rightkit-agent-engine-api-integrations 0.1.4

Agent engine integrations HTTP API: plugin discovery, manifest projection and plugin middleware wiring
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103

//! Per-plugin signature provenance records.

use serde::{Deserialize, Serialize};
use std::path::{Path, PathBuf};

#[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq)]
#[serde(rename_all = "lowercase")]
pub enum SignatureStatus {
    Signed,
    Unsigned,
    Unknown,
}

#[derive(Clone, Debug, Serialize, Deserialize)]
#[serde(rename_all = "camelCase")]
pub struct PluginSignatureRecord {
    pub status: SignatureStatus,
    #[serde(default)]
    pub signed_by: String,
    #[serde(default)]
    pub signing_public_key: String,
    #[serde(default)]
    pub signature: String,
    #[serde(default)]
    pub installed_at: String,
    #[serde(default)]
    pub install_source: String,
}

impl PluginSignatureRecord {
    pub fn signed(
        signed_by: String,
        signing_public_key: String,
        signature: String,
        install_source: String,
        now_iso: String,
    ) -> Self {
        Self {
            status: SignatureStatus::Signed,
            signed_by,
            signing_public_key,
            signature,
            installed_at: now_iso,
            install_source,
        }
    }

    pub fn unsigned(install_source: String, now_iso: String) -> Self {
        Self {
            status: SignatureStatus::Unsigned,
            signed_by: String::new(),
            signing_public_key: String::new(),
            signature: String::new(),
            installed_at: now_iso,
            install_source,
        }
    }
}

pub fn sidecar_path(plugin_install_dir: &Path) -> PathBuf {
    plugin_install_dir.join(".signature.json")
}

pub fn read_record(plugin_install_dir: &Path) -> PluginSignatureRecord {
    let path = sidecar_path(plugin_install_dir);
    match std::fs::read_to_string(&path) {
        Ok(raw) => serde_json::from_str(&raw).unwrap_or_else(|_| unknown_record()),
        Err(_) => unknown_record(),
    }
}

pub fn write_record(plugin_install_dir: &Path, record: &PluginSignatureRecord) {
    let path = sidecar_path(plugin_install_dir);
    match serde_json::to_string_pretty(record) {
        Ok(json) => {
            if let Err(error) = std::fs::write(&path, json) {
                eprintln!(
                    "[plugin-signature] failed to write provenance to {}: {error}",
                    path.display()
                );
            }
        }
        Err(error) => eprintln!("[plugin-signature] serialise record failed: {error}"),
    }
}

pub fn is_acceptable(record: &PluginSignatureRecord, policy_reject_unsigned: bool) -> bool {
    match record.status {
        SignatureStatus::Signed | SignatureStatus::Unknown => true,
        SignatureStatus::Unsigned => !policy_reject_unsigned,
    }
}

fn unknown_record() -> PluginSignatureRecord {
    PluginSignatureRecord {
        status: SignatureStatus::Unknown,
        signed_by: String::new(),
        signing_public_key: String::new(),
        signature: String::new(),
        installed_at: String::new(),
        install_source: String::new(),
    }
}