67 lines
2.8 KiB
Python
67 lines
2.8 KiB
Python
"""Author-only executable examples of proposed rules, using synthetic facts.
|
|
|
|
Not an authenticator, reference resolver, sandbox, process observer, or runtime
|
|
validator. Input facts are fixture assumptions, never evidence of real state.
|
|
"""
|
|
|
|
|
|
def evaluate(case):
|
|
kind, data = case['kind'], case['input']
|
|
if kind == 'reference':
|
|
target = data['target']
|
|
return bool(target and not data['pruned'] and all(
|
|
target[key] == data['reference'][key]
|
|
for key in ('kind', 'id', 'scope', 'revision', 'digest')
|
|
))
|
|
if kind == 'permission':
|
|
if not data['authenticated'] or not data['intentCurrent']:
|
|
return False
|
|
required = ['agent', 'project', 'workspace', 'execution']
|
|
if data['assigned']:
|
|
required += ['mission', 'task']
|
|
elif data['operation'] not in ['work.read', 'file.read']:
|
|
return False
|
|
layers = data['layers']
|
|
return all(name in layers and layers[name] is not None
|
|
and data['operation'] in layers[name] for name in required)
|
|
if kind == 'path':
|
|
path = data['path'].split('/')
|
|
if any(part in ('', '.', '..') for part in path):
|
|
return False
|
|
return any(grant is None or path[:len(grant.split('/'))] == grant.split('/')
|
|
for grant in data['grants'])
|
|
if kind == 'acceptance':
|
|
return (data['reviewerAuthorized'] and data['reviewer'] not in data['authors']
|
|
and bool(data['requiredCriteria'])
|
|
and set(data['requiredCriteria']) == set(data['verifiedCriteria']))
|
|
if kind == 'claim':
|
|
# Read events as externally supplied observations. This never observes a process.
|
|
active, uncertain, audit, generation = False, False, True, 1
|
|
answers = []
|
|
for event in data['events']:
|
|
op = event['operation']
|
|
if op == 'audit-failed':
|
|
audit = False
|
|
elif op == 'audit-restored':
|
|
audit = True
|
|
elif op == 'uncertain-effects':
|
|
uncertain = True
|
|
elif op == 'verified-stopped-and-reconciled':
|
|
if audit:
|
|
active, uncertain = False, False
|
|
generation += 1
|
|
elif op == 'engine-idle':
|
|
pass # Not proof that commands/processes have stopped.
|
|
elif op == 'launch':
|
|
allowed = audit and not active and not uncertain
|
|
answers.append(allowed)
|
|
if allowed:
|
|
active = True
|
|
elif op == 'input':
|
|
answers.append(audit and active and not uncertain
|
|
and event['generation'] == generation)
|
|
else:
|
|
raise ValueError(op)
|
|
return answers
|
|
raise ValueError(kind)
|