule,
|
|
MigrationSpec,
|
|
ModuleContext,
|
|
ModuleInterfaceProvider,
|
|
ModuleManifest,
|
|
PermissionDefinition,
|
|
RoleTemplate,
|
|
ViewSurface,
|
|
)
|
|
from govoplan_core.core.provider_governance import declared_module_architecture
|
|
from govoplan_core.db.base import Base
|
|
from govoplan_identity_trust.backend.db import models
|
|
from govoplan_identity_trust.backend.dsar_provider import (
|
|
IDENTITY_TRUST_DSAR_CAPABILITY,
|
|
IdentityTrustDsarProvider,
|
|
)
|
|
from govoplan_identity_trust.backend.service import SqlIdentityTrustService
|
|
|
|
|
|
MODULE_ID = "identity_trust"
|
|
MODULE_NAME = "Identity Trust"
|
|
MODULE_VERSION = "0.1.21"
|
|
DEVICE_READ_SCOPE = "identity_trust:device:read"
|
|
DEVICE_WRITE_SCOPE = "identity_trust:device:write"
|
|
KEY_ACCESS_SCOPE = "identity_trust:key_access:approve"
|
|
ASSURANCE_SCOPE = "identity_trust:assurance:record"
|
|
ASSURANCE_READ_SCOPE = "identity_trust:assurance:read"
|
|
ADMIN_SCOPE = "identity_trust:device:admin"
|
|
|
|
|
|
def _permission(scope: str, label: str, description: str) -> PermissionDefinition:
|
|
module_id, resource, action = scope.split(":", 2)
|
|
return PermissionDefinition(
|
|
scope=scope,
|
|
label=label,
|
|
description=description,
|
|
category="Identity Trust",
|
|
level="tenant",
|
|
module_id=module_id,
|
|
resource=resource,
|
|
action=action,
|
|
)
|
|
|
|
|
|
def _router(_context: ModuleContext):
|
|
from govoplan_identity_trust.backend.router import router
|
|
|
|
return router
|
|
|
|
|
|
def _service(_context: ModuleContext) -> SqlIdentityTrustService:
|
|
return SqlIdentityTrustService()
|
|
|
|
|
|
def _dsar_provider(_context: ModuleContext) -> IdentityTrustDsarProvider:
|
|
return IdentityTrustDsarProvider()
|
|
|
|
|
|
manifest = ModuleManifest(
|
|
id=MODULE_ID,
|
|
name=MODULE_NAME,
|
|
version=MODULE_VERSION,
|
|
optional_dependencies=("access", "audit", "policy", "encryption", "postbox"),
|
|
provides_interfaces=(
|
|
ModuleInterfaceProvider(name="identity_trust.directory", version="1.0.0"),
|
|
ModuleInterfaceProvider(name="identity_trust.assurance", version="1.0.0"),
|
|
ModuleInterfaceProvider(
|
|
name=IDENTITY_TRUST_DSAR_CAPABILITY,
|
|
version="0.1.0",
|
|
),
|
|
),
|
|
permissions=(
|
|
_permission(
|
|
DEVICE_READ_SCOPE,
|
|
"View device keys",
|
|
"View public device-key and trust state.",
|
|
),
|
|
_permission(
|
|
DEVICE_WRITE_SCOPE,
|
|
"Manage own device keys",
|
|
"Register and revoke public keys for the acting account.",
|
|
),
|
|
_permission(
|
|
KEY_ACCESS_SCOPE,
|
|
"Evaluate key access",
|
|
"Evaluate device and key-epoch trust after Access has approved a resource action.",
|
|
),
|
|
_permission(
|
|
ASSURANCE_READ_SCOPE,
|
|
"View assurance evidence",
|
|
"View bounded assurance state and provenance for the acting account or, with administrative authority, another account.",
|
|
),
|
|
_permission(
|
|
ASSURANCE_SCOPE,
|
|
"Record assurance evidence",
|
|
"Record bounded assurance evidence from a trusted authentication provider.",
|
|
),
|
|
_permission(
|
|
ADMIN_SCOPE,
|
|
"Administer identity trust",
|
|
"Administer device keys, trust epochs, and assurance evidence.",
|
|
),
|
|
),
|
|
role_templates=(
|
|
RoleTemplate(
|
|
slug="identity_trust_user",
|
|
name="Identity trust user",
|
|
description="Manage own public device keys.",
|
|
permissions=(DEVICE_READ_SCOPE, DEVICE_WRITE_SCOPE, ASSURANCE_READ_SCOPE),
|
|
),
|
|
RoleTemplate(
|
|
slug="identity_trust_officer",
|
|
name="Identity trust officer",
|
|
description="Administer trust epochs and assurance evidence.",
|
|
permissions=(
|
|
DEVICE_READ_SCOPE,
|
|
ASSURANCE_READ_SCOPE,
|
|
KEY_ACCESS_SCOPE,
|
|
ASSURANCE_SCOPE,
|
|
ADMIN_SCOPE,
|
|
),
|
|
),
|
|
),
|
|
route_factory=_router,
|
|
frontend=FrontendModule(
|
|
module_id=MODULE_ID,
|
|
package_name="@govoplan/identity-trust-webui",
|
|
view_surfaces=(
|
|
ViewSurface(
|
|
id="identity_trust.settings.devices",
|
|
module_id=MODULE_ID,
|
|
kind="section",
|
|
label="Device trust",
|
|
order=10,
|
|
),
|
|
ViewSurface(
|
|
id="identity_trust.admin.trust",
|
|
module_id=MODULE_ID,
|
|
kind="section",
|
|
label="Identity trust administration",
|
|
order=20,
|
|
),
|
|
ViewSurface(
|
|
id="identity_trust.admin.epochs",
|
|
module_id=MODULE_ID,
|
|
kind="section",
|
|
label="Key epoch administration",
|
|
parent_id="identity_trust.admin.trust",
|
|
order=30,
|
|
),
|
|
ViewSurface(
|
|
id="identity_trust.admin.decisions",
|
|
module_id=MODULE_ID,
|
|
kind="section",
|
|
label="Key-access decisions",
|
|
parent_id="identity_trust.admin.trust",
|
|
order=40,
|
|
),
|
|
),
|
|
),
|
|
capability_factories={
|
|
CAPABILITY_IDENTITY_TRUST_DIRECTORY: _service,
|
|
CAPABILITY_IDENTITY_TRUST_ASSURANCE: _service,
|
|
IDENTITY_TRUST_DSAR_CAPABILITY: _dsar_provider,
|
|
},
|
|
capability_documentation={
|
|
CAPABILITY_IDENTITY_TRUST_DIRECTORY: CapabilityDocumentation(
|
|
label="Identity Trust directory",
|
|
summary="Resolves public device keys, key epochs, and auditable release decisions without private key material.",
|
|
contract_version="1.0.0",
|
|
),
|
|
CAPABILITY_IDENTITY_TRUST_ASSURANCE: CapabilityDocumentation(
|
|
label="Identity Trust assurance",
|
|
summary="Verifies bounded, recent assurance evidence for high-risk cryptographic operations.",
|
|
contract_version="1.0.0",
|
|
),
|
|
IDENTITY_TRUST_DSAR_CAPABILITY: CapabilityDocumentation(
|
|
label="Identity Trust data-subject request provider",
|
|
summary=(
|
|
"Exports bounded device-key and assurance records while keeping "
|
|
"cryptographic history under governed retention and review."
|
|
),
|
|
contract_version="0.1.0",
|
|
),
|
|
},
|
|
migration_spec=MigrationSpec(
|
|
module_id=MODULE_ID,
|
|
metadata=Base.metadata,
|
|
script_location=str(Path(__file__).with_name("migrations") / "versions"),
|
|
retirement_supported=True,
|
|
retirement_provider=drop_table_retirement_provider(
|
|
models.KeyAccessDecisionRecord,
|
|
models.AssuranceEvidence,
|
|
models.TrustKeyEpoch,
|
|
models.DevicePublicKey,
|
|
label="Identity Trust",
|
|
),
|
|
retirement_notes="Destructive retirement removes public-key, epoch, assurance, and key-access evidence after a database snapshot.",
|
|
),
|
|
uninstall_guard_providers=(
|
|
persistent_table_uninstall_guard(
|
|
models.DevicePublicKey,
|
|
models.TrustKeyEpoch,
|
|
models.AssuranceEvidence,
|
|
models.KeyAccessDecisionRecord,
|
|
label="Identity Trust",
|
|
),
|
|
),
|
|
documentation=(
|
|
DocumentationTopic(
|
|
id="identity-trust.data-subject-requests",
|
|
title="Identity Trust data-subject requests",
|
|
summary=(
|
|
"Export tenant-scoped device trust, assurance, epoch, and key-access "
|
|
"evidence without private or operational key material."
|
|
),
|
|
body=(
|
|
"Identity Trust correlates exact account and identity identifiers in "
|
|
"the active tenant and can narrow results to an exact device or key. "
|
|
"The access package includes bounded public-key registration fields, "
|
|
"assurance state, matching key epochs, and key-access decisions. It "
|
|
"never exports private JWK parameters, request digests, idempotency "
|
|
"keys, or arbitrary provenance payloads. Device-key revocation requires "
|
|
"manual review of recovery, active encrypted resources, and the current "
|
|
"epoch. Assurance, epoch, and access-decision records remain immutable "
|
|
"security evidence."
|
|
),
|
|
layer="configured",
|
|
documentation_types=("admin", "user"),
|
|
audience=("user", "administrator", "security_officer", "auditor"),
|
|
related_modules=("core", "access", "encryption", "postbox"),
|
|
metadata={
|
|
"kind": "reference",
|
|
"help_contexts": [
|
|
"identity_trust.settings.devices",
|
|
"identity_trust.admin.trust",
|
|
"privacy.data-subject-requests",
|
|
],
|
|
"consequence_classes": {
|
|
"export_trust_state": (
|
|
"Returns bounded public trust and assurance evidence only."
|
|
),
|
|
"review_device_revocation": (
|
|
"Requires recovery and encrypted-resource impact review."
|
|
),
|
|
"retain_security_evidence": (
|
|
"Preserves epoch, assurance, and access-decision history."
|
|
),
|
|
},
|
|
},
|
|
translations={
|
|
"de": {
|
|
"title": "Datenschutzanfragen zu Identity Trust",
|
|
"summary": (
|
|
"Mandantenbezogene Gerätevertrauens-, Assurance-, Epochen- und "
|
|
"Schlüsselzugriffsnachweise ohne private oder operative Schlüsselmaterialien exportieren."
|
|
),
|
|
"body": (
|
|
"Identity Trust gleicht im aktiven Mandanten exakte Konto- und Identitätskennungen ab "
|
|
"und kann Ergebnisse auf ein bestimmtes Gerät oder einen bestimmten Schlüssel eingrenzen. "
|
|
"Das Auskunftspaket enthält begrenzte Registrierungsfelder öffentlicher Schlüssel, den "
|
|
"Assurance-Status, passende Schlüsselepochen und Schlüsselzugriffsentscheidungen. Private "
|
|
"JWK-Parameter, Anforderungsprüfsummen, Idempotenzschlüssel und beliebige "
|
|
"Provenienzinhalte werden niemals exportiert. Der Widerruf eines Geräteschlüssels erfordert "
|
|
"eine manuelle Prüfung der Wiederherstellung, aktiver verschlüsselter Ressourcen und der "
|
|
"aktuellen Epoche. Assurance-, Epochen- und Zugriffsentscheidungsdatensätze bleiben "
|
|
"unveränderliche Sicherheitsnachweise."
|
|
),
|
|
}
|
|
},
|
|
structured_translation_version="1",
|
|
structured_translations={
|
|
"de": {
|
|
"consequence_classes": {
|
|
"export_trust_state": (
|
|
"Gibt ausschließlich begrenzte öffentliche Vertrauens- und Assurance-Nachweise zurück."
|
|
),
|
|
"review_device_revocation": (
|
|
"Erfordert eine Prüfung der Wiederherstellung und der Auswirkungen auf verschlüsselte Ressourcen."
|
|
),
|
|
"retain_security_evidence": (
|
|
"Bewahrt die Historie von Epochen, Assurance und Zugriffsentscheidungen auf."
|
|
),
|
|
}
|
|
}
|
|
},
|
|
),
|
|
DocumentationTopic(
|
|
id="identity-trust.device-keys",
|
|
title="Device keys and key epochs",
|
|
summary="Separate login authority from public device-key and cryptographic-access trust.",
|
|
body=(
|
|
"Identity Trust stores public keys only. Users can review and revoke their device keys and inspect assurance provenance in Settings. Security officers can select an authorized account, inspect revoked or compromised-device evidence, rotate subject key epochs, and review key-access decisions in Administration. Access first decides whether an account may reach a protected resource; Identity Trust then verifies the current device and key epoch and records an auditable decision. Function and Postbox history grants are explicit epoch policy, and revocation cannot erase plaintext already obtained. Every revoke and rotation is revision-bound and stale actions must be reloaded."
|
|
),
|
|
layer="available",
|
|
documentation_types=("admin", "user"),
|
|
audience=("user", "administrator", "security_officer", "auditor"),
|
|
conditions=(
|
|
DocumentationCondition(
|
|
any_scopes=(DEVICE_READ_SCOPE, ASSURANCE_READ_SCOPE)
|
|
),
|
|
),
|
|
related_modules=("access", "audit", "policy", "encryption", "postbox"),
|
|
metadata={
|
|
"kind": "workflow",
|
|
"help_contexts": [
|
|
"identity_trust.settings.devices",
|
|
"identity_trust.admin.trust",
|
|
],
|
|
"purpose": (
|
|
"Review public device-key trust and rotate or revoke trust evidence without handling private keys."
|
|
),
|
|
"prerequisites": [
|
|
"The actor has device or assurance read access; consequential actions require their dedicated scopes.",
|
|
"Access has already authorized the account and protected resource independently.",
|
|
],
|
|
"steps": [
|
|
"Review registered public device keys and their assurance provenance in Settings.",
|
|
"Inspect the current key epoch and any recorded key-access decisions before changing trust state.",
|
|
"Assess recovery and encrypted-resource impact before revoking a device key.",
|
|
"Security officers may rotate a subject epoch or record assurance only with the corresponding authority.",
|
|
"Reload stale evidence before retrying a revision-bound revoke or rotation action.",
|
|
],
|
|
"limitations": [
|
|
"Identity Trust stores public trust metadata only and provides neither private-key custody nor content encryption.",
|
|
"Trust metadata is not device certification or proof that plaintext was never obtained.",
|
|
],
|
|
"operational_consequences": {
|
|
"revoke_device": "Blocks future trust decisions for the device but cannot erase plaintext already obtained.",
|
|
"rotate_epoch": "Changes the epoch accepted by future key-access decisions and requires impact review.",
|
|
"record_assurance": "Appends immutable provenance evidence; it does not replace Access authorization.",
|
|
},
|
|
"verification": [
|
|
"The displayed key contains public parameters only and names its current status and revision.",
|
|
"Every consequential action records the actor, revision, reason, and resulting trust state.",
|
|
"Access authorization and Identity Trust decisions remain separately auditable.",
|
|
],
|
|
},
|
|
translations={
|
|
"de": {
|
|
"title": "Geräteschlüssel und Schlüsselepochen",
|
|
"summary": (
|
|
"Anmeldeberechtigung von öffentlichen Geräteschlüsseln und dem Vertrauen für "
|
|
"kryptografische Zugriffe trennen."
|
|
),
|
|
"body": (
|
|
"Identity Trust speichert ausschließlich öffentliche Schlüssel. Benutzer können ihre "
|
|
"Geräteschlüssel in den Einstellungen prüfen und widerrufen sowie die Herkunft von "
|
|
"Assurance-Nachweisen einsehen. Sicherheitsverantwortliche können ein berechtigtes Konto "
|
|
"auswählen, Nachweise zu widerrufenen oder kompromittierten Geräten prüfen, "
|
|
"Schlüsselepochen einer betroffenen Person rotieren und Schlüsselzugriffsentscheidungen "
|
|
"in der Administration nachvollziehen. Access entscheidet zuerst, ob ein Konto eine "
|
|
"geschützte Ressource erreichen darf; Identity Trust prüft anschließend das aktuelle Gerät "
|
|
"und die Schlüsselepoche und zeichnet eine nachvollziehbare Entscheidung auf. Historische "
|
|
"Freigaben für Funktionen und Postbox sind ausdrückliche Epochenrichtlinien. Ein Widerruf "
|
|
"kann bereits erhaltenen Klartext nicht löschen. Jeder Widerruf und jede Rotation ist an "
|
|
"eine Revision gebunden; veraltete Aktionen müssen neu geladen werden."
|
|
),
|
|
}
|
|
},
|
|
structured_translation_version="1",
|
|
structured_translations={
|
|
"de": {
|
|
"purpose": (
|
|
"Das Vertrauen in öffentliche Geräteschlüssel prüfen und Vertrauensnachweise rotieren oder widerrufen, ohne private Schlüssel zu verarbeiten."
|
|
),
|
|
"prerequisites": [
|
|
"Die handelnde Person darf Geräte oder Assurance lesen; folgenreiche Aktionen erfordern ihre jeweils eigenen Berechtigungen.",
|
|
"Access hat das Konto und die geschützte Ressource bereits unabhängig autorisiert.",
|
|
],
|
|
"steps": [
|
|
"Registrierte öffentliche Geräteschlüssel und die Herkunft ihrer Assurance-Nachweise in den Einstellungen prüfen.",
|
|
"Vor einer Änderung des Vertrauensstatus die aktuelle Schlüsselepoche und aufgezeichnete Schlüsselzugriffsentscheidungen prüfen.",
|
|
"Vor dem Widerruf eines Geräteschlüssels Wiederherstellung und Auswirkungen auf verschlüsselte Ressourcen bewerten.",
|
|
"Sicherheitsverantwortliche dürfen eine Epoche rotieren oder Assurance nur mit der jeweiligen Berechtigung aufzeichnen.",
|
|
"Veraltete Nachweise neu laden, bevor eine revisionsgebundene Widerrufs- oder Rotationsaktion wiederholt wird.",
|
|
],
|
|
"limitations": [
|
|
"Identity Trust speichert nur öffentliche Vertrauensmetadaten und bietet weder private Schlüsselverwahrung noch Inhaltsverschlüsselung.",
|
|
"Vertrauensmetadaten sind keine Gerätezertifizierung und kein Nachweis dafür, dass niemals Klartext erhalten wurde.",
|
|
],
|
|
"operational_consequences": {
|
|
"revoke_device": "Blockiert künftige Vertrauensentscheidungen für das Gerät, kann aber bereits erhaltenen Klartext nicht löschen.",
|
|
"rotate_epoch": "Ändert die für künftige Schlüsselzugriffsentscheidungen akzeptierte Epoche und erfordert eine Folgenprüfung.",
|
|
"record_assurance": "Fügt unveränderliche Herkunftsnachweise an und ersetzt nicht die Autorisierung durch Access.",
|
|
},
|
|
"verification": [
|
|
"Der angezeigte Schlüssel enthält nur öffentliche Parameter und nennt aktuellen Status und Revision.",
|
|
"Jede folgenreiche Aktion zeichnet Akteur, Revision, Begründung und resultierenden Vertrauensstatus auf.",
|
|
"Access-Autorisierung und Identity-Trust-Entscheidung bleiben getrennt nachvollziehbar.",
|
|
],
|
|
}
|
|
},
|
|
links=(
|
|
DocumentationLink(
|
|
label="Device-key trust and recovery boundary",
|
|
href="govoplan-identity-trust/docs/DEVICE_KEY_TRUST_CONCEPT.md",
|
|
kind="repository",
|
|
),
|
|
),
|
|
),
|
|
),
|
|
architecture=declared_module_architecture(
|
|
layer="institutional_foundation",
|
|
kind="foundation",
|
|
maturity="vertical_slice",
|
|
documentation_ref="docs/DEVICE_KEY_TRUST_CONCEPT.md",
|
|
test_ref="tests/test_identity_trust.py",
|
|
known_limits=(
|
|
"No private key custody, device attestation verifier, or cryptographic rewrap implementation is included.",
|
|
),
|
|
owned_concepts=(
|
|
"public device key",
|
|
"key epoch",
|
|
"assurance evidence",
|
|
"key-access trust decision",
|
|
),
|
|
non_owned_concepts=(
|
|
"login session",
|
|
"resource authorization",
|
|
"private key",
|
|
"content encryption",
|
|
),
|
|
migration_docs=("docs/DEVICE_KEY_TRUST_CONCEPT.md",),
|
|
recovery_docs=("docs/DEVICE_KEY_TRUST_CONCEPT.md",),
|
|
security_docs=("docs/DEVICE_KEY_TRUST_CONCEPT.md",),
|
|
operations_docs=("README.md",),
|
|
),
|
|
)
|
|
|
|
|
|
def get_manifest() -> ModuleManifest:
|
|
return manifest
|
|
|
|
|
|
__all__ = [
|
|
"ADMIN_SCOPE",
|
|
"ASSURANCE_READ_SCOPE",
|
|
"ASSURANCE_SCOPE",
|
|
"DEVICE_READ_SCOPE",
|
|
"DEVICE_WRITE_SCOPE",
|
|
"KEY_ACCESS_SCOPE",
|
|
"MODULE_ID",
|
|
"MODULE_VERSION",
|
|
"get_manifest",
|
|
"manifest",
|
|
]
|