approval.rs 94.8%

145 of 153 lines run, 12 of 26 functions · run #375 on main · run missed

//! A person's approval of one job of one run, signed (oxygenhub#235): the
//! approval attestation, the signer's signature over it, and the signer's
//! identity, so it verifies with nothing else. The hub decides whether the
//! signer may approve; the signature makes the decision theirs, and binds
//! it to exactly that job, state, plan and environment.

use crate::attest::{Attest, AttestBody};
use crate::cbor::{self, Value};
use crate::hash::ObjectRef;
use crate::identity::{verify, Domain, Identity, SecretKey, Signature};
use crate::objects::{array, bytes, Hlc, ObjectError};

/// What is approved.
#[derive(Clone, Debug, PartialEq, Eq)]
pub struct Statement {
    pub repo: [u8; 16],
    /// The run, as its URL on the hub.
    pub run: String,
    pub job: String,
    /// The job's hash with its sandbox (OxygenFlow spec 6.2).
    pub job_hash: ObjectRef,
    pub state: ObjectRef,
    /// The blobs the job takes as inputs (a plan), any order.
    pub inputs: Vec<ObjectRef>,
    pub environment: String,
    pub approve: bool,
}

#[derive(Debug, thiserror::Error)]
pub enum ApprovalError {
    #[error("the attestation is not an approval")]
    NotApproval,
    #[error("no signature by the signer {0}")]
    Unsigned(String),
    #[error("the signature does not verify: {0}")]
    BadSignature(String),
    #[error("{0}")]
    Schema(String),
}

impl From<ObjectError> for ApprovalError {
    fn from(e: ObjectError) -> Self {
        ApprovalError::Schema(e.to_string())
    }
}

#[derive(Clone, Debug, PartialEq, Eq)]
pub struct SignedApproval {
    pub attest: Attest,
    pub sigs: Vec<Signature>,
    pub signer: Identity,
}

impl SignedApproval {
    pub fn sign(s: &Statement, signer: &Identity, sk: &SecretKey) -> SignedApproval {
        let mut inputs = s.inputs.clone();
        inputs.sort();
        inputs.dedup();
        let attest = Attest {
            repo: s.repo,
            hlc: Hlc::now(),
            body: AttestBody::Approval {
                run: s.run.clone(),
                job: s.job.clone(),
                job_hash: s.job_hash,
                state: s.state,
                inputs,
                environment: s.environment.clone(),
                approve: s.approve,
            },
        };
        let sig = sk.sign(Domain::Attest, &signer.hash(), &attest.hash());
        SignedApproval {
            attest,
            sigs: vec![sig],
            signer: signer.clone(),
        }
    }

    /// What was approved, read back from the attestation.
    pub fn statement(&self) -> Result<Statement, ApprovalError> {
        let AttestBody::Approval {
            run,
            job,
            job_hash,
            state,
            inputs,
            environment,
            approve,
        } = &self.attest.body
        else {
            return Err(ApprovalError::NotApproval);
        };
        Ok(Statement {
            repo: self.attest.repo,
            run: run.clone(),
            job: job.clone(),
            job_hash: *job_hash,
            state: *state,
            inputs: inputs.clone(),
            environment: environment.clone(),
            approve: *approve,
        })
    }

    /// It is an approval and the signer signed it. Whether the signer may
    /// approve is the reader's call.
    pub fn verify(&self) -> Result<(), ApprovalError> {
        self.statement()?;
        let key = self.signer.hash();
        let sig = self
            .sigs
            .iter()
            .find(|s| s.key == key)
            .ok_or_else(|| ApprovalError::Unsigned(key.short(12)))?;
        verify(&self.signer, sig, Domain::Attest, &self.attest.hash())
            .map_err(|e| ApprovalError::BadSignature(e.to_string()))
    }

    /// Whether `s` is what this approves (the time it was made aside).
    pub fn covers(&self, s: &Statement) -> bool {
        let mut want = s.inputs.clone();
        want.sort();
        want.dedup();
        self.statement().is_ok_and(|mine| {
            mine == Statement {
                inputs: want,
                ..s.clone()
            }
        })
    }

    /// `[attest, [Signature], identity]`, each object as its bytes.
    pub fn encode(&self) -> Vec<u8> {
        cbor::encode(&Value::Array(vec![
            Value::Bytes(self.attest.encode()),
            Value::Array(self.sigs.iter().map(|s| s.to_value()).collect()),
            Value::Bytes(self.signer.encode()),
        ]))
    }

    pub fn decode(b: &[u8]) -> Result<SignedApproval, ApprovalError> {
        let v = cbor::decode(b).map_err(ObjectError::from)?;
        let a = array(&v, "signed approval")?;
        if a.len() != 3 {
            return Err(ApprovalError::Schema(
                "signed approval: expected [attest, sigs, identity]".into(),
            ));
        }
        Ok(SignedApproval {
            attest: Attest::decode(bytes(&a[0], "attest")?)?,
            sigs: array(&a[1], "sigs")?
                .iter()
                .map(Signature::from_value)
                .collect::<Result<_, _>>()?,
            signer: Identity::decode(bytes(&a[2], "identity")?)?,
        })
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::identity::SecretKey;

    fn statement() -> Statement {
        Statement {
            repo: [7; 16],
            run: "https://hub.example/andy/infra/flow/8".into(),
            job: "apply".into(),
            job_hash: ObjectRef([1; 32]),
            state: ObjectRef([2; 32]),
            inputs: vec![ObjectRef([4; 32]), ObjectRef([3; 32])],
            environment: "prod".into(),
            approve: true,
        }
    }

    #[test]
    fn an_approval_signs_exactly_one_job_state_plan_and_environment() {
        let sk = SecretKey::generate();
        let id = sk.identity("Andy", "[email protected]", 1);
        let sa = SignedApproval::sign(&statement(), &id, &sk);
        sa.verify().unwrap();
        let back = SignedApproval::decode(&sa.encode()).unwrap();
        assert_eq!(back, sa, "round trip");
        assert!(back.covers(&statement()), "inputs in any order");
        for other in [
            Statement {
                inputs: vec![ObjectRef([9; 32])],
                ..statement()
            },
            Statement {
                state: ObjectRef([8; 32]),
                ..statement()
            },
            Statement {
                job_hash: ObjectRef([8; 32]),
                ..statement()
            },
            Statement {
                run: "https://hub.example/andy/infra/flow/9".into(),
                ..statement()
            },
            Statement {
                environment: "dev".into(),
                ..statement()
            },
            Statement {
                approve: false,
                ..statement()
            },
        ] {
            assert!(!back.covers(&other), "{other:?}");
        }
        // Changed after signing: the signature no longer holds.
        let mut forged = sa.clone();
        if let AttestBody::Approval { inputs, .. } = &mut forged.attest.body {
            inputs[0] = ObjectRef([9; 32]);
        }
        assert!(forged.verify().is_err());
        // Signed by someone else than the identity it carries.
        let other_sk = SecretKey::generate();
        let mut stolen = SignedApproval::sign(&statement(), &id, &other_sk);
        stolen.signer = id.clone();
        assert!(stolen.verify().is_err());
    }
}

`/`	Search
`g` `c`	Code
`g` `h`	History
`g` `b`	Bookmarks
`g` `t`	Trust
`y`	Permalink to this state (files and trees)
`?`	This sheet

1		//! A person's approval of one job of one run, signed (oxygenhub#235): the
2		//! approval attestation, the signer's signature over it, and the signer's
3		//! identity, so it verifies with nothing else. The hub decides whether the
4		//! signer may approve; the signature makes the decision theirs, and binds
5		//! it to exactly that job, state, plan and environment.
6
7		use crate::attest::{Attest, AttestBody};
8		use crate::cbor::{self, Value};
9		use crate::hash::ObjectRef;
10		use crate::identity::{verify, Domain, Identity, SecretKey, Signature};
11		use crate::objects::{array, bytes, Hlc, ObjectError};
12
13		/// What is approved.
14		#[derive(Clone, Debug, PartialEq, Eq)]
15		pub struct Statement {
16		pub repo: [u8; 16],
17		/// The run, as its URL on the hub.
18		pub run: String,
19		pub job: String,
20		/// The job's hash with its sandbox (OxygenFlow spec 6.2).
21		pub job_hash: ObjectRef,
22		pub state: ObjectRef,
23		/// The blobs the job takes as inputs (a plan), any order.
24		pub inputs: Vec<ObjectRef>,
25		pub environment: String,
26		pub approve: bool,
27		}
28
29		#[derive(Debug, thiserror::Error)]
30		pub enum ApprovalError {
31		#[error("the attestation is not an approval")]
32		NotApproval,
33		#[error("no signature by the signer {0}")]
34		Unsigned(String),
35		#[error("the signature does not verify: {0}")]
36		BadSignature(String),
37		#[error("{0}")]
38		Schema(String),
39		}
40
41		impl From<ObjectError> for ApprovalError {
42	0×	fn from(e: ObjectError) -> Self {
43	0×	ApprovalError::Schema(e.to_string())
44	0×	}
45		}
46
47		#[derive(Clone, Debug, PartialEq, Eq)]
48		pub struct SignedApproval {
49		pub attest: Attest,
50		pub sigs: Vec<Signature>,
51		pub signer: Identity,
52		}
53
54		impl SignedApproval {
55	4×	pub fn sign(s: &Statement, signer: &Identity, sk: &SecretKey) -> SignedApproval {
56	4×	let mut inputs = s.inputs.clone();
57	4×	inputs.sort();
58	4×	inputs.dedup();
59	4×	let attest = Attest {
60	4×	repo: s.repo,
61	4×	hlc: Hlc::now(),
62	4×	body: AttestBody::Approval {
63	4×	run: s.run.clone(),
64	4×	job: s.job.clone(),
65	4×	job_hash: s.job_hash,
66	4×	state: s.state,
67	4×	inputs,
68	4×	environment: s.environment.clone(),
69	4×	approve: s.approve,
70	4×	},
71	4×	};
72	4×	let sig = sk.sign(Domain::Attest, &signer.hash(), &attest.hash());
73	4×	SignedApproval {
74	4×	attest,
75	4×	sigs: vec![sig],
76	4×	signer: signer.clone(),
77	4×	}
78	4×	}
79
80		/// What was approved, read back from the attestation.
81	14×	pub fn statement(&self) -> Result<Statement, ApprovalError> {
82		let AttestBody::Approval {
83	14×	run,
84	14×	job,
85	14×	job_hash,
86	14×	state,
87	14×	inputs,
88	14×	environment,
89	14×	approve,
90	14×	} = &self.attest.body
91		else {
92	0×	return Err(ApprovalError::NotApproval);
93		};
94	14×	Ok(Statement {
95	14×	repo: self.attest.repo,
96	14×	run: run.clone(),
97	14×	job: job.clone(),
98	14×	job_hash: *job_hash,
99	14×	state: *state,
100	14×	inputs: inputs.clone(),
101	14×	environment: environment.clone(),
102	14×	approve: *approve,
103	14×	})
104	14×	}
105
106		/// It is an approval and the signer signed it. Whether the signer may
107		/// approve is the reader's call.
108	6×	pub fn verify(&self) -> Result<(), ApprovalError> {
109	6×	self.statement()?;
110	6×	let key = self.signer.hash();
111	6×	let sig = self
112	6×	.sigs
113	6×	.iter()
114	6×	.find(\|s\| s.key == key)
115	6×	.ok_or_else(\|\| ApprovalError::Unsigned(key.short(12)))?;
116	6×	verify(&self.signer, sig, Domain::Attest, &self.attest.hash())
117	6×	.map_err(\|e\| ApprovalError::BadSignature(e.to_string()))
118	6×	}
119
120		/// Whether `s` is what this approves (the time it was made aside).
121	7×	pub fn covers(&self, s: &Statement) -> bool {
122	7×	let mut want = s.inputs.clone();
123	7×	want.sort();
124	7×	want.dedup();
125	7×	self.statement().is_ok_and(\|mine\| {
126	7×	mine == Statement {
127	7×	inputs: want,
128	7×	..s.clone()
129	7×	}
130	7×	})
131	7×	}
132
133		/// `[attest, [Signature], identity]`, each object as its bytes.
134	1×	pub fn encode(&self) -> Vec<u8> {
135	1×	cbor::encode(&Value::Array(vec![
136	1×	Value::Bytes(self.attest.encode()),
137	1×	Value::Array(self.sigs.iter().map(\|s\| s.to_value()).collect()),
138	1×	Value::Bytes(self.signer.encode()),
139		]))
140	1×	}
141
142	1×	pub fn decode(b: &[u8]) -> Result<SignedApproval, ApprovalError> {
143	1×	let v = cbor::decode(b).map_err(ObjectError::from)?;
144	1×	let a = array(&v, "signed approval")?;
145	1×	if a.len() != 3 {
146	0×	return Err(ApprovalError::Schema(
147	0×	"signed approval: expected [attest, sigs, identity]".into(),
148	0×	));
149	1×	}
150		Ok(SignedApproval {
151	1×	attest: Attest::decode(bytes(&a[0], "attest")?)?,
152	1×	sigs: array(&a[1], "sigs")?
153	1×	.iter()
154	1×	.map(Signature::from_value)
155	1×	.collect::<Result<_, _>>()?,
156	1×	signer: Identity::decode(bytes(&a[2], "identity")?)?,
157		})
158	1×	}
159		}
160
161		#[cfg(test)]
162		mod tests {
163		use super::*;
164		use crate::identity::SecretKey;
165
166	9×	fn statement() -> Statement {
167	9×	Statement {
168	9×	repo: [7; 16],
169	9×	run: "https://hub.example/andy/infra/flow/8".into(),
170	9×	job: "apply".into(),
171	9×	job_hash: ObjectRef([1; 32]),
172	9×	state: ObjectRef([2; 32]),
173	9×	inputs: vec![ObjectRef([4; 32]), ObjectRef([3; 32])],
174	9×	environment: "prod".into(),
175	9×	approve: true,
176	9×	}
177	9×	}
178
179		#[test]
180	1×	fn an_approval_signs_exactly_one_job_state_plan_and_environment() {
181	1×	let sk = SecretKey::generate();
182	1×	let id = sk.identity("Andy", "[email protected]", 1);
183	1×	let sa = SignedApproval::sign(&statement(), &id, &sk);
184	1×	sa.verify().unwrap();
185	1×	let back = SignedApproval::decode(&sa.encode()).unwrap();
186	1×	assert_eq!(back, sa, "round trip");
187	1×	assert!(back.covers(&statement()), "inputs in any order");
188	6×	for other in [
189	1×	Statement {
190	1×	inputs: vec![ObjectRef([9; 32])],
191	1×	..statement()
192	1×	},
193	1×	Statement {
194	1×	state: ObjectRef([8; 32]),
195	1×	..statement()
196	1×	},
197	1×	Statement {
198	1×	job_hash: ObjectRef([8; 32]),
199	1×	..statement()
200	1×	},
201	1×	Statement {
202	1×	run: "https://hub.example/andy/infra/flow/9".into(),
203	1×	..statement()
204	1×	},
205	1×	Statement {
206	1×	environment: "dev".into(),
207	1×	..statement()
208	1×	},
209	1×	Statement {
210	1×	approve: false,
211	1×	..statement()
212	1×	},
213	1×	] {
214	6×	assert!(!back.covers(&other), "{other:?}");
215		}
216		// Changed after signing: the signature no longer holds.
217	1×	let mut forged = sa.clone();
218	1×	if let AttestBody::Approval { inputs, .. } = &mut forged.attest.body {
219	1×	inputs[0] = ObjectRef([9; 32]);
220	1×	}
221	1×	assert!(forged.verify().is_err());
222		// Signed by someone else than the identity it carries.
223	1×	let other_sk = SecretKey::generate();
224	1×	let mut stolen = SignedApproval::sign(&statement(), &id, &other_sk);
225	1×	stolen.signer = id.clone();
226	1×	assert!(stolen.verify().is_err());
227	1×	}
228		}

Coverage / crates/oxy-core/src/approval.rs 94.8%

Keyboard