54 lines
3.9 KiB
Markdown
54 lines
3.9 KiB
Markdown
<!--
|
|
©AngelaMos | 2026
|
|
04-CHALLENGES.md
|
|
-->
|
|
|
|
# Extension Challenges
|
|
|
|
Pick one and ship it as a PR.
|
|
|
|
## Beginner
|
|
|
|
### 1. Add a fifth rotator: PostgreSQL `ALTER USER`
|
|
A new file `src/cre/rotators/postgres_user.cr` that rotates a Postgres role's password directly via `ALTER USER ... PASSWORD ...`. Use the existing 4-step contract; verify by opening a fresh connection with the new password. Drop the file in - the macro registers it automatically. Add unit specs in `spec/unit/rotators/postgres_user_spec.cr`.
|
|
|
|
### 2. Slack notifier subscriber
|
|
Mirror `TelegramSubscriber` against Slack's `chat.postMessage`. Add chat ID allowlist, channel-id parameterization, and message formatting. Single new file in `src/cre/notifiers/`.
|
|
|
|
### 3. Add `notify_via :slack` to the Channel enum
|
|
Once you have a Slack notifier, add `Slack` to `Channel` in `src/cre/policy/policy.cr`, dispatch on it in the evaluator, and write a policy in `policies/` that uses it.
|
|
|
|
## Intermediate
|
|
|
|
### 4. Web dashboard via SSE
|
|
Add `src/cre/web/` with a Lucky/Kemal HTTP server that subscribes to the bus and pushes events as Server-Sent Events to an HTMX dashboard. Reuse `Tui::State` as the data model - it already has the right shape. The point of the bus + plugin architecture is that this is a *new subscriber*, not a rewrite.
|
|
|
|
### 5. ML-KEM hybrid wrap for KEK
|
|
Add `algorithm_id = 0x03` to envelope encryption: hybrid Curve25519 + ML-KEM-768 (Kyber) for the DEK wrap. Provides forward secrecy against future quantum-attack on captured ciphertexts. Note: ML-KEM is in OpenSSL 3.x; you may need to update LibCrypto FFI bindings.
|
|
|
|
### 6. OpenTimestamps anchoring
|
|
Anchor each `audit_batches` Merkle root to the Bitcoin blockchain via OpenTimestamps. Adds a fourth integrity layer: even if the entire DB and signing key are compromised, an offline auditor with a Bitcoin full node can verify when each batch existed. Update `src/cre/audit/batch_sealer.cr` to publish OTS proofs alongside Ed25519 signatures.
|
|
|
|
## Advanced
|
|
|
|
### 7. SPIFFE/SPIRE workload identity rotator
|
|
Add a rotator that *replaces* static credentials with SPIFFE SVIDs (X.509 + JWT). Demonstrates the post-2024 industry shift away from rotation entirely toward attestation-based ephemeral identity. Touch points: new client in `src/cre/spiffe/`, new rotator in `src/cre/rotators/spiffe.cr`, new credential kind in `src/cre/domain/credential.cr`.
|
|
|
|
### 8. Crash recovery state machine
|
|
Implement the recovery protocol described in the spec: on boot, scan `rotations` table for non-terminal states; for each, decide whether to rollback, retry, or mark `inconsistent`. The current orchestrator publishes events but doesn't recover from a daemon crash mid-rotation. Add `src/cre/engine/recovery.cr` with explicit state-machine semantics for each `(rotator_kind, last_step)` pair.
|
|
|
|
### 9. Multi-tenant support
|
|
Wire `tenant_id` through the schema (already reserved as a column placeholder), the AAD construction, the policy matchers (allow `c.tenant == "tenant-x"`), and the API surface. Postgres row-level security policies enforce isolation at the DB level. The biggest design decision: per-tenant KEKs vs shared KEK with per-tenant DEKs.
|
|
|
|
### 10. JIT credential broker
|
|
Replace the rotation contract entirely for some credential types: instead of rotating, *issue* a fresh ephemeral credential on each access (5-15 minute TTL). Requires a new `Broker` abstraction alongside `Rotator`, integration with AWS STS / GCP service account impersonation / Vault dynamic, and consumer-side token refresh logic in the example apps.
|
|
|
|
## Evaluation rubric (for self-review)
|
|
|
|
A great extension PR:
|
|
- Has unit tests in `spec/unit/<area>/` mirroring the source layout
|
|
- Has a focused commit message explaining the *why*, not just the *what*
|
|
- Doesn't break existing tests (`crystal spec spec/` should be green)
|
|
- Adds 1-3 file-level changes; if it touches more than 5 files, the abstraction is probably wrong
|
|
- Surfaces failure modes honestly (e.g., the JIT broker should clearly document the consumer-side complexity it shifts)
|