Revocation, sessions and recovery decisions

"""Offline worksheet for declared credential timing; no cloud authorization decisions.
Times are whole minutes on a fictional incident clock. Input claims are not verified.
"""
import copy
import hashlib
import itertools
import json
from pathlib import Path


def integer(value, name, minimum=0):
 if type(value) is not int or value < minimum:
 raise ValueError(name + ' must be an integer >= ' + str(minimum))
 return value


def label(value, name):
 if not isinstance(value, str) or not value.strip:
 raise ValueError(name + ' must be nonempty text')
 return value


def evaluate(snapshot):
 if not isinstance(snapshot, dict):
 raise ValueError('snapshot must be an object')
 principal = label(snapshot.get('principal'), 'principal')
 now = integer(snapshot.get('now'), 'now')
 stopped = snapshot.get('issuanceStoppedAt')
 maximum = snapshot.get('maximumLifetime')
 if stopped is not None:
 integer(stopped, 'issuanceStoppedAt')
 if stopped > now:
 raise ValueError('issuance stop cannot be in the future')
 if maximum is not None:
 integer(maximum, 'maximumLifetime', 1)
 complete = snapshot.get('inventoryComplete')
 if type(complete) is not bool:
 raise ValueError('inventoryComplete must be boolean')
 tokens = snapshot.get('tokens')
 if not isinstance(tokens, list):
 raise ValueError('tokens must be a list')
 ids = set
 selected = []
 ignored = []
 for token in tokens:
 if not isinstance(token, dict):
 raise ValueError('token must be an object')
 tid = label(token.get('id'), 'id')
 if tid in ids:
 raise ValueError('duplicate token id')
 ids.add(tid)
 owner = label(token.get('principal'), 'token principal')
 issued = integer(token.get('issuedAt'), 'issuedAt')
 expires = integer(token.get('expiresAt'), 'expiresAt')
 if issued > now or expires <= issued:
 raise ValueError('invalid token interval')
 (selected if owner == principal else ignored).append(token)
 contradictions = []
 for token in selected:
 if stopped is not None and token['issuedAt'] > stopped:
 contradictions.append(token['id'] + ':issued-after-declared-stop')
 if maximum is not None and token['expiresAt'] - token['issuedAt'] > maximum:
 contradictions.append(token['id'] + ':exceeds-declared-lifetime')
 # Issuance at the stop minute is included conservatively in the upper bound.
 horizon = stopped + maximum if stopped is not None and maximum is not None else None
 elapsed = None if horizon is None or contradictions else now >= horizon
 return {
 'principal': principal,
 'knownUnexpiredTokens': sorted(t['id'] for t in selected if now < t['expiresAt']),
 'ignoredOtherPrincipal': sorted(t['id'] for t in ignored),
 'declaredHorizon': horizon,
 'remainingUnderDeclaredBounds': None if horizon is None or contradictions else max(0, horizon - now),
 'elapsedUnderDeclaredBounds': elapsed,
 'contradictions': sorted(contradictions),
 'inventoryComplete': complete,
 'inventoryCoverageUnproven': not complete,
 'credentialValidityVerified': False,
 'actualAccessEvaluated': False,
 'productionRecoveryAuthorized': False,
 }


def evidence:
 base = {'principal': 'batch-A', 'now': 100, 'issuanceStoppedAt': 40,
 'maximumLifetime': 60, 'inventoryComplete': True,
 'tokens': [{'id': 't1', 'principal': 'batch-A', 'issuedAt': 39, 'expiresAt': 99}]}
 def variant(**changes):
 return dict(copy.deepcopy(base), **changes)
 samples = {
 'window-elapsed': variant,
 'still-waiting': variant(now=95),
 'unknown-lifetime': variant(maximumLifetime=None),
 'unknown-stop': variant(issuanceStoppedAt=None),
 'incomplete-inventory': variant(inventoryComplete=False),
 'issuance-contradiction': variant(tokens=[{'id': 'late', 'principal': 'batch-A', 'issuedAt': 45, 'expiresAt': 70}]),
 'lifetime-contradiction': variant(tokens=[{'id': 'long', 'principal': 'batch-A', 'issuedAt': 30, 'expiresAt': 110}]),
 'other-principal': variant(tokens=base['tokens'] + [{'id': 'other', 'principal': 'batch-B', 'issuedAt': 90, 'expiresAt': 200}]),
 'expiry-boundary': variant(tokens=[{'id': 'edge', 'principal': 'batch-A', 'issuedAt': 40, 'expiresAt': 100}]),
 'no-tokens-unknown-stop': variant(tokens=[], issuanceStoppedAt=None),
 'two-contradictions': variant(tokens=[{'id': 'conflict', 'principal': 'batch-A', 'issuedAt': 50, 'expiresAt': 150}]),
 }
 results = {name: evaluate(value) for name, value in samples.items}
 assert results['window-elapsed']['elapsedUnderDeclaredBounds'] is True
 assert results['still-waiting']['knownUnexpiredTokens'] == ['t1']
 assert results['still-waiting']['remainingUnderDeclaredBounds'] == 5
 assert results['unknown-lifetime']['declaredHorizon'] is None
 assert results['unknown-stop']['elapsedUnderDeclaredBounds'] is None
 assert results['incomplete-inventory']['inventoryCoverageUnproven'] is True
 assert results['incomplete-inventory']['elapsedUnderDeclaredBounds'] is True
 assert results['issuance-contradiction']['elapsedUnderDeclaredBounds'] is None
 assert results['lifetime-contradiction']['knownUnexpiredTokens'] == ['long']
 assert results['lifetime-contradiction']['remainingUnderDeclaredBounds'] is None
 assert results['other-principal']['ignoredOtherPrincipal'] == ['other']
 assert results['expiry-boundary']['knownUnexpiredTokens'] == []
 assert results['no-tokens-unknown-stop']['elapsedUnderDeclaredBounds'] is None
 assert len(results['two-contradictions']['contradictions']) == 2
 combos = 0
 for stopped, lifetime, now in itertools.product([None, 0, 20], [None, 30, 60], [60, 100, 130]):
 x = variant(tokens=[], issuanceStoppedAt=stopped, maximumLifetime=lifetime, now=now)
 before = copy.deepcopy(x)
 r = evaluate(x)
 assert x == before
 if stopped is None or lifetime is None:
 assert r['elapsedUnderDeclaredBounds'] is None
 elif stopped == 20 and lifetime == 60 and now == 60:
 assert r['elapsedUnderDeclaredBounds'] is False
 assert r['remainingUnderDeclaredBounds'] == 20
 else:
 assert r['elapsedUnderDeclaredBounds'] is True
 assert r['productionRecoveryAuthorized'] is False
 combos += 1
 tokens = [base['tokens'][0], {'id': 'late', 'principal': 'batch-A', 'issuedAt': 45, 'expiresAt': 70},
 {'id': 'other', 'principal': 'batch-B', 'issuedAt': 90, 'expiresAt': 200}]
 expected = evaluate(variant(tokens=tokens))
 permutations = 0
 for perm in itertools.permutations(tokens):
 x = variant(tokens=list(perm)); before = copy.deepcopy(x)
 assert evaluate(x) == expected
 assert x == before
 permutations += 1
 bad = [None, [], variant(principal=''), variant(now=True), variant(now=-1),
 variant(issuanceStoppedAt=101), variant(issuanceStoppedAt='40'),
 variant(maximumLifetime=0), variant(maximumLifetime=True),
 variant(inventoryComplete=1), variant(tokens=None), variant(tokens=[{}]),
 variant(tokens=[base['tokens'][0], base['tokens'][0]]),
 variant(tokens=[{'id':'x','principal':'batch-A','issuedAt':101,'expiresAt':130}]),
 variant(tokens=[{'id':'x','principal':'batch-A','issuedAt':30,'expiresAt':30}]),
 variant(tokens=[{'id':'x','principal':'','issuedAt':30,'expiresAt':50}]),
 variant(tokens=[{'id':'x','principal':'batch-A','issuedAt':30,'expiresAt':True}])]
 for x in bad:
 try:
 evaluate(x)
 except ValueError:
 pass
 else:
 raise AssertionError('invalid input accepted')
 return {'scriptSha256': hashlib.sha256(Path(__file__).read_bytes).hexdigest,
 'fixtures': [{'id': name, **r} for name, r in results.items],
 'timingCombinations': combos, 'inputPermutations': permutations,
 'invalidInputs': len(bad), 'inputPreserved': True, 'orderIndependent': True,
 'network': False, 'cloudExecuted': False, 'persistentWrites': False,
 'scope': 'Fictional declared timing worksheet; no token parsing, signature verification, policy evaluation or real revocation.'}


if __name__ == '__main__':
 print(json.dumps(evidence, indent=2))

Related topics: Identities, credentials and access evidence · Operational security and release evidence · Governance, scope and control evidence

Reference: Respond to compromised Google Cloud credentials · Current linked guide; edition date unconfirmed (2026-09-30 inspection)