aios/tests/test_owner_merge_authorization_server_v2.py

from __future__ import annotations

import json
import os
from pathlib import Path

import pytest
from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey

from aios_owner_merge_authorization import (
    OwnerMergeApprovalError,
    OwnerMergeApprovalPolicy,
    OwnerMergeApprovalVerifier,
)
from aios_owner_merge_authorization_server import OwnerMergeApprovalService
from aios_single_host_authority import (
    RegistryOwnerApprovalVerifier,
    ssh_fingerprint,
    ssh_public_line,
)


NOW = 2_000_000_000


def _write_key(path: Path, key: Ed25519PrivateKey) -> None:
    path.write_bytes(
        key.private_bytes(
            serialization.Encoding.PEM,
            serialization.PrivateFormat.PKCS8,
            serialization.NoEncryption(),
        )
    )
    os.chmod(path, 0o600)


@pytest.fixture
def service_env(tmp_path: Path):
    owner_key = Ed25519PrivateKey.generate()
    owner_path = tmp_path / "owner.key"
    _write_key(owner_path, owner_key)
    registry_path = tmp_path / "registry.json"
    registry_path.write_text(
        json.dumps(
            {
                "schema": "aios.single-host-signer-registry.v1",
                "authority_generation": 1,
                "signers": [
                    {
                        "signer_id": "local-owner-authority",
                        "role": "OWNER_AUTHORITY",
                        "provider": "local_unix_service",
                        "fingerprint": ssh_fingerprint(owner_key.public_key()),
                        "public_key": ssh_public_line(owner_key.public_key(), "owner"),
                        "socket": "/run/aios/owner-authority.sock",
                        "secret_ref": "aios-secret://owner",
                        "status": "ACTIVE",
                        "generation": 1,
                        "parent_signer_id": "",
                        "parent_fingerprint": "",
                    }
                ],
            },
            sort_keys=True,
        )
        + "\n"
    )
    os.chmod(registry_path, 0o644)
    policy = OwnerMergeApprovalPolicy(
        repository="aios/aios",
        pr_number=75,
        pr_head_oid="a" * 40,
        expected_main_oid="b" * 40,
        operation="merge.pull-request",
        required_check_contract_digest="c" * 64,
        required_checks=("contract", "security"),
        owner_identity="owner:aios-single-host",
        audit_lineage_digest="d" * 64,
        maximum_ttl_seconds=300,
    )
    policy_path = tmp_path / "policy.json"
    policy_path.write_text(json.dumps(policy.as_dict(), sort_keys=True) + "\n")
    os.chmod(policy_path, 0o600)
    return {
        "policy": policy,
        "policy_path": policy_path,
        "registry_path": registry_path,
        "owner_path": owner_path,
        "ledger_path": tmp_path / "issuance.sqlite3",
    }


def _service(env):
    return OwnerMergeApprovalService(
        policy_path=env["policy_path"],
        registry_path=env["registry_path"],
        owner_key_path=env["owner_path"],
        issuance_ledger_path=env["ledger_path"],
        allowed_uids=(1000,),
        require_root_owner=False,
        clock=lambda: NOW,
        token_urlsafe=lambda _size: "server-generated-nonce",
    )


def test_service_issues_exact_owner_approval_and_exact_replay_is_audit_idempotent(service_env):
    service = _service(service_env)
    request = {"operation": "issue_owner_merge_approval", "payload": {}}

    first = service.handle(request, peer_uid=1000)
    second = _service(service_env).handle(request, peer_uid=1000)

    assert first["status"] == "PASS"
    assert first["idempotent"] is False
    assert second["idempotent"] is True
    assert second["artifact"] == first["artifact"]
    verifier = OwnerMergeApprovalVerifier(
        primary=RegistryOwnerApprovalVerifier(
            service_env["registry_path"], require_root_owner=False
        ),
        clock=lambda: NOW,
    )
    payload, proof_path = verifier.verify(first["artifact"], service_env["policy"])
    assert proof_path == "primary"
    assert payload["repository"] == "aios/aios"
    assert payload["pr_number"] == 75


def test_expired_approval_is_retained_for_audit_but_reissued_with_a_new_nonce(service_env):
    clock = [NOW]
    token_values = iter(("approval-one", "nonce-one", "approval-two", "nonce-two"))
    service = OwnerMergeApprovalService(
        policy_path=service_env["policy_path"],
        registry_path=service_env["registry_path"],
        owner_key_path=service_env["owner_path"],
        issuance_ledger_path=service_env["ledger_path"],
        allowed_uids=(1000,),
        require_root_owner=False,
        clock=lambda: clock[0],
        token_urlsafe=lambda _size: next(token_values),
    )
    request = {"operation": "issue_owner_merge_approval", "payload": {}}

    first = service.handle(request, peer_uid=1000)
    clock[0] += service_env["policy"].maximum_ttl_seconds
    second = service.handle(request, peer_uid=1000)

    assert first["idempotent"] is False
    assert second["idempotent"] is False
    assert second["artifact"]["payload"]["nonce"] != first["artifact"]["payload"]["nonce"]
    assert second["artifact"]["payload"]["issued_at"] == clock[0]


@pytest.mark.parametrize(
    "raw_request",
    [
        {"operation": "issue_owner_merge_approval", "payload": {"nonce": "caller-nonce"}},
        {"operation": "issue_owner_merge_approval", "payload": {"pr_head_oid": "f" * 40}},
        {"operation": "sign", "payload": {}},
        {"operation": "sign_bytes", "payload": {}},
    ],
)
def test_service_rejects_caller_selected_scope_and_generic_signing(service_env, raw_request):
    service = _service(service_env)

    with pytest.raises(OwnerMergeApprovalError, match="OWNER_MERGE_ISSUER_"):
        service.handle(raw_request, peer_uid=1000)


def test_service_rejects_untrusted_peer_before_issuing_anything(service_env):
    with pytest.raises(OwnerMergeApprovalError, match="OWNER_MERGE_ISSUER_PEER_UID_FORBIDDEN"):
        _service(service_env).handle(
            {"operation": "issue_owner_merge_approval", "payload": {}},
            peer_uid=2000,
        )