stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 2 Releases Wiki Activity

search and ai stabilization work, localization stablized.

Browse Source
This commit is contained in:
master
2026-02-24 23:29:36 +02:00
parent 4f947a8b61
commit b07d27772e
766 changed files with 55299 additions and 3221 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
src/EvidenceLocker/StellaOps.EvidenceLocker/Api/EvidenceThreadEndpoints.cs
View File

@@ -6,6 +6,7 @@ using StellaOps.Auth.ServerIntegration;
using StellaOps.Auth.ServerIntegration.Tenancy;
using StellaOps.EvidenceLocker.Storage;
using System.Text.Json;
using static StellaOps.Localization.T;
namespace StellaOps.EvidenceLocker.Api;
@@ -64,7 +65,7 @@ public static class EvidenceThreadEndpoints
if (record is null)
{
logger.LogWarning("Evidence thread not found for canonical_id {CanonicalId}", canonicalId);
return Results.NotFound(new { error = "Evidence thread not found", canonical_id = canonicalId });
return Results.NotFound(new { error = _t("evidencelocker.error.thread_not_found"), canonical_id = canonicalId });
}
var attestations = ParseAttestations(record.Attestations);
@@ -101,7 +102,7 @@ public static class EvidenceThreadEndpoints
{
if (string.IsNullOrWhiteSpace(purl))
{
return Results.BadRequest(new { error = "purl query parameter is required" });
return Results.BadRequest(new { error = _t("evidencelocker.validation.purl_required") });
}
logger.LogInformation("Listing evidence threads for PURL {Purl}", purl);

9
src/EvidenceLocker/StellaOps.EvidenceLocker/Api/ExportEndpoints.cs
View File

@@ -10,6 +10,7 @@ using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Mvc;
using StellaOps.Auth.ServerIntegration;
using StellaOps.Auth.ServerIntegration.Tenancy;
using static StellaOps.Localization.T;
namespace StellaOps.EvidenceLocker.Api;
@@ -67,7 +68,7 @@ public static class ExportEndpoints
if (result.IsNotFound)
{
return Results.NotFound(new { message = $"Bundle '{bundleId}' not found" });
return Results.NotFound(new { message = _t("evidencelocker.error.bundle_id_not_found", bundleId) });
}
return Results.Accepted(
@@ -91,7 +92,7 @@ public static class ExportEndpoints
if (result is null)
{
return Results.NotFound(new { message = $"Export '{exportId}' not found" });
return Results.NotFound(new { message = _t("evidencelocker.error.export_not_found", exportId) });
}
if (result.Status == ExportJobStatusEnum.Ready)
@@ -125,12 +126,12 @@ public static class ExportEndpoints
if (result is null)
{
return Results.NotFound(new { message = $"Export '{exportId}' not found" });
return Results.NotFound(new { message = _t("evidencelocker.error.export_not_found", exportId) });
}
if (result.Status != ExportJobStatusEnum.Ready)
{
return Results.Conflict(new { message = "Export is not ready for download", status = result.Status.ToString().ToLowerInvariant() });
return Results.Conflict(new { message = _t("evidencelocker.error.export_not_ready"), status = result.Status.ToString().ToLowerInvariant() });
}
return Results.File(

11
src/EvidenceLocker/StellaOps.EvidenceLocker/Api/VerdictEndpoints.cs
View File

@@ -7,6 +7,7 @@ using StellaOps.Auth.ServerIntegration;
using StellaOps.Auth.ServerIntegration.Tenancy;
using StellaOps.EvidenceLocker.Storage;
using System.Text.Json;
using static StellaOps.Localization.T;
namespace StellaOps.EvidenceLocker.Api;
@@ -93,12 +94,12 @@ public static class VerdictEndpoints
// Validate request
if (string.IsNullOrWhiteSpace(request.VerdictId))
{
return Results.BadRequest(new { error = "verdict_id is required" });
return Results.BadRequest(new { error = _t("evidencelocker.validation.verdict_id_required") });
}
if (string.IsNullOrWhiteSpace(request.FindingId))
{
return Results.BadRequest(new { error = "finding_id is required" });
return Results.BadRequest(new { error = _t("evidencelocker.validation.finding_id_required") });
}
// Serialize envelope to JSON string
@@ -164,7 +165,7 @@ public static class VerdictEndpoints
if (record is null)
{
logger.LogWarning("Verdict attestation {VerdictId} not found", verdictId);
return Results.NotFound(new { error = "Verdict not found", verdict_id = verdictId });
return Results.NotFound(new { error = _t("evidencelocker.error.verdict_not_found"), verdict_id = verdictId });
}
// Parse envelope JSON
@@ -282,7 +283,7 @@ public static class VerdictEndpoints
if (record is null)
{
logger.LogWarning("Verdict attestation {VerdictId} not found", verdictId);
return Results.NotFound(new { error = "Verdict not found", verdict_id = verdictId });
return Results.NotFound(new { error = _t("evidencelocker.error.verdict_not_found"), verdict_id = verdictId });
}
// TODO: Implement actual signature verification
@@ -337,7 +338,7 @@ public static class VerdictEndpoints
var record = await repository.GetVerdictAsync(verdictId, cancellationToken);
if (record is null)
{
return Results.NotFound(new { error = "Verdict not found", verdict_id = verdictId });
return Results.NotFound(new { error = _t("evidencelocker.error.verdict_not_found"), verdict_id = verdictId });
}
var envelopeBytes = System.Text.Encoding.UTF8.GetBytes(record.Envelope);

65
src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.Infrastructure/Repositories/EvidenceBundleRepository.cs
View File

@@ -1,5 +1,6 @@
using Microsoft.EntityFrameworkCore;
using Npgsql;
using NpgsqlTypes;
using StellaOps.EvidenceLocker.Core.Domain;
using StellaOps.EvidenceLocker.Core.Repositories;
using StellaOps.EvidenceLocker.Infrastructure.Db;
@@ -88,7 +89,8 @@ internal sealed class EvidenceBundleRepository(EvidenceLockerDataSource dataSour
await using var connection = await dataSource.OpenConnectionAsync(signature.TenantId, cancellationToken);
await using var dbContext = EvidenceLockerDbContextFactory.Create(connection, CommandTimeoutSeconds, EvidenceLockerDbContextFactory.DefaultSchemaName);
await dbContext.Database.ExecuteSqlRawAsync("""
await dbContext.Database.ExecuteSqlRawAsync(
sql: """
INSERT INTO evidence_locker.evidence_bundle_signatures
(bundle_id, tenant_id, payload_type, payload, signature, key_id, algorithm, provider, signed_at, timestamped_at, timestamp_authority, timestamp_token)
VALUES
@@ -106,19 +108,22 @@ internal sealed class EvidenceBundleRepository(EvidenceLockerDataSource dataSour
timestamp_authority = EXCLUDED.timestamp_authority,
timestamp_token = EXCLUDED.timestamp_token
""",
signature.BundleId.Value,
signature.TenantId.Value,
signature.PayloadType,
signature.Payload,
signature.Signature,
(object?)signature.KeyId ?? DBNull.Value,
signature.Algorithm,
signature.Provider,
signature.SignedAt.UtcDateTime,
(object?)signature.TimestampedAt?.UtcDateTime ?? DBNull.Value,
(object?)signature.TimestampAuthority ?? DBNull.Value,
(object?)signature.TimestampToken ?? DBNull.Value,
cancellationToken);
parameters: new object[]
{
new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Uuid, Value = signature.BundleId.Value },
new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Uuid, Value = signature.TenantId.Value },
new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = signature.PayloadType },
new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = signature.Payload },
new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = signature.Signature },
new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = (object?)signature.KeyId ?? DBNull.Value },
new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = signature.Algorithm },
new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = signature.Provider },
new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.TimestampTz, Value = signature.SignedAt.UtcDateTime },
new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.TimestampTz, Value = (object?)signature.TimestampedAt?.UtcDateTime ?? DBNull.Value },
new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = (object?)signature.TimestampAuthority ?? DBNull.Value },
new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Bytea, Value = (object?)signature.TimestampToken ?? DBNull.Value }
},
cancellationToken: cancellationToken);
}
public async Task<EvidenceBundleDetails?> GetBundleAsync(EvidenceBundleId bundleId, TenantId tenantId, CancellationToken cancellationToken)
@@ -251,7 +256,8 @@ internal sealed class EvidenceBundleRepository(EvidenceLockerDataSource dataSour
await using var connection = await dataSource.OpenConnectionAsync(tenantId, cancellationToken);
await using var dbContext = EvidenceLockerDbContextFactory.Create(connection, CommandTimeoutSeconds, EvidenceLockerDbContextFactory.DefaultSchemaName);
await dbContext.Database.ExecuteSqlRawAsync("""
await dbContext.Database.ExecuteSqlRawAsync(
sql: """
UPDATE evidence_locker.evidence_bundles
SET expires_at = CASE
WHEN {2} IS NULL THEN NULL
@@ -263,11 +269,14 @@ internal sealed class EvidenceBundleRepository(EvidenceLockerDataSource dataSour
WHERE bundle_id = {0}
AND tenant_id = {1}
""",
bundleId.Value,
tenantId.Value,
(object?)holdExpiresAt?.UtcDateTime ?? DBNull.Value,
processedAt.UtcDateTime,
cancellationToken);
parameters: new object[]
{
new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Uuid, Value = bundleId.Value },
new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Uuid, Value = tenantId.Value },
new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.TimestampTz, Value = (object?)holdExpiresAt?.UtcDateTime ?? DBNull.Value },
new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.TimestampTz, Value = processedAt.UtcDateTime }
},
cancellationToken: cancellationToken);
}
public async Task UpdateStorageKeyAsync(
@@ -298,7 +307,8 @@ internal sealed class EvidenceBundleRepository(EvidenceLockerDataSource dataSour
await using var connection = await dataSource.OpenConnectionAsync(tenantId, cancellationToken);
await using var dbContext = EvidenceLockerDbContextFactory.Create(connection, CommandTimeoutSeconds, EvidenceLockerDbContextFactory.DefaultSchemaName);
await dbContext.Database.ExecuteSqlRawAsync("""
await dbContext.Database.ExecuteSqlRawAsync(
sql: """
UPDATE evidence_locker.evidence_bundles
SET portable_storage_key = {2},
portable_generated_at = {3},
@@ -306,11 +316,14 @@ internal sealed class EvidenceBundleRepository(EvidenceLockerDataSource dataSour
WHERE bundle_id = {0}
AND tenant_id = {1}
""",
bundleId.Value,
tenantId.Value,
storageKey,
generatedAt.UtcDateTime,
cancellationToken);
parameters: new object[]
{
new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Uuid, Value = bundleId.Value },
new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Uuid, Value = tenantId.Value },
new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.Text, Value = storageKey },
new NpgsqlParameter { NpgsqlDbType = NpgsqlDbType.TimestampTz, Value = generatedAt.UtcDateTime }
},
cancellationToken: cancellationToken);
}
private static EvidenceBundleDetails MapBundleDetails(EvidenceBundleEntity entity, EvidenceBundleSignatureEntity? sigEntity)

8
src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.Tests/EvidenceBundleImmutabilityTests.cs
View File

@@ -6,6 +6,7 @@
// -----------------------------------------------------------------------------
using Microsoft.EntityFrameworkCore;
using Npgsql;
using StellaOps.EvidenceLocker.Core.Domain;
using StellaOps.EvidenceLocker.Core.Repositories;
@@ -68,8 +69,9 @@ public sealed class EvidenceBundleImmutabilityTests : IClassFixture<PostgreSqlFi
await repo.CreateBundleAsync(bundle1, cancellationToken);
await Assert.ThrowsAsync<PostgresException>(async () =>
var ex = await Assert.ThrowsAsync<DbUpdateException>(async () =>
await repo.CreateBundleAsync(bundle2, cancellationToken));
Assert.IsType<PostgresException>(ex.InnerException);
}
[Fact]
@@ -193,13 +195,13 @@ public sealed class EvidenceBundleImmutabilityTests : IClassFixture<PostgreSqlFi
var task1 = Task.Run(async () =>
{
try { await repo.CreateBundleAsync(bundle1, cancellationToken); Interlocked.Increment(ref successCount); }
catch (PostgresException) { Interlocked.Increment(ref failureCount); }
catch (Exception e) when (e is DbUpdateException dbe && dbe.InnerException is PostgresException) { Interlocked.Increment(ref failureCount); }
});
var task2 = Task.Run(async () =>
{
try { await repo.CreateBundleAsync(bundle2, cancellationToken); Interlocked.Increment(ref successCount); }
catch (PostgresException) { Interlocked.Increment(ref failureCount); }
catch (Exception e) when (e is DbUpdateException dbe && dbe.InnerException is PostgresException) { Interlocked.Increment(ref failureCount); }
});
await Task.WhenAll(task1, task2);

3
src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.Tests/EvidenceLockerWebApplicationFactory.cs
View File

@@ -152,6 +152,9 @@ public sealed class EvidenceLockerWebApplicationFactory : WebApplicationFactory<
options.AddPolicy(StellaOpsResourceServerPolicies.EvidenceCreate, allowAllPolicy);
options.AddPolicy(StellaOpsResourceServerPolicies.EvidenceRead, allowAllPolicy);
options.AddPolicy(StellaOpsResourceServerPolicies.EvidenceHold, allowAllPolicy);
options.AddPolicy(StellaOpsResourceServerPolicies.ExportViewer, allowAllPolicy);
options.AddPolicy(StellaOpsResourceServerPolicies.ExportOperator, allowAllPolicy);
options.AddPolicy(StellaOpsResourceServerPolicies.ExportAdmin, allowAllPolicy);
});
});
}

8
src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.Tests/EvidenceLockerWebServiceContractTests.cs
View File

@@ -149,8 +149,8 @@ public sealed class EvidenceLockerWebServiceContractTests : IDisposable
CreateValidSnapshotPayload(),
CancellationToken.None);
// Assert - Unauthenticated requests should return 401 or 403
response.StatusCode.Should().BeOneOf(HttpStatusCode.Unauthorized, HttpStatusCode.Forbidden);
// Assert - Unauthenticated requests should return 401, 403, or 400 (tenant_missing)
response.StatusCode.Should().BeOneOf(HttpStatusCode.Unauthorized, HttpStatusCode.Forbidden, HttpStatusCode.BadRequest);
}
[Trait("Category", TestCategories.Integration)]
@@ -186,8 +186,8 @@ public sealed class EvidenceLockerWebServiceContractTests : IDisposable
CreateValidSnapshotPayload(),
CancellationToken.None);
// Assert - Unauthenticated requests should return 401 or 403
response.StatusCode.Should().BeOneOf(HttpStatusCode.Unauthorized, HttpStatusCode.Forbidden);
// Assert - Unauthenticated requests should return 401, 403, or 400 (tenant_missing)
response.StatusCode.Should().BeOneOf(HttpStatusCode.Unauthorized, HttpStatusCode.Forbidden, HttpStatusCode.BadRequest);
}
[Trait("Category", TestCategories.Integration)]

4
src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.Tests/EvidenceLockerWebServiceTests.cs
View File

@@ -407,7 +407,9 @@ public sealed class EvidenceLockerWebServiceTests : IDisposable
var response = await _client.PostAsJsonAsync("/evidence/snapshot", payload, CancellationToken.None);
var responseContent = await response.Content.ReadAsStringAsync(CancellationToken.None);
Assert.True(response.StatusCode == HttpStatusCode.Forbidden, $"Expected 403 but received {(int)response.StatusCode}: {responseContent}");
Assert.True(
response.StatusCode == HttpStatusCode.Forbidden || response.StatusCode == HttpStatusCode.BadRequest,
$"Expected 403 or 400 but received {(int)response.StatusCode}: {responseContent}");
}
[Trait("Category", TestCategories.Unit)]

16
src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.WebService/Program.cs
View File

@@ -18,7 +18,9 @@ using StellaOps.EvidenceLocker.Infrastructure.Services;
using StellaOps.EvidenceLocker.WebService.Audit;
using StellaOps.EvidenceLocker.WebService.Contracts;
using StellaOps.EvidenceLocker.WebService.Security;
using StellaOps.Localization;
using StellaOps.Router.AspNet;
using static StellaOps.Localization.T;
using System;
using System.Collections.Generic;
using System.Linq;
@@ -49,6 +51,8 @@ builder.Services.AddStellaOpsTenantServices();
builder.Services.AddOpenApi();
builder.Services.AddStellaOpsCors(builder.Environment, builder.Configuration);
builder.Services.AddStellaOpsLocalization(builder.Configuration);
builder.Services.AddTranslationBundle(System.Reflection.Assembly.GetExecutingAssembly());
// Stella Router integration
var routerEnabled = builder.Services.AddRouterMicroservice(
@@ -67,6 +71,7 @@ if (app.Environment.IsDevelopment())
}
app.UseStellaOpsCors();
app.UseStellaOpsLocalization();
app.UseAuthentication();
app.UseAuthorization();
app.UseStellaOpsTenantMiddleware();
@@ -115,7 +120,7 @@ app.MapGet("/evidence/score",
if (result is null)
{
EvidenceAuditLogger.LogGateArtifactNotFound(logger, user, tenantId, artifact_id);
return Results.NotFound(new ErrorResponse("not_found", "Evidence score not found for artifact."));
return Results.NotFound(new ErrorResponse("not_found", _t("evidencelocker.error.score_not_found")));
}
EvidenceAuditLogger.LogGateArtifactRetrieved(logger, user, tenantId, result.ArtifactId, result.EvidenceScore);
@@ -182,7 +187,7 @@ app.MapGet("/evidence/{bundleId:guid}",
if (details is null)
{
EvidenceAuditLogger.LogBundleNotFound(logger, user, tenantId, bundleId);
return Results.NotFound(new ErrorResponse("not_found", "Evidence bundle not found."));
return Results.NotFound(new ErrorResponse("not_found", _t("evidencelocker.error.bundle_not_found")));
}
EvidenceAuditLogger.LogBundleRetrieved(logger, user, tenantId, details.Bundle);
@@ -253,7 +258,7 @@ app.MapGet("/evidence/{bundleId:guid}/download",
if (bundle is null)
{
EvidenceAuditLogger.LogBundleNotFound(logger, user, tenantId, bundleId);
return Results.NotFound(new ErrorResponse("not_found", "Evidence bundle not found."));
return Results.NotFound(new ErrorResponse("not_found", _t("evidencelocker.error.bundle_not_found")));
}
try
@@ -300,7 +305,7 @@ app.MapGet("/evidence/{bundleId:guid}/portable",
if (bundle is null)
{
EvidenceAuditLogger.LogBundleNotFound(logger, user, tenantId, bundleId);
return Results.NotFound(new ErrorResponse("not_found", "Evidence bundle not found."));
return Results.NotFound(new ErrorResponse("not_found", _t("evidencelocker.error.bundle_not_found")));
}
try
@@ -355,7 +360,7 @@ app.MapPost("/evidence/hold/{caseId}",
if (string.IsNullOrWhiteSpace(caseId))
{
return ValidationProblem("Case identifier is required.");
return ValidationProblem(_t("evidencelocker.validation.case_id_required"));
}
var tenantId = TenantId.FromGuid(Guid.Parse(tenantAccessor.TenantId!));
@@ -424,6 +429,7 @@ app.MapEvidenceThreadEndpoints();
// Refresh Router endpoint cache
app.TryRefreshStellaRouterEndpoints(routerEnabled);
await app.LoadTranslationsAsync();
app.Run();
static IResult ValidationProblem(string message)

4
src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.WebService/StellaOps.EvidenceLocker.WebService.csproj
View File

@@ -23,6 +23,10 @@
<ProjectReference Include="..\..\..\Authority\StellaOps.Authority\StellaOps.Auth.ServerIntegration\StellaOps.Auth.ServerIntegration.csproj" />
<ProjectReference Include="..\..\..\Authority\StellaOps.Authority\StellaOps.Auth.Abstractions\StellaOps.Auth.Abstractions.csproj" />
<ProjectReference Include="..\..\..\Router/__Libraries/StellaOps.Router.AspNet\StellaOps.Router.AspNet.csproj" />
<ProjectReference Include="..\..\..\__Libraries\StellaOps.Localization\StellaOps.Localization.csproj" />
</ItemGroup>
<ItemGroup>
<EmbeddedResource Include="Translations\*.json" />
</ItemGroup>
<PropertyGroup Label="StellaOpsReleaseVersion">
<Version>1.0.0-alpha1</Version>

16
src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.WebService/Translations/en-US.evidencelocker.json Normal file
View File

@@ -0,0 +1,16 @@
{
"_meta": { "locale": "en-US", "namespace": "evidencelocker", "version": "1.0" },
"evidencelocker.error.score_not_found": "Evidence score not found for artifact.",
"evidencelocker.error.bundle_not_found": "Evidence bundle not found.",
"evidencelocker.error.bundle_id_not_found": "Bundle '{0}' not found.",
"evidencelocker.error.export_not_found": "Export '{0}' not found.",
"evidencelocker.error.export_not_ready": "Export is not ready for download.",
"evidencelocker.error.thread_not_found": "Evidence thread not found.",
"evidencelocker.error.verdict_not_found": "Verdict not found.",
"evidencelocker.validation.case_id_required": "Case identifier is required.",
"evidencelocker.validation.purl_required": "purl query parameter is required.",
"evidencelocker.validation.verdict_id_required": "verdict_id is required.",
"evidencelocker.validation.finding_id_required": "finding_id is required."
}