Warden v3

backend/build.gradle

@@ -55,6 +55,10 @@ dependencies {
 }
 
 tasks.named('test') {
+    // Explicit database checks must exercise the current database, not cached results.
+    if (System.getenv('WARDEN_REVIEW_DB_TEST') == 'true' || System.getenv('WARDEN_REPAIR_TX_DB_TEST') == 'true') {
+        outputs.upToDateWhen { false }
+    }
     useJUnitPlatform()
 }
 

backend/src/main/java/net/modtale/config/db/ArtifactManifestStore.java

@@ -0,0 +1,8 @@
+package net.modtale.config.db;
+
+import java.util.Map;
+
+public interface ArtifactManifestStore {
+    String put(Map<String,String> entries);
+    Map<String,String> get(String identity);
+}

backend/src/main/java/net/modtale/config/db/MongoArtifactManifestStore.java

@@ -0,0 +1,40 @@
+package net.modtale.config.db;
+
+import com.mongodb.MongoWriteException;
+import net.modtale.model.project.SecurityManifest;
+import org.bson.Document;
+import org.springframework.data.mongodb.MongoDatabaseFactory;
+import org.springframework.data.mapping.MappingException;
+import java.util.*;
+
+/** Immutable, content-addressed records; raw driver access avoids recursive mapping conversions. */
+public final class MongoArtifactManifestStore implements ArtifactManifestStore {
+    public static final String COLLECTION = "artifact_manifests";
+    private final MongoDatabaseFactory database;
+    public MongoArtifactManifestStore(MongoDatabaseFactory database) { this.database = database; }
+    @Override public String put(Map<String,String> entries) {
+        if (!SecurityManifest.valid(entries, false)) throw new MappingException("Invalid artifact manifest");
+        var snapshot = Collections.unmodifiableMap(new TreeMap<>(entries));
+        String identity = SecurityManifest.identity(snapshot);
+        var values = new ArrayList<Document>();
+        snapshot.forEach((path, hash) -> values.add(new Document("path", path).append("sha256", hash)));
+        try {
+            database.getMongoDatabase().getCollection(COLLECTION).insertOne(new Document("_id", identity)
+                    .append("entries", values).append("createdAt", new Date()));
+        } catch (MongoWriteException duplicate) {
+            if (duplicate.getError().getCode() != 11000) throw duplicate;
+            get(identity); // An existing record must really contain the same immutable manifest.
+        }
+        return identity;
+    }
+    @Override public Map<String,String> get(String identity) {
+        if (!SecurityManifest.digest(identity)) throw new MappingException("Invalid artifact manifest reference");
+        Document document = database.getMongoDatabase().getCollection(COLLECTION).find(new Document("_id", identity)).first();
+        if (document == null) throw new MappingException("Artifact manifest is unavailable");
+        var evidence = new SecurityEvidenceConverters.Read().convert(new Document("entryHashes", document.get("entries")));
+        var entries = evidence.entryHashes();
+        if (!SecurityManifest.valid(entries, false) || !identity.equals(SecurityManifest.identity(entries)))
+            throw new MappingException("Artifact manifest integrity check failed");
+        return Collections.unmodifiableMap(new TreeMap<>(entries));
+    }
+}

backend/src/main/java/net/modtale/config/db/MongoConfig.java

@@ -12,8 +12,19 @@
 public class MongoConfig {
 
     @Bean
+    public ArtifactManifestStore artifactManifestStore(org.springframework.data.mongodb.MongoDatabaseFactory database) {
+        return new MongoArtifactManifestStore(database);
+    }
+
+    @Bean
+    public MongoCustomConversions mongoCustomConversions(ArtifactManifestStore store) {
+        return new MongoCustomConversions(List.of(new StringToOAuthProviderConverter(),
+                new SecurityEvidenceConverters.Write(store), new SecurityEvidenceConverters.Read(store)));
+    }
+
     public MongoCustomConversions mongoCustomConversions() {
-        return new MongoCustomConversions(List.of(new StringToOAuthProviderConverter()));
+        return new MongoCustomConversions(List.of(new StringToOAuthProviderConverter(),
+                new SecurityEvidenceConverters.Write(), new SecurityEvidenceConverters.Read()));
     }
 
     @ReadingConverter

backend/src/main/java/net/modtale/config/db/ReferencedArtifactManifest.java

@@ -0,0 +1,31 @@
+package net.modtale.config.db;
+
+import net.modtale.model.project.SecurityManifest;
+import java.util.*;
+
+/** Existing Map-based consumers still inspect real verified entries before granting clearance. */
+final class ReferencedArtifactManifest extends AbstractMap<String,String> {
+    final ArtifactManifestStore store;
+    final String identity;
+    private volatile Map<String,String> loaded;
+    ReferencedArtifactManifest(ArtifactManifestStore store, String identity) {
+        if (store == null || !SecurityManifest.digest(identity)) throw new IllegalArgumentException("Invalid artifact manifest reference");
+        this.store = store; this.identity = identity;
+    }
+    private Map<String,String> load() {
+        var snapshot = loaded;
+        if (snapshot != null) return snapshot;
+        synchronized (this) {
+            if (loaded == null) {
+                try {
+                    var entries = store.get(identity);
+                    if (!SecurityManifest.valid(entries, false) || !identity.equals(SecurityManifest.identity(entries)))
+                        throw new IllegalStateException("Artifact manifest integrity check failed");
+                    loaded = Collections.unmodifiableMap(new TreeMap<>(entries));
+                } catch (RuntimeException unavailable) { throw new SecurityManifest.Unavailable(unavailable); }
+            }
+            return loaded;
+        }
+    }
+    @Override public Set<Entry<String,String>> entrySet() { return load().entrySet(); }
+}

backend/src/main/java/net/modtale/config/db/SecurityEvidenceConverters.java

@@ -0,0 +1,78 @@
+package net.modtale.config.db;
+
+import java.util.*;
+import net.modtale.model.project.ScanResult.SecurityEvidence;
+import net.modtale.model.project.SecurityManifest;
+import org.bson.Document;
+import org.springframework.core.convert.converter.Converter;
+import org.springframework.data.convert.ReadingConverter;
+import org.springframework.data.convert.WritingConverter;
+import org.springframework.data.mapping.MappingException;
+
+public final class SecurityEvidenceConverters {
+    private SecurityEvidenceConverters() {}
+
+    @WritingConverter
+    public static final class Write implements Converter<SecurityEvidence, Document> {
+        private final ArtifactManifestStore store;
+        public Write() { this(null); }
+        public Write(ArtifactManifestStore store) { this.store = store; }
+        @Override public Document convert(SecurityEvidence evidence) {
+            if (store != null && evidence.entryHashes() instanceof ReferencedArtifactManifest reference && reference.store == store)
+                return header(evidence).append("manifestRef", reference.identity);
+            if (!SecurityManifest.valid(evidence.entryHashes(), true)) throw new MappingException("Invalid or oversized security manifest");
+            if (store != null && evidence.entryHashes() != null && !evidence.entryHashes().isEmpty())
+                return header(evidence).append("manifestRef", store.put(evidence.entryHashes()));
+            var entries = new ArrayList<Document>();
+            if (evidence.entryHashes() != null) evidence.entryHashes().forEach((path, hash) ->
+                    entries.add(new Document("path", path).append("sha256", hash)));
+            return header(evidence).append("entryHashes", entries);
+        }
+        private Document header(SecurityEvidence evidence) {
+            return new Document("policyVersion", evidence.policyVersion())
+                    .append("artifactSha256", evidence.artifactSha256())
+                    .append("contentSha256", evidence.contentSha256())
+                    .append("complete", evidence.complete())
+                    .append("clearanceGranted", evidence.clearanceGranted())
+                    .append("reviewState", evidence.reviewState());
+        }
+    }
+
+    @ReadingConverter
+    public static final class Read implements Converter<Document, SecurityEvidence> {
+        private final ArtifactManifestStore store;
+        public Read() { this(null); }
+        public Read(ArtifactManifestStore store) { this.store = store; }
+        @Override public SecurityEvidence convert(Document source) {
+            if (source.containsKey("manifestRef")) {
+                if (source.containsKey("entryHashes") || store == null || !(source.get("manifestRef") instanceof String identity)
+                        || !SecurityManifest.digest(identity)) throw new MappingException("Invalid artifact manifest reference");
+                return evidence(source, new ReferencedArtifactManifest(store, identity));
+            }
+            var entries = new LinkedHashMap<String, String>();
+            Object stored = source.get("entryHashes");
+            if (stored instanceof List<?> list) {
+                if (list.size() > 20_000) throw new MappingException("Security manifest exceeds entry limit");
+                for (Object value : list) {
+                    if (!(value instanceof Document entry) || !(entry.get("path") instanceof String path)
+                            || !(entry.get("sha256") instanceof String hash) || entries.putIfAbsent(path, hash) != null)
+                        throw new MappingException("Invalid security manifest entry");
+                }
+            } else if (stored instanceof Map<?, ?> map) {
+                if (map.size() > 20_000) throw new MappingException("Security manifest exceeds entry limit");
+                for (var entry : map.entrySet()) {
+                    if (!(entry.getKey() instanceof String path) || !(entry.getValue() instanceof String hash))
+                        throw new MappingException("Invalid legacy security manifest entry");
+                    entries.put(path, hash);
+                }
+            } else if (stored != null) throw new MappingException("Invalid security manifest");
+            if (!SecurityManifest.valid(entries, true)) throw new MappingException("Invalid or oversized security manifest");
+            return evidence(source, entries);
+        }
+        private SecurityEvidence evidence(Document source, Map<String,String> entries) {
+            return new SecurityEvidence(source.getString("policyVersion"), source.getString("artifactSha256"),
+                    source.getString("contentSha256"), Boolean.TRUE.equals(source.get("complete")),
+                    Boolean.TRUE.equals(source.get("clearanceGranted")), source.getString("reviewState"), entries);
+        }
+    }
+}

backend/src/main/java/net/modtale/config/properties/AppReviewRepairProperties.java

@@ -0,0 +1,32 @@
+package net.modtale.config.properties;
+
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.boot.context.properties.bind.DefaultValue;
+import java.util.*;
+
+@ConfigurationProperties(prefix="app.warden.repair")
+public record AppReviewRepairProperties(@DefaultValue("false") boolean enabled,@DefaultValue("") String activeKey,
+        Map<String,String> signingKeys,@DefaultValue("1") int concurrency,@DefaultValue("300000") long preparationLifetimeMillis) {
+    public AppReviewRepairProperties {
+        signingKeys=signingKeys==null?Map.of():Map.copyOf(signingKeys);
+        if(enabled) {
+            if(concurrency<1 || concurrency>2 || preparationLifetimeMillis<1000 || preparationLifetimeMillis>900000
+                    || activeKey==null || !signingKeys.containsKey(activeKey) || signingKeys.isEmpty() || signingKeys.size()>8)throw invalid();
+            decode(signingKeys);
+        }
+    }
+    public Map<String,byte[]> decodedKeys(){if(!enabled)throw invalid();return decode(signingKeys);}
+    private static Map<String,byte[]> decode(Map<String,String> keys) {
+        var decoded=new HashMap<String,byte[]>();
+        keys.forEach((id,value)->{
+            try {
+                if(id==null || !id.matches("[A-Za-z0-9_-]{1,64}") || value==null || value.length()>172)throw invalid();
+                byte[] key=Base64.getDecoder().decode(value);
+                if(key.length<32 || key.length>128 || !Base64.getEncoder().encodeToString(key).equals(value))throw invalid();
+                decoded.put(id,key);
+            } catch(IllegalArgumentException invalid){throw invalid();}
+        });return Map.copyOf(decoded);
+    }
+    private static IllegalArgumentException invalid(){return new IllegalArgumentException("Invalid review repair settings");}
+    @Override public String toString(){return "ReviewRepairSettings[enabled="+enabled+"]";}
+}

backend/src/main/java/net/modtale/config/properties/AppWardenProperties.java

@@ -8,7 +8,7 @@ public record AppWardenProperties(
         @DefaultValue("http://localhost:8081") String url,
         @DefaultValue("") String apiKey,
         @DefaultValue("true") boolean enabled,
-        @DefaultValue("3") int maxAttempts,
-        @DefaultValue("75") long requestTimeoutSeconds
+        @DefaultValue("1") int maxAttempts,
+        @DefaultValue("600") long requestTimeoutSeconds
 ) {
 }