0ae29ae342
Some checks failed
validate / Rego (opa fmt + opa test) (push) Successful in 16s
validate / JSON Schema (ajv) (push) Successful in 20s
build-images / signing-service image (push) Successful in 24s
validate / DB (migrate up/down dry-run) (push) Failing after 26s
validate / Go (vet + test) (push) Successful in 1m16s
Adds services/verification-service exposing POST /api/v1/verify/chain for sink:dummy-sink. The handler runs the six hard-coded chain checks described in DEV-612 and reserves decision_id in a new `verification_decisions` table so a replayed sink delivery is refused without recomputing signatures. - DSSE signature verification against configurable approval + transform signer key_ids, loaded from VERIFICATION_SIGNER_KEYS (pem/hex/b64/b64u) - RFC 6962 inclusion-proof verifier (shared leaf/node hashing with services/transparency-log/pkg/backend) - Content binding: subject.digest.sha256 must match predicate.content_hash (approval) and request.payload_hash (transform) - Hard-coded coverage of allowed_transformations / allowed_sinks / expires_at predicates (OPA deferred to Phase 2 per the subtask) - Replay guard via new db/trust/migrations/0005_verification_decisions (in-memory store ships; Postgres skeleton mirrors sibling pattern) - Dockerfile mirrors signing-service pattern (distroless static + nonroot) - README documents endpoint, reason-code taxonomy, required predicate fields, and the Phase-2 non-scope Tests: happy path + 7 negatives (bad signature, missing inclusion proof, hash drift, sink not allowed, expired, replay, operation not allowed). Co-Authored-By: Paperclip <noreply@paperclip.ing>
44 lines
1.5 KiB
Go
44 lines
1.5 KiB
Go
// Package store persists the verification-service's replay-guard
|
|
// `verification_decisions` row. The verifier reserves a decision_id
|
|
// exactly once per successful chain check; the second attempt sees
|
|
// ErrReplay and short-circuits to a 409-shaped verdict in the HTTP
|
|
// layer.
|
|
//
|
|
// Phase 1 ships an in-memory impl; the Postgres schema is in
|
|
// db/trust/migrations/0005_verification_decisions.*.sql and wired via a
|
|
// skeleton Postgres type so the HTTP + chain layers stay unchanged when
|
|
// the real pgxpool wiring lands.
|
|
package store
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"time"
|
|
)
|
|
|
|
// ErrReplay is returned by Reserve when decision_id has already been
|
|
// stored by a prior successful chain check.
|
|
var ErrReplay = errors.New("store: decision_id already used")
|
|
|
|
// Decision is the single row inserted on a successful chain verdict.
|
|
// Actors are the (approval_signer_key, transform_signer_key) pair; they
|
|
// are useful for post-hoc audit (who, together, authorised this sink
|
|
// write) and are returned to the client in the verify response.
|
|
type Decision struct {
|
|
DecisionID string
|
|
ApprovalRef string
|
|
TransformRef string
|
|
PayloadHash string
|
|
SinkTarget string
|
|
ApprovalKey string
|
|
TransformKey string
|
|
CreatedAt time.Time
|
|
}
|
|
|
|
// Store is the persistence contract. Reserve MUST be atomic: a second
|
|
// Reserve of the same decision_id, even if interleaved with the first,
|
|
// MUST return ErrReplay and NOT overwrite the stored row.
|
|
type Store interface {
|
|
Reserve(ctx context.Context, d Decision) error
|
|
Get(ctx context.Context, decisionID string) (Decision, bool, error)
|
|
}
|