Implement Stage A: rule engine, validation, audit, and safety gates
Completes 109 of 121 tasks. Every remaining task needs a tenant connection
(T055, T056, T101-T103) or an Azure Automation account (T115-T121).
354 offline Pester tests PASS
Engine purity (Principle IV) PASS
Sanitization (SC-013) PASS (156 files)
Graph module loaded in tests none (SC-008 holds)
What landed
- Four-layer configuration validation with stable finding codes, covering
every VR-002 and VR-003 condition, plus a 23-fixture invalid-config corpus
- Run loop, audit records (NDJSON through a single sink), summaries,
reconciliation, and exit codes 0-6
- Persistence behind a single write-body builder whose result always has
exactly one key
- Invoke-PersonaEngine.ps1 and Edit-PersonaEngineConfig.ps1
- Six docs, two pipelines, traceability matrix, V-5a and sanitization records
Three deviations from tasks.md, each recorded in its status block
T033 is not in Resolve-UserPersona. evaluationErrorThreshold is run-level
state and the rule engine is pure; a counter there would break Principle IV.
It lives in New-PersonaRunCounter and is applied in the run loop.
A new src/Engine/ layer holds Invoke-PersonaEngineRun. The entry script
imports the manifest, which requires Microsoft.Graph.Authentication, so a
loop living only inside it could not run on a machine without the Graph SDK
and SC-004 could not be proven at all. The entry script is now a thin
wrapper and what ships is what is tested.
The invalid-config corpus is generated by a committed script, with the
generated fixtures committed too, so a reviewer sees the fixture in the diff.
Defects found by running the code, not by reading it
Group and role ID lists were double-wrapped: @(Get-PersonaGroupIdPage ...)
around a comma-returned array collapsed every membership list into one
bogus space-joined entry. That is a silent false non-match, exactly what
FR-013 exists to prevent.
A 403 whose status appears only in the exception message parsed as $null,
which the retry policy treats as a transport error - five requests per
account against a tenant already refusing. Status extraction now falls back
to the message text, bounded to 400-599.
The sanitization scan walked tracked files only, so it covered 34 of 156
files and none of this phase's code. It now scans untracked non-ignored
files too, and a negative control confirms it catches a planted leak.
Test-Json reports one error per violating location, not first-failure-only
as the V-5a draft claimed. Record and pin corrected.
Enforcement remains blocked on the V-4 security sign-off.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
@@ -0,0 +1,138 @@
|
||||
<#
|
||||
.SYNOPSIS
|
||||
Fails if any tracked file contains data that must never be committed (SC-013).
|
||||
|
||||
.DESCRIPTION
|
||||
Constitution: every artifact must be free of organization names, real domains,
|
||||
tenant or subscription IDs, real UPNs or Object IDs, and any secret.
|
||||
|
||||
The scan is intentionally blunt. A false positive costs a placeholder rewrite;
|
||||
a false negative commits tenant data to history, where deleting it later does
|
||||
not undo the disclosure.
|
||||
|
||||
Placeholder GUIDs are permitted: any GUID built only from zeros plus a short
|
||||
hex suffix (00000000-0000-0000-0000-0000000000a0) is obviously synthetic.
|
||||
|
||||
.EXAMPLE
|
||||
./tests/Test-Sanitization.ps1
|
||||
./tests/Test-Sanitization.ps1 -Path ./src
|
||||
#>
|
||||
[CmdletBinding()]
|
||||
param(
|
||||
[string] $Path = (Split-Path $PSScriptRoot -Parent),
|
||||
[switch] $PassThru
|
||||
)
|
||||
|
||||
$ErrorActionPreference = 'Stop'
|
||||
|
||||
# A GUID is synthetic when every character before the final short suffix is 0.
|
||||
$placeholderGuid = '^0{8}-0{4}-0{4}-0{4}-0{8}[0-9a-f]{4}$'
|
||||
|
||||
$patterns = @(
|
||||
@{
|
||||
Name = 'Real GUID (tenant, subscription, object, or group ID)'
|
||||
Regex = '\b[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\b'
|
||||
Exclude = $placeholderGuid
|
||||
# A PowerShell module manifest must carry a genuine, unique GUID as its
|
||||
# identity - it is what distinguishes this module from another of the same
|
||||
# name. It identifies the module, not a tenant, and cannot be replaced with a
|
||||
# placeholder without breaking module resolution.
|
||||
ExcludeLine = '^\s*GUID\s*='
|
||||
}
|
||||
@{
|
||||
Name = 'Email address or UPN'
|
||||
# Placeholders such as <USER>@<PRIMARY-DOMAIN> contain angle brackets and
|
||||
# are excluded by requiring word characters on both sides.
|
||||
Regex = '\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b'
|
||||
# Reserved, permanently unresolvable domains from RFC 2606 and RFC 6761.
|
||||
# These exist precisely so documentation and fixtures can use an address that
|
||||
# is guaranteed never to reach a real mailbox. Rejecting them would push
|
||||
# fixtures toward something that merely looks fake, which is worse: the
|
||||
# difference between "obviously synthetic" and "probably nobody's" is the
|
||||
# whole point of the reserved list.
|
||||
Exclude = '@(?:[A-Za-z0-9-]+\.)*(?:example\.(?:com|net|org)|invalid|test|localhost)$'
|
||||
}
|
||||
@{
|
||||
Name = 'onmicrosoft.com domain'
|
||||
Regex = '[A-Za-z0-9-]+\.onmicrosoft\.com'
|
||||
}
|
||||
@{
|
||||
Name = 'Bearer token or JWT'
|
||||
Regex = 'eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}'
|
||||
}
|
||||
@{
|
||||
Name = 'Assigned secret, password, or key literal'
|
||||
Regex = '(?i)\b(client_?secret|password|api_?key|access_?token)\b\s*[:=]\s*["\x27][^"\x27<][^"\x27]*["\x27]'
|
||||
}
|
||||
@{
|
||||
Name = 'PEM private key block'
|
||||
Regex = '-----BEGIN [A-Z ]*PRIVATE KEY-----'
|
||||
}
|
||||
)
|
||||
|
||||
Push-Location $Path
|
||||
try {
|
||||
# Tracked files AND untracked files that are not gitignored.
|
||||
#
|
||||
# Tracked-only would make this gate useless where it matters most: a leaked
|
||||
# identifier in a file that has not been committed yet is precisely the one worth
|
||||
# catching, and scanning only what is already in history means the scan passes
|
||||
# right up until the commit that makes it too late.
|
||||
#
|
||||
# --exclude-standard keeps gitignored build output and local scratch files out,
|
||||
# so the scan covers exactly what a commit would add.
|
||||
$files = git ls-files --cached --others --exclude-standard 2>$null | Sort-Object -Unique
|
||||
if (-not $files) {
|
||||
throw "Not a git repository or no files to scan under '$Path'."
|
||||
}
|
||||
|
||||
# This scanner necessarily contains the patterns it searches for.
|
||||
$selfName = 'tests/Test-Sanitization.ps1'
|
||||
|
||||
$findings = [System.Collections.Generic.List[object]]::new()
|
||||
|
||||
foreach ($file in $files) {
|
||||
if ($file -eq $selfName) { continue }
|
||||
if (-not (Test-Path $file -PathType Leaf)) { continue }
|
||||
|
||||
# Skip binaries.
|
||||
if ($file -match '\.(png|jpg|jpeg|gif|ico|pdf|zip|dll|exe|pfx|cer)$') { continue }
|
||||
|
||||
$lineNumber = 0
|
||||
foreach ($line in (Get-Content -LiteralPath $file -ErrorAction SilentlyContinue)) {
|
||||
$lineNumber++
|
||||
foreach ($pattern in $patterns) {
|
||||
# A line-level exemption is narrower than a file-level one on purpose:
|
||||
# exempting a whole file would let a real identifier land anywhere in
|
||||
# it, and the files that need an exemption at all are exactly the ones
|
||||
# worth keeping under scrutiny.
|
||||
if ($pattern.ExcludeLine -and $line -match $pattern.ExcludeLine) { continue }
|
||||
|
||||
foreach ($match in [regex]::Matches($line, $pattern.Regex)) {
|
||||
if ($pattern.Exclude -and $match.Value -match $pattern.Exclude) { continue }
|
||||
|
||||
$findings.Add([pscustomobject]@{
|
||||
File = $file
|
||||
Line = $lineNumber
|
||||
Pattern = $pattern.Name
|
||||
Match = $match.Value
|
||||
})
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
finally {
|
||||
Pop-Location
|
||||
}
|
||||
|
||||
if ($findings.Count -gt 0) {
|
||||
Write-Host "Sanitization scan FAILED - $($findings.Count) finding(s):" -ForegroundColor Red
|
||||
$findings | Format-Table -AutoSize | Out-String | Write-Host
|
||||
if ($PassThru) { return $findings }
|
||||
exit 1
|
||||
}
|
||||
|
||||
Write-Host 'Sanitization scan passed: no tenant data, credentials, or real identifiers found.' -ForegroundColor Green
|
||||
if ($PassThru) { return @() }
|
||||
exit 0
|
||||
Reference in New Issue
Block a user