tfmcp

use anyhow::Result; use chrono::{DateTime, Utc}; use serde::{Deserialize, Serialize}; use std::collections::HashMap; use std::env; use std::fs; use std::path::{Path, PathBuf}; /// Security policy configuration #[derive(Debug, Clone, Serialize, Deserialize)] pub struct SecurityPolicy { /// Whether dangerous operations (apply, destroy) are allowed pub allow_dangerous_operations: bool, /// Whether auto-approve is allowed for apply/destroy operations pub allow_auto_approve: bool, /// List of allowed Terraform commands pub allowed_commands: Vec<String>, /// List of blocked file patterns (e.g., production configs) pub blocked_file_patterns: Vec<String>, /// Maximum number of resources that can be managed pub max_resource_limit: Option<usize>, /// Required approval patterns for certain operations pub approval_patterns: HashMap<String, String>, /// Audit logging configuration pub audit_logging: AuditConfig, } /// Audit logging configuration #[derive(Debug, Clone, Serialize, Deserialize)] pub struct AuditConfig { /// Whether audit logging is enabled pub enabled: bool, /// Path to audit log file pub log_file: Option<PathBuf>, /// Whether to log sensitive information (state files, etc.) pub log_sensitive: bool, } /// Audit log entry #[derive(Debug, Serialize, Deserialize)] pub struct AuditLogEntry { pub timestamp: DateTime<Utc>, pub user: String, pub operation: String, pub directory: String, pub command: Vec<String>, pub success: bool, pub error: Option<String>, pub resource_count: Option<usize>, } /// Security manager for tfmcp operations pub struct SecurityManager { pub policy: SecurityPolicy, pub audit_log: Option<PathBuf>, } impl Default for SecurityPolicy { fn default() -> Self { Self { allow_dangerous_operations: false, allow_auto_approve: false, allowed_commands: vec![ "version".to_string(), "init".to_string(), "validate".to_string(), "plan".to_string(), "show".to_string(), "state".to_string(), ], blocked_file_patterns: vec![ "**/prod*/**".to_string(), "**/production*/**".to_string(), "**/*prod*.tf".to_string(), "**/*production*.tf".to_string(), "**/*secret*".to_string(), ], max_resource_limit: Some(50), approval_patterns: HashMap::new(), audit_logging: AuditConfig { enabled: true, log_file: None, log_sensitive: false, }, } } } impl SecurityManager { pub fn new() -> Result<Self> { let policy = Self::load_security_policy()?; let audit_log = if policy.audit_logging.enabled { policy .audit_logging .log_file .clone() .or_else(|| dirs::home_dir().map(|d| d.join(".tfmcp").join("audit.log"))) } else { None }; Ok(Self { policy, audit_log }) } /// Load security policy from environment variables and config files fn load_security_policy() -> Result<SecurityPolicy> { let mut policy = SecurityPolicy::default(); // Check environment variables for security settings if let Ok(val) = env::var("TFMCP_ALLOW_DANGEROUS_OPS") { policy.allow_dangerous_operations = val.to_lowercase() == "true"; } if let Ok(val) = env::var("TFMCP_ALLOW_AUTO_APPROVE") { policy.allow_auto_approve = val.to_lowercase() == "true"; } if let Ok(val) = env::var("TFMCP_MAX_RESOURCES") { if let Ok(limit) = val.parse::<usize>() { policy.max_resource_limit = Some(limit); } } if let Ok(val) = env::var("TFMCP_AUDIT_ENABLED") { policy.audit_logging.enabled = val.to_lowercase() == "true"; } if let Ok(val) = env::var("TFMCP_AUDIT_LOG_SENSITIVE") { policy.audit_logging.log_sensitive = val.to_lowercase() == "true"; } if let Ok(path) = env::var("TFMCP_AUDIT_LOG_FILE") { policy.audit_logging.log_file = Some(PathBuf::from(path)); } // Load additional security policy from config file if exists if let Some(home) = dirs::home_dir() { let config_path = home.join(".tfmcp").join("security.json"); if config_path.exists() { if let Ok(content) = fs::read_to_string(&config_path) { if let Ok(file_policy) = serde_json::from_str::<SecurityPolicy>(&content) { // Merge with environment-based policy policy = file_policy; // Re-apply environment overrides if let Ok(val) = env::var("TFMCP_ALLOW_DANGEROUS_OPS") { policy.allow_dangerous_operations = val.to_lowercase() == "true"; } } } } } Ok(policy) } /// Check if a Terraform command is allowed pub fn is_command_allowed(&self, command: &str) -> bool { // Special handling for dangerous operations match command { "apply" | "destroy" => self.policy.allow_dangerous_operations, _ => self.policy.allowed_commands.contains(&command.to_string()), } } /// Check if auto-approve is allowed for the given command pub fn is_auto_approve_allowed(&self, command: &str) -> bool { match command { "apply" | "destroy" => { self.policy.allow_dangerous_operations && self.policy.allow_auto_approve } _ => true, // Auto-approve is always allowed for safe commands } } /// Check if a file path is blocked by security policy pub fn is_file_blocked(&self, file_path: &Path) -> bool { let path_str = file_path.to_string_lossy().to_lowercase(); for pattern in &self.policy.blocked_file_patterns { let pattern_lower = pattern.to_lowercase(); // Handle different glob patterns if pattern_lower.contains("**") { // Pattern like "**/prod*/**" or "**/*prod*.tf" let pattern_parts: Vec<&str> = pattern_lower.split("**").collect(); if pattern_parts.len() == 3 { // Pattern: **/xxx/** let middle = pattern_parts[1]; // For patterns like "**/prod*/**", the middle part is "/prod*/" // We need to handle this properly if middle.starts_with('/') && middle.ends_with('/') { let inner = &middle[1..middle.len() - 1]; // Remove leading and trailing '/' if inner.contains('*') { // Handle wildcards in the middle part let inner_parts: Vec<&str> = inner.split('*').collect(); if inner_parts.len() == 2 { let prefix = inner_parts[0]; let suffix = inner_parts[1]; // Look for /prefix*suffix/ pattern in path for segment in path_str.split('/') { if segment.starts_with(prefix) && segment.ends_with(suffix) { return true; } } } } else { // Exact match for middle directory if path_str.contains(&format!("/{}/", inner)) { return true; } } } else if path_str.contains(middle) { return true; } } else if pattern_parts.len() == 2 { // Pattern: **/xxx or xxx/** let prefix = pattern_parts[0]; let suffix = pattern_parts[1]; if prefix.is_empty() && path_str.ends_with(suffix) { // Pattern: **/xxx return true; } else if suffix.is_empty() && path_str.contains(prefix) { // Pattern: xxx/** return true; } else if path_str.contains(prefix) && path_str.ends_with(suffix) { // Pattern: prefix**suffix return true; } } } else if pattern_lower.contains('*') { // Simple wildcard matching let parts: Vec<&str> = pattern_lower.split('*').collect(); let mut pos = 0; let mut matched = true; for (i, part) in parts.iter().enumerate() { if i == 0 && !part.is_empty() { // First part must match from the beginning if !path_str.starts_with(part) { matched = false; break; } pos = part.len(); } else if i == parts.len() - 1 && !part.is_empty() { // Last part must match at the end if !path_str.ends_with(part) { matched = false; break; } } else if !part.is_empty() { // Middle parts must be found in order if let Some(found_pos) = path_str[pos..].find(part) { pos += found_pos + part.len(); } else { matched = false; break; } } } if matched { return true; } } else if path_str.contains(&pattern_lower) { // Exact substring matching return true; } } false } /// Check if the number of resources exceeds the limit pub fn check_resource_limit(&self, resource_count: usize) -> Result<()> { if let Some(limit) = self.policy.max_resource_limit { if resource_count > limit { return Err(anyhow::anyhow!( "Operation blocked: Resource count ({}) exceeds security limit ({})", resource_count, limit )); } } Ok(()) } /// Log an audit entry pub fn log_audit_entry(&self, entry: AuditLogEntry) -> Result<()> { if !self.policy.audit_logging.enabled { return Ok(()); } if let Some(log_file) = &self.audit_log { // Ensure the directory exists if let Some(parent) = log_file.parent() { fs::create_dir_all(parent)?; } let log_line = serde_json::to_string(&entry)?; use std::io::Write; let mut file = fs::OpenOptions::new() .create(true) .append(true) .open(log_file)?; file.write_all(format!("{}\n", log_line).as_bytes())?; } Ok(()) } /// Create an audit log entry for a Terraform operation pub fn create_audit_entry( &self, operation: &str, directory: &str, command: &[String], success: bool, error: Option<String>, resource_count: Option<usize>, ) -> AuditLogEntry { AuditLogEntry { timestamp: Utc::now(), user: env::var("USER") .or_else(|_| env::var("USERNAME")) .unwrap_or_else(|_| "unknown".to_string()), operation: operation.to_string(), directory: directory.to_string(), command: command.to_vec(), success, error, resource_count, } } /// Get current security policy (for reporting/debugging) #[allow(dead_code)] pub fn get_policy(&self) -> &SecurityPolicy { &self.policy } /// Validate a directory for security compliance pub fn validate_directory(&self, directory: &Path) -> Result<()> { if self.is_file_blocked(directory) { return Err(anyhow::anyhow!( "Directory access blocked by security policy: {}", directory.display() )); } // Check for sensitive files in the directory if directory.exists() && directory.is_dir() { for entry in fs::read_dir(directory)? { let entry = entry?; let path = entry.path(); if self.is_file_blocked(&path) { return Err(anyhow::anyhow!( "Directory contains blocked files: {}", path.display() )); } } } Ok(()) } } #[cfg(test)] mod tests { use super::*; #[test] fn test_default_security_policy() { let policy = SecurityPolicy::default(); assert!(!policy.allow_dangerous_operations); assert!(!policy.allow_auto_approve); assert!(policy.allowed_commands.contains(&"init".to_string())); assert!(!policy.allowed_commands.contains(&"apply".to_string())); } #[test] fn test_command_security() { let manager = SecurityManager { policy: SecurityPolicy::default(), audit_log: None, }; assert!(manager.is_command_allowed("init")); assert!(manager.is_command_allowed("plan")); assert!(!manager.is_command_allowed("apply")); assert!(!manager.is_command_allowed("destroy")); } #[test] fn test_file_blocking() { let manager = SecurityManager { policy: SecurityPolicy::default(), audit_log: None, }; let prod_file = PathBuf::from("/some/path/prod/main.tf"); let production_file = PathBuf::from("/some/path/production.tf"); let safe_file = PathBuf::from("/some/path/dev/main.tf"); assert!(manager.is_file_blocked(&prod_file)); assert!(manager.is_file_blocked(&production_file)); assert!(!manager.is_file_blocked(&safe_file)); } #[test] fn test_resource_limit() { let manager = SecurityManager { policy: SecurityPolicy { max_resource_limit: Some(10), ..SecurityPolicy::default() }, audit_log: None, }; assert!(manager.check_resource_limit(5).is_ok()); assert!(manager.check_resource_limit(15).is_err()); } #[test] fn test_audit_entry_creation() { let manager = SecurityManager { policy: SecurityPolicy::default(), audit_log: None, }; let entry = manager.create_audit_entry( "plan", "/test/dir", &["terraform".to_string(), "plan".to_string()], true, None, Some(5), ); assert_eq!(entry.operation, "plan"); assert_eq!(entry.directory, "/test/dir"); assert!(entry.success); assert_eq!(entry.resource_count, Some(5)); } }