ADR-013 Phase 2: enforcement + signed shelf + adopt (adversarial-review hardened)

shopdb/plugins/verification.py

@@ -0,0 +1,64 @@
+"""Plugin signature enforcement policy (ADR-013 Phase 2).
+
+One PluginVerifier is built per app from config and shared by the loader
+(verify-at-load) and the migration manager (verify-at-migrate). A plugin only
+loads or migrates when it verifies against a trusted key - so signing stops
+being advisory and becomes enforced everywhere plugin code executes.
+
+Default is OFF (PLUGIN_REQUIRE_SIGNED unset), so existing deploys are
+unchanged. A site opts into hardening by stamping its plugins
+(`flask plugin stamp-bundled`), pinning keys (PLUGIN_TRUSTED_KEYS), and setting
+PLUGIN_REQUIRE_SIGNED. Fail-closed: an unverifiable plugin does NOT run.
+"""
+
+import logging
+from pathlib import Path
+
+from . import signing, packaging
+
+logger = logging.getLogger(__name__)
+
+
+class PluginVerifier:
+    """Decides whether a plugin may load/migrate under the site's trust policy."""
+
+    def __init__(self, plugins_dir, require_signed=False, trusted_key_paths=None,
+                 dev_trust_dirs=None, is_dev=False):
+        self.plugins_dir = Path(plugins_dir)
+        self.require_signed = bool(require_signed)
+        self.is_dev = bool(is_dev)
+        # dev trust dirs only mean anything in dev/test (ADR-013); prod ignores.
+        self.dev_trust_dirs = [Path(p).resolve() for p in (dev_trust_dirs or [])]
+        self._keys = signing.load_trusted_keys(trusted_key_paths or [])
+
+    def _dev_exempt(self, plugin_dir: Path) -> bool:
+        # unsigned dev/external-repo plugins pass, but ONLY under DEBUG/TESTING
+        if not self.is_dev or not self.dev_trust_dirs:
+            return False
+        resolved = Path(plugin_dir).resolve()
+        for trusted in self.dev_trust_dirs:
+            try:
+                resolved.relative_to(trusted)
+                return True
+            except ValueError:
+                continue
+        return False
+
+    def check(self, plugin_name: str):
+        """(ok, reason). ok True = plugin may load/migrate."""
+        if not self.require_signed:
+            return True, 'enforcement off'
+
+        plugin_dir = self.plugins_dir / plugin_name
+        if self._dev_exempt(plugin_dir):
+            return True, 'dev-trusted'
+
+        if not self._keys:
+            # require-signed with nothing to verify against = refuse everything.
+            return False, ('PLUGIN_REQUIRE_SIGNED is set but no trusted keys '
+                           'are configured')
+
+        _, errors = packaging.verify_dir(plugin_dir, self._keys)
+        if errors:
+            return False, '; '.join(errors)
+        return True, 'verified'