263 lines
9.6 KiB
Python
263 lines
9.6 KiB
Python
#!/usr/bin/env python3
|
||
"""
|
||
IwoooS 高價值配置 owner response packet 產生器。
|
||
|
||
本工具讀取 high-value-config-change-gate 的 JSON 報告，為 impacted
|
||
categories 產出 owner response packet 草案。它只產生欄位、補件規則與
|
||
禁止事項，不送件、不收回覆、不建立 action button、不執行 runtime。
|
||
"""
|
||
|
||
from __future__ import annotations
|
||
|
||
import argparse
|
||
import json
|
||
import subprocess
|
||
import sys
|
||
from datetime import datetime, timedelta, timezone
|
||
from pathlib import Path
|
||
from typing import Any
|
||
|
||
|
||
TAIPEI = timezone(timedelta(hours=8))
|
||
|
||
CANONICAL_OWNER_FIELDS = [
|
||
"owner_role_or_team",
|
||
"decision",
|
||
"decision_reason",
|
||
"affected_scope",
|
||
"redacted_evidence_refs",
|
||
"followup_owner",
|
||
"rollback_owner",
|
||
"maintenance_window",
|
||
"validation_plan",
|
||
]
|
||
|
||
ALLOWED_DECISIONS = ["confirm", "defer", "reject", "request_more_evidence"]
|
||
|
||
FIELD_INSTRUCTIONS = {
|
||
"owner_role_or_team": "填角色或團隊，不填私人帳號、密碼、token 或私人聯絡資訊。",
|
||
"decision": "只能填 confirm、defer、reject、request_more_evidence；不得附帶 runtime 執行批准。",
|
||
"decision_reason": "填脫敏短理由；不可貼 raw log、raw API body、未脫敏截圖或內部對話。",
|
||
"affected_scope": "填受影響 repo、host、domain、namespace、route、service、secret name 或產品邊界。",
|
||
"redacted_evidence_refs": "只填文件路徑、snapshot id、ticket id、commit、hash 或脫敏 metadata pointer。",
|
||
"followup_owner": "填後續補證、審查或決策負責角色 / 團隊。",
|
||
"rollback_owner": "填回滾負責角色 / 團隊；不是直接執行授權。",
|
||
"maintenance_window": "填維護窗口或明確寫 deferred / not scheduled；不得用口頭同意代替。",
|
||
"validation_plan": "填 preflight、post-check、rollback check；若只讀文件變更，寫 guard / json / doc secret sanity。",
|
||
}
|
||
|
||
FALSE_FLAGS = [
|
||
"request_sent",
|
||
"response_received",
|
||
"response_accepted",
|
||
"runtime_execution_authorized",
|
||
"host_write_authorized",
|
||
"nginx_reload_authorized",
|
||
"dns_tls_change_authorized",
|
||
"workflow_modification_authorized",
|
||
"runner_change_authorized",
|
||
"refs_sync_authorized",
|
||
"force_push_authorized",
|
||
"secret_value_collection_allowed",
|
||
"active_scan_authorized",
|
||
"action_buttons_allowed",
|
||
]
|
||
|
||
BLOCKED_REQUESTS = [
|
||
"repo_create",
|
||
"visibility_change",
|
||
"refs_sync",
|
||
"refs_delete",
|
||
"force_push",
|
||
"workflow_modify",
|
||
"runner_enable",
|
||
"secret_value_submit",
|
||
"ssh_host_modify",
|
||
"nginx_reload",
|
||
"dns_tls_modify",
|
||
"argocd_sync",
|
||
"kubectl_apply",
|
||
"active_scan",
|
||
"agent_bounty_runtime_execute",
|
||
"payout_or_withdrawal",
|
||
]
|
||
|
||
OUTCOME_LANES = [
|
||
"keep_waiting_owner_response",
|
||
"request_more_evidence",
|
||
"quarantine_sensitive_payload",
|
||
"reject_execution_request",
|
||
"ready_for_reviewer_validation",
|
||
]
|
||
|
||
|
||
def git_short_sha(root: Path) -> str:
|
||
try:
|
||
result = subprocess.run(
|
||
["git", "rev-parse", "--short", "HEAD"],
|
||
cwd=root,
|
||
check=True,
|
||
capture_output=True,
|
||
text=True,
|
||
)
|
||
return result.stdout.strip()
|
||
except Exception:
|
||
return "unknown"
|
||
|
||
|
||
def load_json(path: Path) -> dict[str, Any]:
|
||
return json.loads(path.read_text(encoding="utf-8"))
|
||
|
||
|
||
def field_templates() -> list[dict[str, Any]]:
|
||
return [
|
||
{
|
||
"field": field,
|
||
"required": True,
|
||
"instruction": FIELD_INSTRUCTIONS[field],
|
||
}
|
||
for field in CANONICAL_OWNER_FIELDS
|
||
]
|
||
|
||
|
||
def false_flag_map() -> dict[str, bool]:
|
||
return {flag: False for flag in FALSE_FLAGS}
|
||
|
||
|
||
def files_for_category(gate_report: dict[str, Any], category_id: str) -> list[str]:
|
||
paths: list[str] = []
|
||
for item in gate_report.get("changed_files", []):
|
||
if any(category.get("category_id") == category_id for category in item.get("categories", [])):
|
||
paths.append(item["path"])
|
||
return sorted(paths)
|
||
|
||
|
||
def category_inventory_by_id(gate_report: dict[str, Any]) -> dict[str, dict[str, Any]]:
|
||
return {
|
||
item["category_id"]: item
|
||
for item in gate_report.get("control_category_inventory", [])
|
||
}
|
||
|
||
|
||
def packet_for_category(gate_report: dict[str, Any], category: dict[str, Any]) -> dict[str, Any]:
|
||
inventory = category_inventory_by_id(gate_report).get(category["category_id"], {})
|
||
affected_files = files_for_category(gate_report, category["category_id"])
|
||
return {
|
||
"packet_id": f"high_value_config_owner_packet:{category['category_id']}",
|
||
"status": "draft_waiting_owner_response",
|
||
"category_id": category["category_id"],
|
||
"label": category["label"],
|
||
"priority": category["priority"],
|
||
"control_tier": category["control_tier"],
|
||
"required_gate": category["required_gate"],
|
||
"affected_files": affected_files,
|
||
"allowed_decisions": ALLOWED_DECISIONS,
|
||
"field_templates": field_templates(),
|
||
"required_validation": category.get("required_validation") or inventory.get("required_validation", []),
|
||
"redaction_rules": [
|
||
"只收 redacted evidence refs，不收 secret value。",
|
||
"疑似 token、cookie、authorization header、private key、runner token 或 webhook secret 一律 quarantine。",
|
||
"內部工作視窗對話、抱怨、口頭同意不得進產品文案或 LOGBOOK raw text。",
|
||
],
|
||
"blocked_requests": BLOCKED_REQUESTS,
|
||
"outcome_lanes": OUTCOME_LANES,
|
||
"false_flags": false_flag_map(),
|
||
"reviewer_checklist": [
|
||
"canonical owner fields 全部存在。",
|
||
"decision 只使用允許值。",
|
||
"affected scope 可映射到 repo / host / domain / route / service / secret name。",
|
||
"redacted evidence refs 不含 raw payload。",
|
||
"沒有夾帶執行要求。",
|
||
"C0 / C1 若要進 runtime，需獨立人工批准與維護窗口。",
|
||
],
|
||
}
|
||
|
||
|
||
def build_report(root: Path, gate_report: dict[str, Any], generated_at: str | None) -> dict[str, Any]:
|
||
report_time = generated_at or datetime.now(TAIPEI).isoformat(timespec="seconds")
|
||
impacted_categories = gate_report.get("impacted_categories", [])
|
||
packets = [packet_for_category(gate_report, category) for category in impacted_categories]
|
||
c0_packets = [packet for packet in packets if packet["control_tier"] == "C0"]
|
||
c1_packets = [packet for packet in packets if packet["control_tier"] == "C1"]
|
||
|
||
return {
|
||
"schema_version": "high_value_config_owner_packet_v1",
|
||
"generated_at": report_time,
|
||
"git_commit": git_short_sha(root),
|
||
"source_gate_schema_version": gate_report.get("schema_version"),
|
||
"source_gate_summary": gate_report.get("summary", {}),
|
||
"status": "draft_waiting_owner_response",
|
||
"canonical_owner_fields": CANONICAL_OWNER_FIELDS,
|
||
"allowed_decisions": ALLOWED_DECISIONS,
|
||
"execution_boundaries": {
|
||
"request_sent": False,
|
||
"response_received": False,
|
||
"response_accepted": False,
|
||
"runtime_execution_authorized": False,
|
||
"host_write_authorized": False,
|
||
"secret_value_collected": False,
|
||
"action_buttons_allowed": False,
|
||
},
|
||
"summary": {
|
||
"packet_count": len(packets),
|
||
"c0_packet_count": len(c0_packets),
|
||
"c1_packet_count": len(c1_packets),
|
||
"request_sent_count": 0,
|
||
"received_response_count": 0,
|
||
"accepted_response_count": 0,
|
||
"runtime_gate_count": 0,
|
||
},
|
||
"universal_owner_response_template": {
|
||
"allowed_decisions": ALLOWED_DECISIONS,
|
||
"field_templates": field_templates(),
|
||
"false_flags": false_flag_map(),
|
||
},
|
||
"packets": packets,
|
||
"control_category_inventory": gate_report.get("control_category_inventory", []),
|
||
"next_steps": [
|
||
"若 packet_count > 0，將 packet 交給 owner 補 canonical 欄位；不得把草案視為已送件。",
|
||
"若 owner 回覆含 secret 或執行要求，先 quarantine 或 reject_execution_request。",
|
||
"只有 reviewer checklist 完成後才可進 accepted；accepted 仍不開 runtime gate。",
|
||
],
|
||
}
|
||
|
||
|
||
def main() -> int:
|
||
parser = argparse.ArgumentParser(description="IwoooS 高價值配置 owner response packet 產生器")
|
||
parser.add_argument("--root", default=".", help="repo root")
|
||
parser.add_argument(
|
||
"--gate-report",
|
||
default="docs/security/high-value-config-change-gate.snapshot.json",
|
||
help="high-value-config-change-gate.py 輸出的 JSON",
|
||
)
|
||
parser.add_argument("--output", help="寫出 JSON 報告")
|
||
parser.add_argument("--generated-at", help="固定報告時間，供 committed snapshot 使用")
|
||
args = parser.parse_args()
|
||
|
||
root = Path(args.root).resolve()
|
||
gate_report = load_json(root / args.gate_report)
|
||
report = build_report(root, gate_report, args.generated_at)
|
||
payload = json.dumps(report, ensure_ascii=False, indent=2, sort_keys=True)
|
||
|
||
if args.output:
|
||
output = Path(args.output)
|
||
output.parent.mkdir(parents=True, exist_ok=True)
|
||
output.write_text(payload + "\n", encoding="utf-8")
|
||
else:
|
||
print(payload)
|
||
|
||
summary = report["summary"]
|
||
print(
|
||
"HIGH_VALUE_CONFIG_OWNER_PACKET_OK "
|
||
f"packets={summary['packet_count']} "
|
||
f"c0={summary['c0_packet_count']} "
|
||
f"c1={summary['c1_packet_count']} "
|
||
f"runtime_gate={summary['runtime_gate_count']}",
|
||
file=sys.stderr,
|
||
)
|
||
return 0
|
||
|
||
|
||
if __name__ == "__main__":
|
||
sys.exit(main())
|