fd90b2acd1
Implements all 22 WS6 tasks completing Phase 3 Enterprise. Column-level encryption (AES-256-CBC, Vault-backed key) via EncryptionService applied to credentials.secret_hash, credentials.vault_path, webhook_subscriptions.vault_secret_path, and agent_did_keys.vault_key_path. Backward-compatible: isEncrypted() guard skips decryption for existing plaintext rows until next read-write cycle. Audit chain integrity (CC7.2): AuditRepository computes SHA-256 Merkle hash on every INSERT (hash = SHA-256(eventId+timestamp+action+outcome+agentId+orgId+prevHash)). AuditVerificationService walks the full chain verifying hash continuity. AuditChainVerificationJob runs hourly; sets agentidp_audit_chain_integrity Prometheus gauge to 1 (pass) or 0 (fail). TLS enforcement (CC6.7): TLSEnforcementMiddleware registered as first middleware in Express stack; 301 redirect on non-https X-Forwarded-Proto in production. SecretsRotationJob (CC9.2): hourly scan for credentials expiring within 7 days; increments agentidp_credentials_expiring_soon_total. ComplianceController + routes: GET /audit/verify (auth+audit:read scope, 30/min rate-limit); GET /compliance/controls (public, Cache-Control 60s). ComplianceStatusStore: module-level map updated by jobs, consumed by controller. Prometheus: 2 new metrics (agentidp_credentials_expiring_soon_total, agentidp_audit_chain_integrity); 6 alerting rules in alerts.yml. Compliance docs: soc2-controls-matrix.md, encryption-runbook.md, audit-log-runbook.md, incident-response.md, secrets-rotation.md. Tests: 557 unit tests passing (35 suites); 26 new tests (EncryptionService, AuditVerificationService); 19 compliance integration tests. TypeScript clean. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
37 lines
2.4 KiB
JSON
37 lines
2.4 KiB
JSON
{
|
|
"endpoint_permissions": {
|
|
"GET:/api/v1/agents": ["agents:read"],
|
|
"GET:/api/v1/agents/:id": ["agents:read"],
|
|
"POST:/api/v1/agents": ["agents:write"],
|
|
"PATCH:/api/v1/agents/:id": ["agents:write"],
|
|
"DELETE:/api/v1/agents/:id": ["agents:write"],
|
|
"GET:/api/v1/agents/:id/credentials": ["agents:read"],
|
|
"POST:/api/v1/agents/:id/credentials": ["agents:write"],
|
|
"POST:/api/v1/agents/:id/credentials/:credId/rotate": ["agents:write"],
|
|
"DELETE:/api/v1/agents/:id/credentials/:credId": ["agents:write"],
|
|
"POST:/api/v1/token/introspect": ["tokens:read"],
|
|
"POST:/api/v1/token/revoke": ["tokens:read"],
|
|
"GET:/api/v1/audit": ["audit:read"],
|
|
"GET:/api/v1/audit/:id": ["audit:read"],
|
|
"POST:/api/v1/organizations": ["admin:orgs"],
|
|
"GET:/api/v1/organizations": ["admin:orgs"],
|
|
"GET:/api/v1/organizations/:id": ["admin:orgs"],
|
|
"PATCH:/api/v1/organizations/:id": ["admin:orgs"],
|
|
"DELETE:/api/v1/organizations/:id": ["admin:orgs"],
|
|
"POST:/api/v1/organizations/:id/members": ["admin:orgs"],
|
|
"GET:/api/v1/agents/:agentId/did/resolve": ["agents:read"],
|
|
"POST:/api/v1/federation/trust": ["admin:orgs"],
|
|
"GET:/api/v1/federation/partners": ["admin:orgs"],
|
|
"GET:/api/v1/federation/partners/:id": ["admin:orgs"],
|
|
"PATCH:/api/v1/federation/partners/:id": ["admin:orgs"],
|
|
"DELETE:/api/v1/federation/partners/:id": ["admin:orgs"],
|
|
"POST:/api/v1/webhooks": ["webhooks:write"],
|
|
"GET:/api/v1/webhooks": ["webhooks:read"],
|
|
"GET:/api/v1/webhooks/:id": ["webhooks:read"],
|
|
"PATCH:/api/v1/webhooks/:id": ["webhooks:write"],
|
|
"DELETE:/api/v1/webhooks/:id": ["webhooks:write"],
|
|
"GET:/api/v1/webhooks/:id/deliveries": ["webhooks:read"],
|
|
"GET:/api/v1/audit/verify": ["audit:read"]
|
|
}
|
|
}
|