Sealed approvals: a gate released only by a signature of the approver's key 47e374020b59

-- Sealed approvals (oxygenhub#235): the approval attestation, kept in the

-- repository, that released a job; empty when it was approved unsealed.

ALTER TABLE flow_jobs ADD COLUMN approval_seal TEXT NOT NULL DEFAULT '';

        .route("/repos/{owner}/{name}/flow/runs/{number}/jobs/{job}/approval", get(flow_job_statement))

        .route("/repos/{owner}/{name}/flow/runs/{number}/jobs/{job}/seal", post(seal_flow_job))

/// `GET .../flow/runs/{n}/jobs/{job}/approval`: what approving the job

/// means, for `oxy seal --flow` to sign (oxygenhub#235).

async fn flow_job_statement(

    State(app): State<Shared>,

    headers: HeaderMap,

    Path((owner, name, number, job)): Path<(String, String, i64, String)>,

) -> Result<Json<serde_json::Value>, ApiError> {

    let c = caller(&app, &headers).await?;

    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;

    let run = db::flow::run(&app.db, row.id, number).await?.ok_or_else(|| ApiError(StatusCode::NOT_FOUND, "no such run".into()))?;

    let (s, j) = crate::flow::approval_statement(&app, &row, &run, &job).await.map_err(|m| ApiError(StatusCode::CONFLICT, m))?;

    Ok(Json(serde_json::json!({

        "repo": hex::encode(s.repo),

        "run": s.run,

        "job": s.job,

        "job_hash": s.job_hash.to_hex(),

        "state": s.state.to_hex(),

        "inputs": s.inputs.iter().map(|i| i.to_hex()).collect::<Vec<_>>(),

        "environment": s.environment,

        "waiting": j.approval == "waiting" && j.status == "queued",

    })))

}

#[derive(Deserialize)]

struct SealBody {

    signed: String,

}

/// `POST .../flow/runs/{n}/jobs/{job}/seal` `{"signed": hex}`: approve or

/// reject with a signed approval (oxygenhub#235). The signature, not the

/// caller, says who decided; the caller must be signed in.

async fn seal_flow_job(

    State(app): State<Shared>,

    headers: HeaderMap,

    Path((owner, name, number, job)): Path<(String, String, i64, String)>,

    Json(body): Json<SealBody>,

) -> Result<Json<serde_json::Value>, ApiError> {

    let c = caller(&app, &headers).await?;

    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;

    let run = db::flow::run(&app.db, row.id, number).await?.ok_or_else(|| ApiError(StatusCode::NOT_FOUND, "no such run".into()))?;

    let said = crate::flow::decide_sealed(&app, &row, &run, &job, &body.signed).await.map_err(|m| ApiError(StatusCode::CONFLICT, m))?;

    Ok(Json(serde_json::json!({ "number": number, "job": job, "said": said })))

}

    /// The approval attestation that released it, when sealed (#235).

    pub approval_seal: String,

             approved_ms = NULL, approval_seal = '' WHERE id = ?",

pub async fn approve_job(pool: &Pool, id: i64, who: &str, seal: &str) -> sqlx::Result<bool> {

        "UPDATE flow_jobs SET approval = 'approved', approved_by = ?, approved_ms = ?, approval_seal = ? \

         WHERE id = ? AND status = 'queued' AND approval = 'waiting'",

    .bind(seal)

    decide_with(app, row, run, name, who, approve, None).await

}

/// [`decide`], from a verified seal (`Some(approval ref)`) or without one;

/// a gate that takes a sealed approval is not approved without.

async fn decide_with(

    app: &Shared,

    row: &db::repos::RepoRow,

    run: &fdb::Run,

    name: &str,

    who: &db::accounts::Account,

    approve: bool,

    seal: Option<&str>,

) -> Result<String, String> {

    let approval = may_decide(app, row, run, &job, who).await?;

    if approve && approval.sealed && seal.is_none() {

        return Err(format!(

            "{name} takes an approval signed with your key: in a checkout of {}/{}, run oxy seal --flow {}/{}/{}/flow/{} --job {name}",

            row.owner,

            row.name,

            app.config.base_url(),

            row.owner,

            row.name,

            run.number

        ));

    }

    let sealed = seal.map(|r| format!(", sealed (approval {})", &r[..12.min(r.len())])).unwrap_or_default();

        if !fdb::approve_job(&app.db, job.id, &who.username, seal.unwrap_or("")).await.map_err(|e| e.to_string())? {

        db::accounts::audit(&app.db, Some(who), "flow.approved", &target, seal.unwrap_or("")).await.ok();

        format!("approved by {}{sealed}", who.username)

        let why = format!("rejected by {}{sealed}", who.username);

}

/// What approving job `name` of `run` means, for the approver to sign

/// (oxygenhub#235): this repository, the run's URL, the job's hash with its

/// sandbox, the run's state, the blobs it takes, its environment.

pub async fn approval_statement(

    app: &Shared,

    row: &db::repos::RepoRow,

    run: &fdb::Run,

    name: &str,

) -> Result<(oxy_core::approval::Statement, fdb::Job), String> {

    let jobs = fdb::jobs(&app.db, run.id).await.map_err(|e| e.to_string())?;

    let Some(job) = jobs.into_iter().find(|j| j.name == name) else { return Err(format!("run #{} has no job {name}", run.number)) };

    let spec: flow_core::Job = serde_json::from_str(&job.spec).map_err(|e| format!("stored job: {e}"))?;

    let sandbox: flow_core::Sandbox = serde_json::from_str(&job.sandbox).map_err(|e| format!("stored sandbox: {e}"))?;

    let repo_name = RepoName::new(&row.owner, &row.name).ok_or("bad repository name")?;

    let repo = app.repos.read(&repo_name, |r, _| Ok(r.id()?)).await.map_err(|e| e.to_string())?;

    let state = oxy_core::hash::ObjectRef::from_hex(&run.state).ok_or("the run has no state")?;

    let inputs = artifact_inputs(app, &job, &spec).await?.iter().filter_map(|i| oxy_core::hash::ObjectRef::from_hex(&i.blob)).collect();

    let statement = oxy_core::approval::Statement {

        repo,

        run: format!("{}/{}/{}/flow/{}", app.config.base_url(), row.owner, row.name, run.number),

        job: name.to_string(),

        job_hash: oxy_core::hash::ObjectRef(spec.hash(&sandbox)),

        state,

        inputs,

        environment: spec.environment.clone().unwrap_or_default(),

        approve: true,

    };

    Ok((statement, job))

}

/// Decide on job `name` of `run` from a signed approval (oxygenhub#235): it

/// must verify, cover exactly this job's statement, and be signed by a key

/// linked to an account (a delegated agent key is not) that may decide; it

/// is kept in the repository. What happened, or why not.

pub async fn decide_sealed(app: &Shared, row: &db::repos::RepoRow, run: &fdb::Run, name: &str, signed_hex: &str) -> Result<String, String> {

    let bytes = hex::decode(signed_hex.trim()).map_err(|_| "the signed approval is not hex".to_string())?;

    let sa = oxy_core::approval::SignedApproval::decode(&bytes).map_err(|e| format!("not a signed approval: {e}"))?;

    sa.verify().map_err(|e| format!("it does not verify: {e}"))?;

    let (mut expected, _) = approval_statement(app, row, run, name).await?;

    let given = sa.statement().map_err(|e| e.to_string())?;

    expected.approve = given.approve;

    if !sa.covers(&expected) {

        return Err(format!(

            "it approves something else than job {name} of run #{} as it is now (another run, state, plan or environment): sign again",

            run.number

        ));

    }

    let key = sa.signer.hash().to_hex();

    let links = db::accounts::identity_accounts(&app.db).await.map_err(|e| e.to_string())?;

    let Some((_, username)) = links.iter().find(|(k, _)| *k == key) else {

        return Err(format!(

            "key {} is not linked to an account here (link it under Settings › Keys; an agent's delegated key cannot approve)",

            &key[..12]

        ));

    };

    let who = db::accounts::account_by_name(&app.db, username).await.map_err(|e| e.to_string())?.ok_or("the key's account is gone")?;

    let repo_name = RepoName::new(&row.owner, &row.name).ok_or("bad repository name")?;

    let jobs = fdb::jobs(&app.db, run.id).await.map_err(|e| e.to_string())?;

    let job = jobs.iter().find(|j| j.name == name).ok_or("no such job")?;

    may_decide(app, row, run, job, &who).await?;

    let kept = app.repos.write(&repo_name, move |r, _| Ok(r.add_approval(&sa)?)).await.map_err(|e| e.to_string())?;

    decide_with(app, row, run, name, &who, given.approve, Some(&kept.to_hex())).await

                approved_by: (job.approval == "approved").then_some(job.approved_by.as_str()),

                approval: (!job.approval_seal.is_empty()).then_some(job.approval_seal.as_str()),

    /// Who approved the job, and the sealed approval's hash (#235).

    pub approved_by: Option<&'a str>,

    pub approval: Option<&'a str>,

                "repository_visibility", "bookmark", "run_number", "job", "state", "runner", "actor", "environment", "approved_by", "approval"],

        if let Some(a) = c.approved_by {

            payload["approved_by"] = serde_json::Value::from(a);

        }

        if let Some(a) = c.approval {

            payload["approval"] = serde_json::Value::from(a);

        }

            approved_by: Some("andy"),

            approval: Some("ab12"),

        assert_eq!((got["approved_by"].as_str(), got["approval"].as_str()), (Some("andy"), Some("ab12")));

        let plain = issuer.mint(&JobClaims { environment: None, approved_by: None, approval: None, ..claims });

    /// It takes an approval signed with the approver's key (#235): the

    /// command that signs it, and the approval's hash once sealed.

    pub sealed: bool,

    pub command: String,

    pub seal: String,

            sealed: a.sealed,

            command: format!("oxy seal --flow {}/{owner}/{name}/flow/{} --job {}", app.config.base_url(), run.number, j.name),

            seal: j.approval_seal.clone(),

            "schema-version 1\nsandbox \"alpine\" {{\n    rootfs \"cas://blob/{ROOTFS}\"\n}}\njob \"plan\" {{\n    sandbox \"alpine\"\n    exec \"plan\"\n}}\njob \"apply\" {{\n    sandbox \"alpine\"\n    depends-on \"plan\"\n    approval {{\n        by \"maintain\"\n        others-only #true\n        sealed #false\n    }}\n    environment \"prod\"\n    identity \"https://sts.example\" {{\n        mount-path \"/run/secrets/cloud\"\n    }}\n    exec \"apply\"\n}}\n"

#[tokio::test(flavor = "multi_thread")]

async fn a_sealed_approval_releases_exactly_the_reviewed_plan() {

    use oxy_core::approval::{SignedApproval, Statement};

    use oxy_core::hash::ObjectRef;

    use oxy_core::identity::SecretKey;

    let h = hub().await;

    db::accounts::create_account(&h.app.db, "andy", "[email protected]", "x", "salt", true).await.unwrap();

    let carol = db::accounts::create_account(&h.app.db, "carol", "[email protected]", "x", "salt", true).await.unwrap();

    let sk = SecretKey::generate();

    let carol_id = sk.identity("Carol", "[email protected]", 1);

    db::accounts::link_identity(&h.app.db, carol.id, &carol_id.hash().to_hex(), "Carol", "[email protected]", &carol_id.encode())

        .await

        .unwrap();

    create(&h.app, "andy", "infra").await;

    let row = db::repos::get(&h.app.db, "andy", "infra").await.unwrap().unwrap();

    let work = tempfile::tempdir().unwrap();

    let c = client(&format!("{}/andy/infra", h.base), work.path());

    write(

        work.path(),

        ".flow/pipeline.kdl",

        &format!(

            "schema-version 1\nsandbox \"alpine\" {{\n    rootfs \"cas://blob/{ROOTFS}\"\n}}\njob \"plan\" {{\n    sandbox \"alpine\"\n    exec \"plan\"\n    output {{\n        artifact \"tfplan\" {{\n            path \"/src/out/tfplan\"\n        }}\n    }}\n}}\njob \"apply\" {{\n    sandbox \"alpine\"\n    depends-on \"plan\"\n    environment \"prod\"\n    approval\n    input {{\n        artifact \"tfplan\" from \"plan\"\n        path \"/src/tfplan\"\n    }}\n    identity \"https://sts.example\" {{\n        mount-path \"/run/secrets/cloud\"\n    }}\n    exec \"apply\"\n}}\n"

        ),

    );

    c.snapshot("test").unwrap();

    c.commit("Plan, then apply", &[]).unwrap();

    assert!(c.push("origin", false).unwrap().iter().all(|r| r.ok));

    let run = runs_of(&h.app, "andy", "infra").await[0].clone();

    let p = claim(&h.app).await.unwrap();

    let plan_id = p["job_id"].as_i64().unwrap();

    let plan = b"the reviewed plan".to_vec();

    upload(&h.app, plan_id, "tfplan", &plan).await;

    let mut r = receipt("plan", p["pipeline_hash"].as_str().unwrap(), 0);

    r["outputs"] = serde_json::json!([oxy_core::repo::Repo::blob_ref(&plan).to_hex()]);

    finish(&h.app, plan_id, serde_json::json!({ "exit_code": 0, "duration_ms": 10, "receipt": r })).await;

    let run = db::flow::run(&h.app.db, row.id, run.number).await.unwrap().unwrap();

    // An environment's gate takes a sealed approval: pressing Approve is not enough.

    let plain = oxygenhub::flow::decide(&h.app, &row, &run, "apply", &carol, true).await.unwrap_err();

    assert!(plain.contains(&format!("oxy seal --flow {}/andy/infra/flow/{} --job apply", h.base, run.number)), "{plain}");

    // What there is to sign.

    let (st, body) =

        call(&h.app, "GET", &format!("/api/v1/repos/andy/infra/flow/runs/{}/jobs/apply/approval", run.number), Some("site"), None).await;

    assert_eq!(st, StatusCode::OK, "{body}");

    let v: serde_json::Value = serde_json::from_str(&body).unwrap();

    assert_eq!(v["environment"], "prod");

    assert_eq!(v["inputs"], serde_json::json!([oxy_core::repo::Repo::blob_ref(&plan).to_hex()]), "the reviewed plan");

    let mut repo = [0u8; 16];

    repo.copy_from_slice(&hex::decode(v["repo"].as_str().unwrap()).unwrap());

    let oref = |k: &str| ObjectRef::from_hex(v[k].as_str().unwrap()).unwrap();

    let statement = Statement {

        repo,

        run: v["run"].as_str().unwrap().into(),

        job: "apply".into(),

        job_hash: oref("job_hash"),

        state: oref("state"),

        inputs: v["inputs"].as_array().unwrap().iter().map(|i| ObjectRef::from_hex(i.as_str().unwrap()).unwrap()).collect(),

        environment: "prod".into(),

        approve: true,

    };

    let seal = |s: &Statement, key: &SecretKey, id: &oxy_core::identity::Identity| {

        let body = serde_json::json!({ "signed": hex::encode(SignedApproval::sign(s, id, key).encode()) }).to_string();

        let app = h.app.clone();

        let path = format!("/api/v1/repos/andy/infra/flow/runs/{}/jobs/apply/seal", run.number);

        async move { call(&app, "POST", &path, Some("site"), Some(body)).await }

    };

    // Another plan, or a key linked to nobody (an agent's), is refused.

    let other_plan = Statement { inputs: vec![ObjectRef([9; 32])], ..statement.clone() };

    let (st, body) = seal(&other_plan, &sk, &carol_id).await;

    assert!(st == StatusCode::CONFLICT && body.contains("approves something else"), "{st} {body}");

    let agent = SecretKey::generate();

    let agent_id = agent.identity("Claude Code", "[email protected]", 1);

    let (st, body) = seal(&statement, &agent, &agent_id).await;

    assert!(st == StatusCode::CONFLICT && body.contains("not linked to an account"), "{st} {body}");

    assert!(claim(&h.app).await.is_none(), "still waiting");

    // Carol's seal releases it; it is kept in the repository; the token names her and it.

    let (st, body) = seal(&statement, &sk, &carol_id).await;

    assert_eq!(st, StatusCode::OK, "{body}");

    assert!(body.contains("approved by carol, sealed"), "{body}");

    let name = oxygenhub::repos::RepoName::parse("andy/infra").unwrap();

    let state = statement.state;

    let kept = h.app.repos.read(&name, move |r, _| Ok(r.store().approvals_for(&state)?)).await.unwrap();

    assert_eq!(kept.len(), 1, "the approval is in the repository");

    let j = claim(&h.app).await.expect("released");

    assert_eq!(j["job"]["name"], "apply");

    let token =

        j["secrets"].as_array().unwrap().iter().find(|s| s["path"] == "/run/secrets/cloud").unwrap()["value"].as_str().unwrap().to_string();

    let claims = h.app.oidc().await.unwrap().verify(&token, "https://sts.example", db::now_ms()).unwrap();

    assert_eq!((claims["environment"].as_str(), claims["approved_by"].as_str()), (Some("prod"), Some("carol")));

    assert_eq!(claims["approval"].as_str(), Some(kept[0].to_hex().as_str()));

    let (_, page) = call(&h.app, "GET", &format!("/andy/infra/flow/{}", run.number), None, None).await;

    assert!(page.contains("sealed with their key"), "the run page says so");

}

      {% if a.sealed %}<p class="small">It takes an approval signed with your own key. In a checkout of {{ repo.owner }}/{{ repo.name }}:</p>

      <div class="clone"><input type="text" readonly value="{{ a.command }}" onfocus="this.select()" aria-label="The command that approves it"><button type="button" class="small" data-copy="{{ a.command }}">copy</button></div>{% endif %}

      {% if a.may_decide() %}<form class="inline" method="post" action="{{ repo.url }}/flow/{{ run.number }}/jobs/{{ a.job }}/decide"><input type="hidden" name="_csrf" value="{{ shell.csrf }}">{% if !a.sealed %}<button type="submit" name="action" value="approve" class="small">APPROVE</button> {% endif %}<button type="submit" name="action" value="reject" class="small danger-btn">REJECT</button></form>

    {% else if a.state == "approved" %}approved by {{ a.who }} <time title="{{ a.when_ms|when }}">{{ a.when_ms|ago }}</time>{% if !a.seal.is_empty() %}, <span class="sig sig-valid">◈</span> sealed with their key (approval <code title="{{ a.seal }}">{{ a.seal|short }}</code>){% else if a.sealed %}{% endif %}.