ADR-013 Phase 2: enforcement + signed shelf + adopt (adversarial-review hardened)

shopdb/plugins/migrations.py

@@ -18,6 +18,25 @@ class PluginMigrationManager:
     def __init__(self, plugins_dir: Path, database_url: str):
         self.plugins_dir = plugins_dir
         self.database_url = database_url
+        # Set by PluginManager.init_app; a PluginVerifier or None (no policy).
+        self.verifier = None
+
+    def _verify_ok(self, plugin_name: str) -> bool:
+        """Strip bytecode + verify the tree before ANY alembic import.
+
+        Alembic imports env.py and every versions/*.py module body (running
+        their top-level code) with full DB rights, so every method that reaches
+        alembic for a plugin must pass through here first (finding #3).
+        """
+        if self.verifier is None or not self.verifier.require_signed:
+            return True
+        from .packaging import strip_bytecode
+        strip_bytecode(self.plugins_dir / plugin_name)
+        ok, reason = self.verifier.check(plugin_name)
+        if not ok:
+            logger.error(
+                "Refusing plugin migration code for %s: %s", plugin_name, reason)
+        return ok
 
     def get_migrations_dir(self, plugin_name: str) -> Optional[Path]:
         """Get migrations directory for a plugin."""
@@ -36,6 +55,11 @@ class PluginMigrationManager:
 
         Uses flask db upgrade with the plugin's migrations directory.
         """
+        # verify-at-migrate: never run a plugin's migration code (full DB rights)
+        # from an unverified tree when the site enforces signing.
+        if not self._verify_ok(plugin_name):
+            return False
+
         migrations_dir = self.get_migrations_dir(plugin_name)
 
         if not migrations_dir:
@@ -46,6 +70,7 @@ class PluginMigrationManager:
             # Use alembic directly with plugin's migrations
             from alembic.config import Config
             from alembic import command
+            from .packaging import no_bytecode
 
             config = Config()
             config.set_main_option('script_location', str(migrations_dir))
@@ -57,7 +82,8 @@ class PluginMigrationManager:
                 f'alembic_version_{plugin_name}'
             )
 
-            command.upgrade(config, revision)
+            with no_bytecode():
+                command.upgrade(config, revision)
             logger.info(f"Migrations completed for {plugin_name}")
             return True
 
@@ -76,6 +102,9 @@ class PluginMigrationManager:
         revision: str = 'head'
     ) -> bool:
         """Run migrations via subprocess as fallback."""
+        if not self._verify_ok(plugin_name):
+            return False
+
         migrations_dir = self.get_migrations_dir(plugin_name)
         if not migrations_dir:
             return True
@@ -83,7 +112,7 @@ class PluginMigrationManager:
         try:
             result = subprocess.run(
                 [
-                    sys.executable, '-m', 'alembic',
+                    sys.executable, '-B', '-m', 'alembic',
                     '-c', str(migrations_dir / 'alembic.ini'),
                     'upgrade', revision
                 ],
@@ -91,7 +120,8 @@ class PluginMigrationManager:
                 text=True,
                 env={
                     **dict(__import__('os').environ),
-                    'DATABASE_URL': self.database_url
+                    'DATABASE_URL': self.database_url,
+                    'PYTHONDONTWRITEBYTECODE': '1',
                 }
             )
 
@@ -113,6 +143,11 @@ class PluginMigrationManager:
         """
         Downgrade/rollback plugin migrations.
         """
+        # Downgrade runs the same env.py + version module code as upgrade, so it
+        # gets the same fail-closed verification (finding #3: this path had none).
+        if not self._verify_ok(plugin_name):
+            return False
+
         migrations_dir = self.get_migrations_dir(plugin_name)
 
         if not migrations_dir:
@@ -121,6 +156,7 @@ class PluginMigrationManager:
         try:
             from alembic.config import Config
             from alembic import command
+            from .packaging import no_bytecode
 
             config = Config()
             config.set_main_option('script_location', str(migrations_dir))
@@ -130,7 +166,8 @@ class PluginMigrationManager:
                 f'alembic_version_{plugin_name}'
             )
 
-            command.downgrade(config, revision)
+            with no_bytecode():
+                command.downgrade(config, revision)
             logger.info(f"Downgrade completed for {plugin_name}")
             return True
 
@@ -139,7 +176,14 @@ class PluginMigrationManager:
             return False
 
     def get_current_revision(self, plugin_name: str) -> Optional[str]:
-        """Get current migration revision for a plugin."""
+        """Get current migration revision for a plugin.
+
+        ScriptDirectory imports every versions/*.py to build the revision map,
+        so this reads (executes) plugin code and must verify first (finding #3).
+        """
+        if not self._verify_ok(plugin_name):
+            return None
+
         migrations_dir = self.get_migrations_dir(plugin_name)
         if not migrations_dir:
             return None
@@ -147,12 +191,14 @@ class PluginMigrationManager:
         try:
             from alembic.config import Config
             from alembic.script import ScriptDirectory
+            from .packaging import no_bytecode
 
             config = Config()
             config.set_main_option('script_location', str(migrations_dir))
 
-            script = ScriptDirectory.from_config(config)
-            return script.get_current_head()
+            with no_bytecode():
+                script = ScriptDirectory.from_config(config)
+                return script.get_current_head()
 
         except Exception:
             return None