Initial curated ITWorx_MCP_Hub source from 368fba691ea8d23403b4d56b53b5ec670d7c5020

packages/hub_runtime/secret_files.py

@@ -0,0 +1,94 @@
+"""Fail-closed secret-file access without value projection or logging."""
+
+from __future__ import annotations
+
+import os
+import stat
+from pathlib import Path
+
+
+class SecretFileError(RuntimeError):
+    """Stable non-secret error raised for an invalid runtime secret file."""
+
+
+def validate_secret_file(
+    path: Path,
+    *,
+    root: Path = Path("/run/secrets"),
+    expected_uid: int | None = None,
+    expected_gid: int | None = None,
+    max_bytes: int = 8192,
+) -> bytes:
+    """Return bounded bytes only after containment, mode, owner, and content checks."""
+
+    try:
+        resolved_root = root.resolve(strict=True)
+        resolved = path.resolve(strict=True)
+        resolved.relative_to(resolved_root)
+        metadata = resolved.stat()
+    except (OSError, ValueError) as exc:
+        raise SecretFileError("required secret file is unavailable") from exc
+    if not stat.S_ISREG(metadata.st_mode):
+        raise SecretFileError("required secret path is not a regular file")
+    mode = stat.S_IMODE(metadata.st_mode)
+    if os.name != "nt" and (mode & 0o077 or mode & 0o111 or not mode & 0o400):
+        raise SecretFileError("required secret file permissions are unsafe")
+    if expected_uid is not None and metadata.st_uid != expected_uid:
+        raise SecretFileError("required secret file owner is invalid")
+    if expected_gid is not None and metadata.st_gid != expected_gid:
+        raise SecretFileError("required secret file group is invalid")
+    try:
+        payload = resolved.read_bytes()
+    except OSError as exc:
+        raise SecretFileError("required secret file is unreadable") from exc
+    payload = payload.rstrip(b"\r\n")
+    if (
+        not payload
+        or len(payload) > max_bytes
+        or b"\x00" in payload
+        or b"\r" in payload.rstrip(b"\r\n")
+        or b"\n" in payload.rstrip(b"\r\n")
+    ):
+        raise SecretFileError("required secret file content is invalid")
+    return payload
+
+
+def read_secret_file(
+    path: Path,
+    *,
+    root: Path = Path("/run/secrets"),
+    expected_uid: int | None = None,
+    expected_gid: int | None = None,
+    max_bytes: int = 8192,
+) -> str:
+    """Read a UTF-8 secret at its internal consumption boundary."""
+
+    payload = validate_secret_file(
+        path,
+        root=root,
+        expected_uid=expected_uid,
+        expected_gid=expected_gid,
+        max_bytes=max_bytes,
+    )
+    try:
+        return payload.decode("utf-8")
+    except UnicodeDecodeError as exc:
+        raise SecretFileError("required secret file encoding is invalid") from exc
+
+
+def validate_required_secret_paths(raw: str) -> None:
+    """Validate a comma-separated production startup contract without returning values."""
+
+    if not raw.strip():
+        return
+    expected_uid = (
+        int(os.environ["SECRET_EXPECTED_UID"]) if os.getenv("SECRET_EXPECTED_UID") else None
+    )
+    expected_gid = (
+        int(os.environ["SECRET_EXPECTED_GID"]) if os.getenv("SECRET_EXPECTED_GID") else None
+    )
+    for value in raw.split(","):
+        path = Path(value.strip())
+        if not path.is_absolute():
+            raise SecretFileError("required secret path must be absolute")
+        validate_secret_file(path, expected_uid=expected_uid, expected_gid=expected_gid)