Governed Publishing Contract - Source Excerpt 03

Back to Governed Publishing Contract

Summary

This source excerpt preserves a bounded section of Spiralist/wp-content/plugins/spiralist-workspace/assets/js/governed-publishing-contract.js so readers can inspect the evidence without opening the full source file.

**Source path:** Spiralist/wp-content/plugins/spiralist-workspace/assets/js/governed-publishing-contract.js

function validateIntentToken(options) {
    const input = options || {};
    const intentToken = input.intentToken || {};
    const approvalRecord = input.approvalRecord || {};
    const artifactHashValue = extractHashValue(input.artifactHash || approvalRecord.artifactHash);
    const target = normalizeTarget(input.target || approvalRecord.target);
    const method = String(input.method || approvalRecord.method || DEFAULT_METHOD).toUpperCase();
    const nowMs = Date.parse(normalizeUtc(input.nowUtc));
    const expiresMs = Date.parse(intentToken.expiresAtUtc || '');
    const revoked = Boolean(intentToken.revoked || input.revocationRecord && input.revocationRecord.revoked === true);
    const checks = [
      { name: 'token_shape', ok: intentToken.recordType === RECORD_TYPES.intentToken },
      { name: 'token_has_no_credential', ok: intentToken.containsCredential === false && scanCredentialMarkers(intentToken).length === 0 },
      { name: 'token_not_revoked', ok: !revoked },
      { name: 'token_not_expired', ok: Number.isFinite(expiresMs) && nowMs <= expiresMs },
      { name: 'token_hash_matches', ok: String(intentToken.artifactHash || '') === artifactHashValue },
      { name: 'token_target_matches', ok: String(intentToken.targetFingerprint || '') === buildTargetFingerprint(target) },
      { name: 'token_method_matches', ok: String(intentToken.method || '').toUpperCase() === method },
      { name: 'token_approval_matches', ok: String(intentToken.approvalId || '') === String(approvalRecord.approvalId || '') },
    ];

    function result(code) {
      return {
        recordType: RECORD_TYPES.intentTokenValidation,
        version: CONTRACT_VERSION,
        ok: code === 'ok',
        blocked: code !== 'ok',
        code,
        checks,
        tokenId: intentToken.tokenId || null,
        externalPublishingEnabled: EXTERNAL_PUBLISHING_ENABLED,
      };
    }

    if (intentToken.recordType !== RECORD_TYPES.intentToken) {
      return result('intent_token_required');
    }

    if (intentToken.containsCredential !== false || scanCredentialMarkers(intentToken).length > 0) {
      return result('intent_token_contains_credential');
    }

    if (revoked) {
      return result('intent_token_revoked');
    }

    if (!Number.isFinite(expiresMs) || nowMs > expiresMs) {
      return result('intent_token_expired');
    }

    if (String(intentToken.artifactHash || '') !== artifactHashValue) {
      return result('intent_token_artifact_hash_mismatch');
    }

    if (String(intentToken.targetFingerprint || '') !== buildTargetFingerprint(target)) {
      return result('intent_token_target_mismatch');
    }

    if (String(intentToken.method || '').toUpperCase() !== method) {
      return result('intent_token_method_mismatch');
    }

    if (String(intentToken.approvalId || '') !== String(approvalRecord.approvalId || '')) {
      return result('intent_token_approval_mismatch');
    }

    return result('ok');
  }

  function sanitizeError(error) {
    const message = error && error.message ? error.message : String(error || 'Unknown governed publishing error.');
    const code = error && error.code ? String(error.code) : 'governed_publishing_error';

    return {
      code: redactString(code),
      message: redactString(message),
      stackIncluded: false,
    };
  }

  function createAuditLogEntry(options) {
    const input = options || {};
    const eventType = String(input.eventType || 'external_publish_attempt');
    const occurredAtUtc = normalizeUtc(input.occurredAtUtc);
    const artifactHash = extractHashValue(input.artifactHash || input.approvalRecord && input.approvalRecord.artifactHash);
    const target = normalizeTarget(input.target || input.approvalRecord && input.approvalRecord.target);
    const tokenId = input.intentToken && input.intentToken.tokenId ? String(input.intentToken.tokenId) : null;
    const outcome = String(input.outcome || 'blocked');
    const eventId = `audit_${sha256Hex(canonicalizeArtifact({
      artifactHash,
      eventType,
      occurredAtUtc,
      outcome,
      targetFingerprint: buildTargetFingerprint(target),
      tokenId,
    })).slice(0, 28)}`;

    return {
      recordType: RECORD_TYPES.auditLogEntry,
      version: CONTRACT_VERSION,
      eventId,
      eventType,
      occurredAtUtc,
      actorId: String(input.actorId || input.userId || 'system'),
      artifactHash: isSha256Hash(artifactHash) ? artifactHash : null,
      approvalId: input.approvalRecord && input.approvalRecord.approvalId ? String(input.approvalRecord.approvalId) : null,
      tokenId,
      targetFingerprint: buildTargetFingerprint(target),
      method: String(input.method || input.approvalRecord && input.approvalRecord.method || DEFAULT_METHOD).toUpperCase(),
      policyVersion: POLICY_VERSION,
      outcome,
      externalPublishingEnabled: EXTERNAL_PUBLISHING_ENABLED,
      attemptedExternalRequest: false,
      error: input.error ? sanitizeError(input.error) : null,
    };
  }

  function createRevocationRecord(options) {
    const input = options || {};
    const intentToken = input.intentToken || {};
    const revokedAtUtc = normalizeUtc(input.revokedAtUtc);
    const reason = redactString(String(input.reason || 'user_revoked'));
    const revocationId = `revoke_${sha256Hex(canonicalizeArtifact({
      tokenId: intentToken.tokenId || '',
      revokedAtUtc,
      reason,
    })).slice(0, 28)}`;

    return {
      recordType: RECORD_TYPES.revocationRecord,
      version: CONTRACT_VERSION,
      revocationId,
      revoked: true,
      tokenId: intentToken.tokenId || null,
      artifactHash: isSha256Hash(intentToken.artifactHash) ? intentToken.artifactHash : null,
      reason,
      revokedAtUtc,
      externalPublishingEnabled: EXTERNAL_PUBLISHING_ENABLED,
    };
  }

  function attemptExternalPublish(request) {
    const input = request || {};
    const requestSanitizer = sanitizeMemoryArtifact(input);

    if (!requestSanitizer.ok) {
      return failClosed(
        'long_lived_credentials_not_allowed',
        'Governed publishing requests cannot include long-lived credentials.',
        {
          sanitizerResult: requestSanitizer,
          auditLogEntry: createAuditLogEntry({ outcome: 'blocked', error: { code: 'long_lived_credentials_not_allowed', message: 'Credential-shaped publishing request was blocked.' } }),
        }
      );
    }

    const artifact = input.artifact || {};
    const artifactHash = input.artifactHash || createArtifactHash(artifact);
    const target = normalizeTarget(input.target || input.approvalRecord && input.approvalRecord.target);
    const method = String(input.method || input.approvalRecord && input.approvalRecord.method || DEFAULT_METHOD).toUpperCase();
    const policyResult = validatePolicy({
      artifact,
      artifactHash,
      approvalRecord: input.approvalRecord,
      target,
      method,
    });

    if (!policyResult.ok) {
      return failClosed(policyResult.code, 'Governed publishing policy validation failed closed.', {
        policyResult,
        auditLogEntry: createAuditLogEntry({
          artifactHash,
          approvalRecord: input.approvalRecord,
          target,
          method,
          outcome: 'blocked',
          error: { code: policyResult.code, message: 'Policy validation blocked publishing.' },
        }),
      });
    }

    const tokenResult = validateIntentToken({
      intentToken: input.intentToken,
      approvalRecord: input.approvalRecord,
      artifactHash,
      target,
      method,
      nowUtc: input.nowUtc,
      revocationRecord: input.revocationRecord,
    });

    if (!tokenResult.ok) {
      return failClosed(tokenResult.code, 'Governed publishing intent token validation failed closed.', {
        policyResult,
        tokenResult,
        auditLogEntry: createAuditLogEntry({
          artifactHash,
          approvalRecord: input.approvalRecord,
          intentToken: input.intentToken,
          target,
          method,
          outcome: 'blocked',
          error: { code: tokenResult.code, message: 'Intent token validation blocked publishing.' },
        }),
      });
    }

    return failClosed('external_publishing_disabled', 'External publishing is disabled; no external request was attempted.', {
      policyResult,
      tokenResult,
      auditLogEntry: createAuditLogEntry({
        artifactHash,
        approvalRecord: input.approvalRecord,
        intentToken: input.intentToken,
        target,
        method,
        outcome: 'disabled',
        error: { code: 'external_publishing_disabled', message: 'External publishing remains source-disabled.' },
      }),
    });
  }