qinglong/scripts/ql3-plugin-package-secret-binding-kubernetes-live-audit.cjs

#!/usr/bin/env node

'use strict';

const fs = require('node:fs');
const path = require('node:path');

const FIXTURE = 'qinglong/plugin-package-secret-binding-kubernetes-live@v1';
const SHA256 = /^sha256:[a-f0-9]{64}$/;
const FORBIDDEN_KEY =
  /(secretRef|secretValue|material|assertion|jwt|password|dsn|privateKey|certificate|kubeconfig|podUid|nodeUid|podName|nodeName)/i;
const REQUIRED_GATES = Object.freeze([
  'realThreeNodeKubernetes',
  'twoManagementReplicasOnDistinctNodes',
  'formalHttpsClientCommands',
  'planReplayedAcrossReplicas',
  'separationOfDutyDecision',
  'authorizedInspection',
  'realExecutorJob',
  'projectedSecretMetadataAccepted',
  'bindingPublishedExactlyOnce',
  'managementCannotReadSecrets',
  'managementDoesNotMountPackageValues',
  'executorCannotReadSecrets',
  'executorHasNoServiceAccountToken',
  'executorProjectionReadOnly',
  'databaseContainsNoSensitiveValue',
  'passed',
]);

function exact(value, keys) {
  return Boolean(
    value &&
      typeof value === 'object' &&
      !Array.isArray(value) &&
      JSON.stringify(Object.keys(value).sort()) ===
        JSON.stringify([...keys].sort()),
  );
}

function scan(value, findings, location = 'report') {
  if (Array.isArray(value)) {
    value.forEach((entry, index) =>
      scan(entry, findings, `${location}[${index}]`),
    );
    return;
  }
  if (!value || typeof value !== 'object') return;
  for (const [key, entry] of Object.entries(value)) {
    if (FORBIDDEN_KEY.test(key))
      findings.push(`${location}.${key} is forbidden`);
    if (
      typeof entry === 'string' &&
      /(qlsecret:v1:|-----BEGIN |postgres(?:ql)?:\/\/|eyJ[A-Za-z0-9_-]+\.)/.test(
        entry,
      )
    ) {
      findings.push(`${location}.${key} contains sensitive material`);
    }
    scan(entry, findings, `${location}.${key}`);
  }
}

function validatePluginPackageSecretBindingKubernetesLiveReport(report) {
  const findings = [];
  if (
    !exact(report, [
      'schemaVersion',
      'fixture',
      'observedAtMs',
      'platform',
      'management',
      'review',
      'executor',
      'persistence',
      'gates',
      'limitations',
    ]) ||
    report.schemaVersion !== 1 ||
    report.fixture !== FIXTURE ||
    !Number.isSafeInteger(report.observedAtMs) ||
    report.observedAtMs < 1
  ) {
    findings.push('report envelope is invalid');
  }
  if (
    !exact(report.platform, [
      'architecture',
      'kubernetesVersion',
      'nodeCount',
      'postgresVersionNumber',
      'adminImageId',
    ]) ||
    !['amd64', 'arm64'].includes(report.platform?.architecture) ||
    typeof report.platform?.kubernetesVersion !== 'string' ||
    report.platform?.nodeCount !== 3 ||
    report.platform?.postgresVersionNumber !== 180004 ||
    !SHA256.test(report.platform?.adminImageId ?? '')
  ) {
    findings.push('platform evidence is invalid');
  }
  if (
    !exact(report.management, [
      'replicas',
      'distinctNodeHashes',
      'serviceAccountTokenMounted',
      'packageValueVolumeMounted',
      'canGetSecrets',
      'canListSecrets',
    ]) ||
    report.management?.replicas !== 2 ||
    !Array.isArray(report.management?.distinctNodeHashes) ||
    report.management.distinctNodeHashes.length !== 2 ||
    new Set(report.management.distinctNodeHashes).size !== 2 ||
    !report.management.distinctNodeHashes.every((value) =>
      SHA256.test(value),
    ) ||
    report.management.serviceAccountTokenMounted !== false ||
    report.management.packageValueVolumeMounted !== false ||
    report.management.canGetSecrets !== false ||
    report.management.canListSecrets !== false
  ) {
    findings.push('management isolation evidence is invalid');
  }
  if (
    !exact(report.review, [
      'commands',
      'requesterSubjectHash',
      'reviewerSubjectHash',
      'distinctUsers',
      'planStatus',
      'replayStatus',
      'decisionStatus',
      'inspectionStale',
      'actionDigest',
      'planDigest',
    ]) ||
    JSON.stringify(report.review?.commands) !==
      JSON.stringify([
        'plugin-package.secret-binding.plan',
        'plugin-package.secret-binding.plan',
        'plugin-package.secret-binding.propose',
        'plugin-package.secret-binding.decide',
        'plugin-package.secret-binding.inspect',
      ]) ||
    !SHA256.test(report.review?.requesterSubjectHash ?? '') ||
    !SHA256.test(report.review?.reviewerSubjectHash ?? '') ||
    report.review?.requesterSubjectHash ===
      report.review?.reviewerSubjectHash ||
    report.review?.distinctUsers !== true ||
    report.review?.planStatus !== 'created' ||
    report.review?.replayStatus !== 'existing' ||
    report.review?.decisionStatus !== 'decided' ||
    report.review?.inspectionStale !== false ||
    !SHA256.test(`sha256:${report.review?.actionDigest ?? ''}`) ||
    !SHA256.test(`sha256:${report.review?.planDigest ?? ''}`)
  ) {
    findings.push('review ceremony evidence is invalid');
  }
  if (
    !exact(report.executor, [
      'jobSucceeded',
      'serviceAccountTokenMounted',
      'canGetSecrets',
      'canListSecrets',
      'projectionReadOnly',
      'projectionFileCount',
      'projectionKeyHash',
      'outputSensitiveFree',
    ]) ||
    report.executor?.jobSucceeded !== true ||
    report.executor?.serviceAccountTokenMounted !== false ||
    report.executor?.canGetSecrets !== false ||
    report.executor?.canListSecrets !== false ||
    report.executor?.projectionReadOnly !== true ||
    report.executor?.projectionFileCount !== 1 ||
    !SHA256.test(report.executor?.projectionKeyHash ?? '') ||
    report.executor?.outputSensitiveFree !== true
  ) {
    findings.push('executor projection evidence is invalid');
  }
  if (
    !exact(report.persistence, [
      'bindingCount',
      'authorityKind',
      'evidenceDigest',
      'entryCount',
      'approvalConsumed',
      'executionSucceeded',
      'sensitiveMatchCount',
    ]) ||
    report.persistence?.bindingCount !== 1 ||
    report.persistence?.authorityKind !== 'approved-action-execution' ||
    !SHA256.test(`sha256:${report.persistence?.evidenceDigest ?? ''}`) ||
    report.persistence?.entryCount !== 1 ||
    report.persistence?.approvalConsumed !== true ||
    report.persistence?.executionSucceeded !== true ||
    report.persistence?.sensitiveMatchCount !== 0
  ) {
    findings.push('durable binding evidence is invalid');
  }
  if (
    !exact(report.gates, REQUIRED_GATES) ||
    REQUIRED_GATES.some((gate) => report.gates?.[gate] !== true)
  ) {
    findings.push('one or more required gates are false or missing');
  }
  if (
    !Array.isArray(report.limitations) ||
    report.limitations.length !== 2 ||
    report.limitations.some(
      (value) =>
        typeof value !== 'string' || value.length < 16 || value.length > 512,
    )
  ) {
    findings.push('limitations are invalid');
  }
  scan(report, findings);
  return Object.freeze({
    schemaVersion: 1,
    fixture: FIXTURE,
    findings: Object.freeze(findings),
    compatible: findings.length === 0,
  });
}

function main(argv) {
  if (argv.length !== 1 || !argv[0].startsWith('--report=/')) {
    throw new Error(
      'usage: ql3-plugin-package-secret-binding-kubernetes-live-audit --report=/absolute/report.json',
    );
  }
  const reportPath = argv[0].slice('--report='.length);
  if (path.resolve(reportPath) !== reportPath)
    throw new Error('report path is invalid');
  const report = JSON.parse(fs.readFileSync(reportPath, 'utf8'));
  const result = validatePluginPackageSecretBindingKubernetesLiveReport(report);
  process.stdout.write(`${JSON.stringify(result)}\n`);
  if (!result.compatible) process.exitCode = 1;
}

if (require.main === module) {
  try {
    main(process.argv.slice(2));
  } catch (error) {
    process.stderr.write(
      `QL3 Secret binding Kubernetes live audit failed: ${
        error instanceof Error ? error.message : String(error)
      }\n`,
    );
    process.exitCode = 1;
  }
}

module.exports = {
  FIXTURE,
  REQUIRED_GATES,
  validatePluginPackageSecretBindingKubernetesLiveReport,
};