Restructure solution layout by module
Some checks failed
Docs CI / lint-and-preview (push) Has been cancelled
Some checks failed
Docs CI / lint-and-preview (push) Has been cancelled
This commit is contained in:
root
@@ -1,11 +1,11 @@
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")"/.. && pwd)"
|
||||
OUTPUT_DIR="${1:-$REPO_ROOT/docs/schemas}"
|
||||
|
||||
pushd "$REPO_ROOT" > /dev/null
|
||||
|
||||
dotnet run --project tools/PolicySchemaExporter -- "$OUTPUT_DIR"
|
||||
|
||||
popd > /dev/null
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")"/.. && pwd)"
|
||||
OUTPUT_DIR="${1:-$REPO_ROOT/docs/schemas}"
|
||||
|
||||
pushd "$REPO_ROOT" > /dev/null
|
||||
|
||||
dotnet run --project tools/PolicySchemaExporter -- "$OUTPUT_DIR"
|
||||
|
||||
popd > /dev/null
|
||||
|
||||
@@ -1,63 +1,63 @@
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
usage() {
|
||||
cat <<'EOF'
|
||||
Usage: rotate-policy-cli-secret.sh [--output <path>] [--dry-run]
|
||||
|
||||
Generates a new random shared secret suitable for the Authority
|
||||
`policy-cli` client and optionally writes it to the target file
|
||||
in `etc/secrets/` with the standard header comment.
|
||||
|
||||
Options:
|
||||
--output <path> Destination file (default: etc/secrets/policy-cli.secret)
|
||||
--dry-run Print the generated secret to stdout without writing.
|
||||
-h, --help Show this help.
|
||||
EOF
|
||||
}
|
||||
|
||||
OUTPUT="etc/secrets/policy-cli.secret"
|
||||
DRY_RUN=0
|
||||
|
||||
while [[ $# -gt 0 ]]; do
|
||||
case "$1" in
|
||||
--output)
|
||||
OUTPUT="$2"
|
||||
shift 2
|
||||
;;
|
||||
--dry-run)
|
||||
DRY_RUN=1
|
||||
shift
|
||||
;;
|
||||
-h|--help)
|
||||
usage
|
||||
exit 0
|
||||
;;
|
||||
*)
|
||||
echo "Unknown argument: $1" >&2
|
||||
usage >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
if ! command -v openssl >/dev/null 2>&1; then
|
||||
echo "openssl is required to generate secrets" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Generate a 48-byte random secret, base64 encoded without padding.
|
||||
RAW_SECRET=$(openssl rand -base64 48 | tr -d '\n=')
|
||||
SECRET="policy-cli-${RAW_SECRET}"
|
||||
|
||||
if [[ "$DRY_RUN" -eq 1 ]]; then
|
||||
echo "$SECRET"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
cat <<EOF > "$OUTPUT"
|
||||
# generated $(date -u +%Y-%m-%dT%H:%M:%SZ) via scripts/rotate-policy-cli-secret.sh
|
||||
$SECRET
|
||||
EOF
|
||||
|
||||
echo "Wrote new policy-cli secret to $OUTPUT"
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
usage() {
|
||||
cat <<'EOF'
|
||||
Usage: rotate-policy-cli-secret.sh [--output <path>] [--dry-run]
|
||||
|
||||
Generates a new random shared secret suitable for the Authority
|
||||
`policy-cli` client and optionally writes it to the target file
|
||||
in `etc/secrets/` with the standard header comment.
|
||||
|
||||
Options:
|
||||
--output <path> Destination file (default: etc/secrets/policy-cli.secret)
|
||||
--dry-run Print the generated secret to stdout without writing.
|
||||
-h, --help Show this help.
|
||||
EOF
|
||||
}
|
||||
|
||||
OUTPUT="etc/secrets/policy-cli.secret"
|
||||
DRY_RUN=0
|
||||
|
||||
while [[ $# -gt 0 ]]; do
|
||||
case "$1" in
|
||||
--output)
|
||||
OUTPUT="$2"
|
||||
shift 2
|
||||
;;
|
||||
--dry-run)
|
||||
DRY_RUN=1
|
||||
shift
|
||||
;;
|
||||
-h|--help)
|
||||
usage
|
||||
exit 0
|
||||
;;
|
||||
*)
|
||||
echo "Unknown argument: $1" >&2
|
||||
usage >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
if ! command -v openssl >/dev/null 2>&1; then
|
||||
echo "openssl is required to generate secrets" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Generate a 48-byte random secret, base64 encoded without padding.
|
||||
RAW_SECRET=$(openssl rand -base64 48 | tr -d '\n=')
|
||||
SECRET="policy-cli-${RAW_SECRET}"
|
||||
|
||||
if [[ "$DRY_RUN" -eq 1 ]]; then
|
||||
echo "$SECRET"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
cat <<EOF > "$OUTPUT"
|
||||
# generated $(date -u +%Y-%m-%dT%H:%M:%SZ) via scripts/rotate-policy-cli-secret.sh
|
||||
$SECRET
|
||||
EOF
|
||||
|
||||
echo "Wrote new policy-cli secret to $OUTPUT"
|
||||
|
||||
@@ -1,19 +1,19 @@
|
||||
#!/usr/bin/env pwsh
|
||||
Set-StrictMode -Version Latest
|
||||
$ErrorActionPreference = "Stop"
|
||||
|
||||
$rootDir = Split-Path -Parent $PSCommandPath
|
||||
$rootDir = Join-Path $rootDir ".."
|
||||
$rootDir = Resolve-Path $rootDir
|
||||
|
||||
$env:UPDATE_APPLE_FIXTURES = "1"
|
||||
|
||||
Push-Location $rootDir
|
||||
try {
|
||||
$sentinel = Join-Path $rootDir "src/StellaOps.Concelier.Connector.Vndr.Apple.Tests/Apple/Fixtures/.update-apple-fixtures"
|
||||
New-Item -ItemType File -Path $sentinel -Force | Out-Null
|
||||
dotnet test "src\StellaOps.Concelier.Connector.Vndr.Apple.Tests\StellaOps.Concelier.Connector.Vndr.Apple.Tests.csproj" @Args
|
||||
}
|
||||
finally {
|
||||
Pop-Location
|
||||
}
|
||||
#!/usr/bin/env pwsh
|
||||
Set-StrictMode -Version Latest
|
||||
$ErrorActionPreference = "Stop"
|
||||
|
||||
$rootDir = Split-Path -Parent $PSCommandPath
|
||||
$rootDir = Join-Path $rootDir ".."
|
||||
$rootDir = Resolve-Path $rootDir
|
||||
|
||||
$env:UPDATE_APPLE_FIXTURES = "1"
|
||||
|
||||
Push-Location $rootDir
|
||||
try {
|
||||
$sentinel = Join-Path $rootDir "src/Concelier/__Tests/StellaOps.Concelier.Connector.Vndr.Apple.Tests/Apple/Fixtures/.update-apple-fixtures"
|
||||
New-Item -ItemType File -Path $sentinel -Force | Out-Null
|
||||
dotnet test "src\StellaOps.Concelier.Connector.Vndr.Apple.Tests\StellaOps.Concelier.Connector.Vndr.Apple.Tests.csproj" @Args
|
||||
}
|
||||
finally {
|
||||
Pop-Location
|
||||
}
|
||||
|
||||
@@ -1,14 +1,14 @@
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
|
||||
export UPDATE_APPLE_FIXTURES=1
|
||||
if [ -n "${WSLENV-}" ]; then
|
||||
export WSLENV="${WSLENV}:UPDATE_APPLE_FIXTURES/up"
|
||||
else
|
||||
export WSLENV="UPDATE_APPLE_FIXTURES/up"
|
||||
fi
|
||||
|
||||
touch "$ROOT_DIR/src/StellaOps.Concelier.Connector.Vndr.Apple.Tests/Apple/Fixtures/.update-apple-fixtures"
|
||||
( cd "$ROOT_DIR" && dotnet test "src/StellaOps.Concelier.Connector.Vndr.Apple.Tests/StellaOps.Concelier.Connector.Vndr.Apple.Tests.csproj" "$@" )
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
|
||||
export UPDATE_APPLE_FIXTURES=1
|
||||
if [ -n "${WSLENV-}" ]; then
|
||||
export WSLENV="${WSLENV}:UPDATE_APPLE_FIXTURES/up"
|
||||
else
|
||||
export WSLENV="UPDATE_APPLE_FIXTURES/up"
|
||||
fi
|
||||
|
||||
touch "$ROOT_DIR/src/Concelier/__Tests/StellaOps.Concelier.Connector.Vndr.Apple.Tests/Apple/Fixtures/.update-apple-fixtures"
|
||||
( cd "$ROOT_DIR" && dotnet test "src/Concelier/__Tests/StellaOps.Concelier.Connector.Vndr.Apple.Tests/StellaOps.Concelier.Connector.Vndr.Apple.Tests.csproj" "$@" )
|
||||
|
||||
@@ -1,9 +1,9 @@
|
||||
Param(
|
||||
[Parameter(ValueFromRemainingArguments = $true)]
|
||||
[string[]] $RestArgs
|
||||
)
|
||||
|
||||
$Root = Split-Path -Parent $PSScriptRoot
|
||||
$env:UPDATE_GOLDENS = "1"
|
||||
|
||||
dotnet test (Join-Path $Root "src/StellaOps.Concelier.Models.Tests/StellaOps.Concelier.Models.Tests.csproj") @RestArgs
|
||||
Param(
|
||||
[Parameter(ValueFromRemainingArguments = $true)]
|
||||
[string[]] $RestArgs
|
||||
)
|
||||
|
||||
$Root = Split-Path -Parent $PSScriptRoot
|
||||
$env:UPDATE_GOLDENS = "1"
|
||||
|
||||
dotnet test (Join-Path $Root "src/Concelier/__Tests/StellaOps.Concelier.Models.Tests/StellaOps.Concelier.Models.Tests.csproj") @RestArgs
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
|
||||
export UPDATE_GOLDENS=1
|
||||
|
||||
dotnet test "$ROOT_DIR/src/StellaOps.Concelier.Models.Tests/StellaOps.Concelier.Models.Tests.csproj" "$@"
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
|
||||
export UPDATE_GOLDENS=1
|
||||
|
||||
dotnet test "$ROOT_DIR/src/Concelier/__Tests/StellaOps.Concelier.Models.Tests/StellaOps.Concelier.Models.Tests.csproj" "$@"
|
||||
|
||||
@@ -1,57 +1,57 @@
|
||||
Set-StrictMode -Version Latest
|
||||
$ErrorActionPreference = 'Stop'
|
||||
|
||||
$repoRoot = Split-Path -Parent $PSScriptRoot
|
||||
$pluginsDir = Join-Path $repoRoot 'plugins\notify'
|
||||
|
||||
$assemblies = @{
|
||||
slack = 'StellaOps.Notify.Connectors.Slack.dll'
|
||||
teams = 'StellaOps.Notify.Connectors.Teams.dll'
|
||||
email = 'StellaOps.Notify.Connectors.Email.dll'
|
||||
webhook = 'StellaOps.Notify.Connectors.Webhook.dll'
|
||||
}
|
||||
|
||||
$hasFailures = $false
|
||||
|
||||
foreach ($channel in $assemblies.Keys) {
|
||||
$dir = Join-Path $pluginsDir $channel
|
||||
if (-not (Test-Path -LiteralPath $dir -PathType Container)) {
|
||||
Write-Host "ERROR: Missing plug-in directory '$dir'."
|
||||
$hasFailures = $true
|
||||
continue
|
||||
}
|
||||
|
||||
$manifest = Join-Path $dir 'notify-plugin.json'
|
||||
$assembly = Join-Path $dir $assemblies[$channel]
|
||||
$baseName = [System.IO.Path]::GetFileNameWithoutExtension($assemblies[$channel])
|
||||
$pdb = Join-Path $dir "$baseName.pdb"
|
||||
$deps = Join-Path $dir "$baseName.deps.json"
|
||||
|
||||
if (-not (Test-Path -LiteralPath $manifest -PathType Leaf)) {
|
||||
Write-Host "ERROR: Missing manifest for '$channel' connector ($manifest)."
|
||||
$hasFailures = $true
|
||||
}
|
||||
|
||||
if (-not (Test-Path -LiteralPath $assembly -PathType Leaf)) {
|
||||
Write-Host "ERROR: Missing assembly for '$channel' connector ($assembly)."
|
||||
$hasFailures = $true
|
||||
}
|
||||
|
||||
Get-ChildItem -LiteralPath $dir -File | ForEach-Object {
|
||||
switch ($_.Name) {
|
||||
'notify-plugin.json' { return }
|
||||
{ $_.Name -eq $assemblies[$channel] } { return }
|
||||
{ $_.Name -eq "$baseName.pdb" } { return }
|
||||
{ $_.Name -eq "$baseName.deps.json" } { return }
|
||||
default {
|
||||
Write-Host "ERROR: Unexpected file '$($_.Name)' in '$dir'."
|
||||
$hasFailures = $true
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if ($hasFailures) {
|
||||
exit 1
|
||||
}
|
||||
exit 0
|
||||
Set-StrictMode -Version Latest
|
||||
$ErrorActionPreference = 'Stop'
|
||||
|
||||
$repoRoot = Split-Path -Parent $PSScriptRoot
|
||||
$pluginsDir = Join-Path $repoRoot 'plugins\notify'
|
||||
|
||||
$assemblies = @{
|
||||
slack = 'StellaOps.Notify.Connectors.Slack.dll'
|
||||
teams = 'StellaOps.Notify.Connectors.Teams.dll'
|
||||
email = 'StellaOps.Notify.Connectors.Email.dll'
|
||||
webhook = 'StellaOps.Notify.Connectors.Webhook.dll'
|
||||
}
|
||||
|
||||
$hasFailures = $false
|
||||
|
||||
foreach ($channel in $assemblies.Keys) {
|
||||
$dir = Join-Path $pluginsDir $channel
|
||||
if (-not (Test-Path -LiteralPath $dir -PathType Container)) {
|
||||
Write-Host "ERROR: Missing plug-in directory '$dir'."
|
||||
$hasFailures = $true
|
||||
continue
|
||||
}
|
||||
|
||||
$manifest = Join-Path $dir 'notify-plugin.json'
|
||||
$assembly = Join-Path $dir $assemblies[$channel]
|
||||
$baseName = [System.IO.Path]::GetFileNameWithoutExtension($assemblies[$channel])
|
||||
$pdb = Join-Path $dir "$baseName.pdb"
|
||||
$deps = Join-Path $dir "$baseName.deps.json"
|
||||
|
||||
if (-not (Test-Path -LiteralPath $manifest -PathType Leaf)) {
|
||||
Write-Host "ERROR: Missing manifest for '$channel' connector ($manifest)."
|
||||
$hasFailures = $true
|
||||
}
|
||||
|
||||
if (-not (Test-Path -LiteralPath $assembly -PathType Leaf)) {
|
||||
Write-Host "ERROR: Missing assembly for '$channel' connector ($assembly)."
|
||||
$hasFailures = $true
|
||||
}
|
||||
|
||||
Get-ChildItem -LiteralPath $dir -File | ForEach-Object {
|
||||
switch ($_.Name) {
|
||||
'notify-plugin.json' { return }
|
||||
{ $_.Name -eq $assemblies[$channel] } { return }
|
||||
{ $_.Name -eq "$baseName.pdb" } { return }
|
||||
{ $_.Name -eq "$baseName.deps.json" } { return }
|
||||
default {
|
||||
Write-Host "ERROR: Unexpected file '$($_.Name)' in '$dir'."
|
||||
$hasFailures = $true
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if ($hasFailures) {
|
||||
exit 1
|
||||
}
|
||||
exit 0
|
||||
|
||||
@@ -1,56 +1,56 @@
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
plugins_dir="${repo_root}/plugins/notify"
|
||||
|
||||
declare -A assemblies=(
|
||||
[slack]="StellaOps.Notify.Connectors.Slack.dll"
|
||||
[teams]="StellaOps.Notify.Connectors.Teams.dll"
|
||||
[email]="StellaOps.Notify.Connectors.Email.dll"
|
||||
[webhook]="StellaOps.Notify.Connectors.Webhook.dll"
|
||||
)
|
||||
|
||||
status=0
|
||||
|
||||
for channel in "${!assemblies[@]}"; do
|
||||
dir="${plugins_dir}/${channel}"
|
||||
if [[ ! -d "${dir}" ]]; then
|
||||
echo "ERROR: Missing plug-in directory '${dir}'."
|
||||
status=1
|
||||
continue
|
||||
fi
|
||||
|
||||
manifest="${dir}/notify-plugin.json"
|
||||
assembly="${dir}/${assemblies[$channel]}"
|
||||
base="${assemblies[$channel]%.dll}"
|
||||
pdb="${dir}/${base}.pdb"
|
||||
deps="${dir}/${base}.deps.json"
|
||||
|
||||
if [[ ! -f "${manifest}" ]]; then
|
||||
echo "ERROR: Missing manifest for '${channel}' connector (${manifest})."
|
||||
status=1
|
||||
fi
|
||||
|
||||
if [[ ! -f "${assembly}" ]]; then
|
||||
echo "ERROR: Missing assembly for '${channel}' connector (${assembly})."
|
||||
status=1
|
||||
fi
|
||||
|
||||
while IFS= read -r -d '' file; do
|
||||
name="$(basename "${file}")"
|
||||
case "${name}" in
|
||||
"notify-plugin.json" \
|
||||
| "${assemblies[$channel]}" \
|
||||
| "${base}.pdb" \
|
||||
| "${base}.deps.json")
|
||||
;;
|
||||
*)
|
||||
echo "ERROR: Unexpected file '${name}' in '${dir}'."
|
||||
status=1
|
||||
;;
|
||||
esac
|
||||
done < <(find "${dir}" -maxdepth 1 -type f -print0)
|
||||
done
|
||||
|
||||
exit "${status}"
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
plugins_dir="${repo_root}/plugins/notify"
|
||||
|
||||
declare -A assemblies=(
|
||||
[slack]="StellaOps.Notify.Connectors.Slack.dll"
|
||||
[teams]="StellaOps.Notify.Connectors.Teams.dll"
|
||||
[email]="StellaOps.Notify.Connectors.Email.dll"
|
||||
[webhook]="StellaOps.Notify.Connectors.Webhook.dll"
|
||||
)
|
||||
|
||||
status=0
|
||||
|
||||
for channel in "${!assemblies[@]}"; do
|
||||
dir="${plugins_dir}/${channel}"
|
||||
if [[ ! -d "${dir}" ]]; then
|
||||
echo "ERROR: Missing plug-in directory '${dir}'."
|
||||
status=1
|
||||
continue
|
||||
fi
|
||||
|
||||
manifest="${dir}/notify-plugin.json"
|
||||
assembly="${dir}/${assemblies[$channel]}"
|
||||
base="${assemblies[$channel]%.dll}"
|
||||
pdb="${dir}/${base}.pdb"
|
||||
deps="${dir}/${base}.deps.json"
|
||||
|
||||
if [[ ! -f "${manifest}" ]]; then
|
||||
echo "ERROR: Missing manifest for '${channel}' connector (${manifest})."
|
||||
status=1
|
||||
fi
|
||||
|
||||
if [[ ! -f "${assembly}" ]]; then
|
||||
echo "ERROR: Missing assembly for '${channel}' connector (${assembly})."
|
||||
status=1
|
||||
fi
|
||||
|
||||
while IFS= read -r -d '' file; do
|
||||
name="$(basename "${file}")"
|
||||
case "${name}" in
|
||||
"notify-plugin.json" \
|
||||
| "${assemblies[$channel]}" \
|
||||
| "${base}.pdb" \
|
||||
| "${base}.deps.json")
|
||||
;;
|
||||
*)
|
||||
echo "ERROR: Unexpected file '${name}' in '${dir}'."
|
||||
status=1
|
||||
;;
|
||||
esac
|
||||
done < <(find "${dir}" -maxdepth 1 -type f -print0)
|
||||
done
|
||||
|
||||
exit "${status}"
|
||||
|
||||
@@ -1,86 +1,86 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Ensure Authority policy client configs use the fine-grained scope set."""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import sys
|
||||
from pathlib import Path
|
||||
|
||||
EXPECTED_SCOPES = (
|
||||
"policy:read",
|
||||
"policy:author",
|
||||
"policy:review",
|
||||
"policy:simulate",
|
||||
"findings:read",
|
||||
)
|
||||
|
||||
|
||||
def extract_scopes(lines: list[str], start_index: int) -> tuple[str, ...] | None:
|
||||
for offset in range(1, 12):
|
||||
if start_index + offset >= len(lines):
|
||||
break
|
||||
line = lines[start_index + offset].strip()
|
||||
if not line:
|
||||
continue
|
||||
if line.startswith("scopes:"):
|
||||
try:
|
||||
raw = line.split("[", 1)[1].rsplit("]", 1)[0]
|
||||
except IndexError:
|
||||
return None
|
||||
scopes = tuple(scope.strip().strip('"') for scope in raw.split(","))
|
||||
scopes = tuple(scope for scope in scopes if scope)
|
||||
return scopes
|
||||
return None
|
||||
|
||||
|
||||
def validate(path: Path) -> list[str]:
|
||||
errors: list[str] = []
|
||||
try:
|
||||
text = path.read_text(encoding="utf-8")
|
||||
except FileNotFoundError:
|
||||
return [f"{path}: missing file"]
|
||||
|
||||
if "policy:write" in text or "policy:submit" in text:
|
||||
errors.append(f"{path}: contains legacy policy scope names (policy:write/policy:submit)")
|
||||
|
||||
lines = text.splitlines()
|
||||
client_indices = [idx for idx, line in enumerate(lines) if 'clientId: "policy-cli"' in line]
|
||||
if not client_indices:
|
||||
errors.append(f"{path}: policy-cli client registration not found")
|
||||
return errors
|
||||
|
||||
for idx in client_indices:
|
||||
scopes = extract_scopes(lines, idx)
|
||||
if scopes is None:
|
||||
errors.append(f"{path}: unable to parse scopes for policy-cli client")
|
||||
continue
|
||||
if tuple(sorted(scopes)) != tuple(sorted(EXPECTED_SCOPES)):
|
||||
errors.append(
|
||||
f"{path}: unexpected policy-cli scopes {scopes}; expected {EXPECTED_SCOPES}"
|
||||
)
|
||||
|
||||
return errors
|
||||
|
||||
|
||||
def main(argv: list[str]) -> int:
|
||||
repo_root = Path(__file__).resolve().parents[1]
|
||||
targets = [
|
||||
repo_root / "etc" / "authority.yaml",
|
||||
repo_root / "etc" / "authority.yaml.sample",
|
||||
]
|
||||
|
||||
failures: list[str] = []
|
||||
for target in targets:
|
||||
failures.extend(validate(target))
|
||||
|
||||
if failures:
|
||||
for message in failures:
|
||||
print(f"error: {message}", file=sys.stderr)
|
||||
return 1
|
||||
|
||||
print("policy scope verification passed")
|
||||
return 0
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
raise SystemExit(main(sys.argv))
|
||||
#!/usr/bin/env python3
|
||||
"""Ensure Authority policy client configs use the fine-grained scope set."""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import sys
|
||||
from pathlib import Path
|
||||
|
||||
EXPECTED_SCOPES = (
|
||||
"policy:read",
|
||||
"policy:author",
|
||||
"policy:review",
|
||||
"policy:simulate",
|
||||
"findings:read",
|
||||
)
|
||||
|
||||
|
||||
def extract_scopes(lines: list[str], start_index: int) -> tuple[str, ...] | None:
|
||||
for offset in range(1, 12):
|
||||
if start_index + offset >= len(lines):
|
||||
break
|
||||
line = lines[start_index + offset].strip()
|
||||
if not line:
|
||||
continue
|
||||
if line.startswith("scopes:"):
|
||||
try:
|
||||
raw = line.split("[", 1)[1].rsplit("]", 1)[0]
|
||||
except IndexError:
|
||||
return None
|
||||
scopes = tuple(scope.strip().strip('"') for scope in raw.split(","))
|
||||
scopes = tuple(scope for scope in scopes if scope)
|
||||
return scopes
|
||||
return None
|
||||
|
||||
|
||||
def validate(path: Path) -> list[str]:
|
||||
errors: list[str] = []
|
||||
try:
|
||||
text = path.read_text(encoding="utf-8")
|
||||
except FileNotFoundError:
|
||||
return [f"{path}: missing file"]
|
||||
|
||||
if "policy:write" in text or "policy:submit" in text:
|
||||
errors.append(f"{path}: contains legacy policy scope names (policy:write/policy:submit)")
|
||||
|
||||
lines = text.splitlines()
|
||||
client_indices = [idx for idx, line in enumerate(lines) if 'clientId: "policy-cli"' in line]
|
||||
if not client_indices:
|
||||
errors.append(f"{path}: policy-cli client registration not found")
|
||||
return errors
|
||||
|
||||
for idx in client_indices:
|
||||
scopes = extract_scopes(lines, idx)
|
||||
if scopes is None:
|
||||
errors.append(f"{path}: unable to parse scopes for policy-cli client")
|
||||
continue
|
||||
if tuple(sorted(scopes)) != tuple(sorted(EXPECTED_SCOPES)):
|
||||
errors.append(
|
||||
f"{path}: unexpected policy-cli scopes {scopes}; expected {EXPECTED_SCOPES}"
|
||||
)
|
||||
|
||||
return errors
|
||||
|
||||
|
||||
def main(argv: list[str]) -> int:
|
||||
repo_root = Path(__file__).resolve().parents[1]
|
||||
targets = [
|
||||
repo_root / "etc" / "authority.yaml",
|
||||
repo_root / "etc" / "authority.yaml.sample",
|
||||
]
|
||||
|
||||
failures: list[str] = []
|
||||
for target in targets:
|
||||
failures.extend(validate(target))
|
||||
|
||||
if failures:
|
||||
for message in failures:
|
||||
print(f"error: {message}", file=sys.stderr)
|
||||
return 1
|
||||
|
||||
print("policy scope verification passed")
|
||||
return 0
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
raise SystemExit(main(sys.argv))
|
||||
|
||||
Reference in New Issue
Block a user