dac8e10e36
## Summary
This commit completes Phase 2 of the configuration-driven crypto architecture, achieving
100% crypto compliance by eliminating all hardcoded cryptographic implementations.
## Key Changes
### Phase 1: Plugin Loader Infrastructure
- **Plugin Discovery System**: Created StellaOps.Cryptography.PluginLoader with manifest-based loading
- **Configuration Model**: Added CryptoPluginConfiguration with regional profiles support
- **Dependency Injection**: Extended DI to support plugin-based crypto provider registration
- **Regional Configs**: Created appsettings.crypto.{international,russia,eu,china}.yaml
- **CI Workflow**: Added .gitea/workflows/crypto-compliance.yml for audit enforcement
### Phase 2: Code Refactoring
- **API Extension**: Added ICryptoProvider.CreateEphemeralVerifier for verification-only scenarios
- **Plugin Implementation**: Created OfflineVerificationCryptoProvider with ephemeral verifier support
- Supports ES256/384/512, RS256/384/512, PS256/384/512
- SubjectPublicKeyInfo (SPKI) public key format
- **100% Compliance**: Refactored DsseVerifier to remove all BouncyCastle cryptographic usage
- **Unit Tests**: Created OfflineVerificationProviderTests with 39 passing tests
- **Documentation**: Created comprehensive security guide at docs/security/offline-verification-crypto-provider.md
- **Audit Infrastructure**: Created scripts/audit-crypto-usage.ps1 for static analysis
### Testing Infrastructure (TestKit)
- **Determinism Gate**: Created DeterminismGate for reproducibility validation
- **Test Fixtures**: Added PostgresFixture and ValkeyFixture using Testcontainers
- **Traits System**: Implemented test lane attributes for parallel CI execution
- **JSON Assertions**: Added CanonicalJsonAssert for deterministic JSON comparisons
- **Test Lanes**: Created test-lanes.yml workflow for parallel test execution
### Documentation
- **Architecture**: Created CRYPTO_CONFIGURATION_DRIVEN_ARCHITECTURE.md master plan
- **Sprint Tracking**: Created SPRINT_1000_0007_0002_crypto_refactoring.md (COMPLETE)
- **API Documentation**: Updated docs2/cli/crypto-plugins.md and crypto.md
- **Testing Strategy**: Created testing strategy documents in docs/implplan/SPRINT_5100_0007_*
## Compliance & Testing
- ✅ Zero direct System.Security.Cryptography usage in production code
- ✅ All crypto operations go through ICryptoProvider abstraction
- ✅ 39/39 unit tests passing for OfflineVerificationCryptoProvider
- ✅ Build successful (AirGap, Crypto plugin, DI infrastructure)
- ✅ Audit script validates crypto boundaries
## Files Modified
**Core Crypto Infrastructure:**
- src/__Libraries/StellaOps.Cryptography/CryptoProvider.cs (API extension)
- src/__Libraries/StellaOps.Cryptography/CryptoSigningKey.cs (verification-only constructor)
- src/__Libraries/StellaOps.Cryptography/EcdsaSigner.cs (fixed ephemeral verifier)
**Plugin Implementation:**
- src/__Libraries/StellaOps.Cryptography.Plugin.OfflineVerification/ (new)
- src/__Libraries/StellaOps.Cryptography.PluginLoader/ (new)
**Production Code Refactoring:**
- src/AirGap/StellaOps.AirGap.Importer/Validation/DsseVerifier.cs (100% compliant)
**Tests:**
- src/__Libraries/__Tests/StellaOps.Cryptography.Plugin.OfflineVerification.Tests/ (new, 39 tests)
- src/__Libraries/__Tests/StellaOps.Cryptography.PluginLoader.Tests/ (new)
**Configuration:**
- etc/crypto-plugins-manifest.json (plugin registry)
- etc/appsettings.crypto.*.yaml (regional profiles)
**Documentation:**
- docs/security/offline-verification-crypto-provider.md (600+ lines)
- docs/implplan/CRYPTO_CONFIGURATION_DRIVEN_ARCHITECTURE.md (master plan)
- docs/implplan/SPRINT_1000_0007_0002_crypto_refactoring.md (Phase 2 complete)
## Next Steps
Phase 3: Docker & CI/CD Integration
- Create multi-stage Dockerfiles with all plugins
- Build regional Docker Compose files
- Implement runtime configuration selection
- Add deployment validation scripts
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
76 lines
3.3 KiB
Markdown
76 lines
3.3 KiB
Markdown
# Identity, tenancy, and scopes
|
|
|
|
Authority issues short-lived tokens bound to tenants and scopes. Tenancy is
|
|
enforced at every service boundary.
|
|
|
|
Token model
|
|
- tenant: required for all tenant-scoped APIs.
|
|
- scopes: list of granted permissions.
|
|
- service_identity: required for privileged write scopes.
|
|
- auth_time: used for fresh auth enforcement.
|
|
- reason and ticket fields: required for sensitive operations.
|
|
- act claim: present for delegated service accounts.
|
|
|
|
Tenancy propagation
|
|
- Gateways attach the tenant claim to a header (X-StellaOps-Tenant or configured).
|
|
- Services reject missing or mismatched tenant headers.
|
|
- All audit events record tenant and scope for traceability.
|
|
|
|
Scope categories (examples)
|
|
- Ingestion: advisory:ingest, vex:ingest.
|
|
- Verification: aoc:verify (required with advisory:read or vex:read).
|
|
- Signals: signals:read, signals:write.
|
|
- Policy: policy:author, policy:approve, policy:publish, policy:promote.
|
|
- Findings: effective:write (Policy Engine only), findings:read.
|
|
- Observability: obs:read, timeline:read, timeline:write, evidence:read.
|
|
- Ops: airgap:status:read, airgap:import, airgap:seal.
|
|
- Automation: packs.read, packs.run, packs.approve.
|
|
- Notifications: notify.viewer, notify.operator, notify.admin.
|
|
|
|
Scope enforcement rules
|
|
- advisory:read and vex:read require aoc:verify.
|
|
- effective:write requires service_identity = policy-engine.
|
|
- graph:write requires service_identity = cartographer.
|
|
- Ingest scopes must not be combined with effective:write.
|
|
|
|
Scope matrix (examples)
|
|
| Module | Typical roles | Scopes |
|
|
| --- | --- | --- |
|
|
| Concelier | concelier-ingest | advisory:ingest, advisory:read, aoc:verify |
|
|
| Excititor | excititor-ingest | vex:ingest, vex:read, aoc:verify |
|
|
| Policy Engine | policy-engine | effective:write, findings:read |
|
|
| Scanner | scanner-operator | scanner:read, scanner:scan, scanner:export |
|
|
| Graph | cartographer-service | graph:write, graph:read |
|
|
| Notify | notify-operator | notify.viewer, notify.operator |
|
|
| Export Center | export-operator | export.viewer, export.operator |
|
|
| Airgap | airgap-operator | airgap:status:read, airgap:import |
|
|
| Observability | obs-investigator | obs:read, timeline:read, timeline:write, evidence:read |
|
|
| Task Runner | packs-runner | packs.read, packs.run |
|
|
|
|
Role bundles
|
|
- Roles group scopes for common workflows (scanner, policy, notify, export).
|
|
- Policy author role: policy:author, policy:read, policy:simulate.
|
|
- Policy approver role: policy:approve, policy:review, policy:read.
|
|
- Pack runner role: packs.read, packs.run.
|
|
- Observability incident commander role: obs:read, obs:incident, timeline:write.
|
|
|
|
Fresh auth and MFA
|
|
- Policy publish and promote require fresh auth (auth_time window).
|
|
- Exception approvals can require MFA when routing templates demand it.
|
|
- Sensitive scopes require reason and ticket metadata for audit.
|
|
|
|
Delegation and service accounts
|
|
- Delegated accounts mint limited tokens for automation.
|
|
- Authority enforces per-tenant quotas and allowedScopes lists.
|
|
- Delegated tokens include act and service account identifiers.
|
|
|
|
Offline notes
|
|
- Offline kits can include scoped tokens with short expirations.
|
|
- Rotate tokens and trust roots on a fixed schedule.
|
|
- Avoid long-lived admin scopes in sealed environments.
|
|
|
|
Related references
|
|
- docs/security/authority-scopes.md
|
|
- docs/architecture/console-admin-rbac.md
|
|
- docs/modules/authority/architecture.md
|