dpcs 0.11.0

Reference implementation of the Data Pipeline Contract Standard (DPCS)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128

//! Security metadata validation (SPEC Ch 24).

use crate::diagnostics::{categories, Diagnostic, ValidationReport};
use crate::model::{PipelineContract, SecurityMetadata};

/// Validate security metadata when present.
pub fn validate(contract: &PipelineContract) -> ValidationReport {
    let mut report = ValidationReport::new();
    if let Some(security) = &contract.security {
        report.extend(validate_security(security));
    }
    report
}

/// Validate a [`SecurityMetadata`] block.
pub fn validate_security(security: &SecurityMetadata) -> ValidationReport {
    let mut report = ValidationReport::new();

    for (index, secret) in security.secret_refs.iter().enumerate() {
        let object_ref = format!("security.secretRefs[{index}]");
        if secret.id.trim().is_empty() {
            report.push(
                Diagnostic::error(
                    "DPCS-SEC-001",
                    categories::SECURITY,
                    "secret reference id must not be empty",
                )
                .with_object_ref(format!("{object_ref}.id")),
            );
        }
        if secret.loc.trim().is_empty() {
            report.push(
                Diagnostic::error(
                    "DPCS-SEC-002",
                    categories::SECURITY,
                    "secret reference loc must not be empty",
                )
                .with_object_ref(format!("{object_ref}.loc"))
                .with_remediation("Point loc at an external secret manager reference"),
            );
        }
        // Reject obviously embedded secret material in loc.
        if looks_like_embedded_secret(&secret.loc) {
            report.push(
                Diagnostic::error(
                    "DPCS-SEC-003",
                    categories::SECURITY,
                    "secret reference loc must not embed secret material",
                )
                .with_object_ref(format!("{object_ref}.loc"))
                .with_remediation(
                    "Use an external reference (URI or vault path), not a password or token value",
                ),
            );
        }
        for (key, value) in &secret.extensions {
            if key_suggests_secret(key) {
                if let Some(text) = value.as_str() {
                    if looks_like_embedded_secret(text) {
                        report.push(
                            Diagnostic::error(
                                "DPCS-SEC-003",
                                categories::SECURITY,
                                format!(
                                    "secret reference must not embed secret material in `{key}`"
                                ),
                            )
                            .with_object_ref(format!("{object_ref}.{key}")),
                        );
                    }
                }
            }
        }
    }

    for (index, integrity) in security.integrity_refs.iter().enumerate() {
        let object_ref = format!("security.integrityRefs[{index}]");
        if integrity.kind.trim().is_empty() {
            report.push(
                Diagnostic::error(
                    "DPCS-SEC-004",
                    categories::SECURITY,
                    "integrity reference kind must not be empty",
                )
                .with_object_ref(format!("{object_ref}.kind")),
            );
        }
        if integrity.value.trim().is_empty() {
            report.push(
                Diagnostic::error(
                    "DPCS-SEC-005",
                    categories::SECURITY,
                    "integrity reference value must not be empty",
                )
                .with_object_ref(format!("{object_ref}.value")),
            );
        }
    }

    report
}

fn key_suggests_secret(key: &str) -> bool {
    let key = key.to_ascii_lowercase();
    key.contains("password")
        || key.contains("secret")
        || key.contains("token")
        || key.contains("apikey")
        || key.contains("api_key")
        || key == "key"
}

fn looks_like_embedded_secret(value: &str) -> bool {
    let value = value.trim();
    if value.is_empty() {
        return false;
    }
    // External refs typically look like URIs or paths with separators.
    if value.contains("://") || value.starts_with("vault:") || value.starts_with('/') {
        return false;
    }
    // Bare high-entropy-looking tokens without path structure.
    if value.len() >= 16 && !value.contains('/') && !value.contains(':') {
        return true;
    }
    value.to_ascii_lowercase().starts_with("password=")
        || value.to_ascii_lowercase().starts_with("token=")
}