Cybersecurity-Projects/PROJECTS/intermediate/credential-rotation-enforcer/learn/04-CHALLENGES.md

54 lines
3.9 KiB
Markdown

<!--
©AngelaMos | 2026
04-CHALLENGES.md
-->
# Extension Challenges
Pick one and ship it as a PR.
## Beginner
### 1. Add a fifth rotator: PostgreSQL `ALTER USER`
A new file `src/cre/rotators/postgres_user.cr` that rotates a Postgres role's password directly via `ALTER USER ... PASSWORD ...`. Use the existing 4-step contract; verify by opening a fresh connection with the new password. Drop the file in - the macro registers it automatically. Add unit specs in `spec/unit/rotators/postgres_user_spec.cr`.
### 2. Slack notifier subscriber
Mirror `TelegramSubscriber` against Slack's `chat.postMessage`. Add chat ID allowlist, channel-id parameterization, and message formatting. Single new file in `src/cre/notifiers/`.
### 3. Add `notify_via :slack` to the Channel enum
Once you have a Slack notifier, add `Slack` to `Channel` in `src/cre/policy/policy.cr`, dispatch on it in the evaluator, and write a policy in `policies/` that uses it.
## Intermediate
### 4. Web dashboard via SSE
Add `src/cre/web/` with a Lucky/Kemal HTTP server that subscribes to the bus and pushes events as Server-Sent Events to an HTMX dashboard. Reuse `Tui::State` as the data model - it already has the right shape. The point of the bus + plugin architecture is that this is a *new subscriber*, not a rewrite.
### 5. ML-KEM hybrid wrap for KEK
Add `algorithm_id = 0x03` to envelope encryption: hybrid Curve25519 + ML-KEM-768 (Kyber) for the DEK wrap. Provides forward secrecy against future quantum-attack on captured ciphertexts. Note: ML-KEM is in OpenSSL 3.x; you may need to update LibCrypto FFI bindings.
### 6. OpenTimestamps anchoring
Anchor each `audit_batches` Merkle root to the Bitcoin blockchain via OpenTimestamps. Adds a fourth integrity layer: even if the entire DB and signing key are compromised, an offline auditor with a Bitcoin full node can verify when each batch existed. Update `src/cre/audit/batch_sealer.cr` to publish OTS proofs alongside Ed25519 signatures.
## Advanced
### 7. SPIFFE/SPIRE workload identity rotator
Add a rotator that *replaces* static credentials with SPIFFE SVIDs (X.509 + JWT). Demonstrates the post-2024 industry shift away from rotation entirely toward attestation-based ephemeral identity. Touch points: new client in `src/cre/spiffe/`, new rotator in `src/cre/rotators/spiffe.cr`, new credential kind in `src/cre/domain/credential.cr`.
### 8. Crash recovery state machine
Implement the recovery protocol described in the spec: on boot, scan `rotations` table for non-terminal states; for each, decide whether to rollback, retry, or mark `inconsistent`. The current orchestrator publishes events but doesn't recover from a daemon crash mid-rotation. Add `src/cre/engine/recovery.cr` with explicit state-machine semantics for each `(rotator_kind, last_step)` pair.
### 9. Multi-tenant support
Wire `tenant_id` through the schema (already reserved as a column placeholder), the AAD construction, the policy matchers (allow `c.tenant == "tenant-x"`), and the API surface. Postgres row-level security policies enforce isolation at the DB level. The biggest design decision: per-tenant KEKs vs shared KEK with per-tenant DEKs.
### 10. JIT credential broker
Replace the rotation contract entirely for some credential types: instead of rotating, *issue* a fresh ephemeral credential on each access (5-15 minute TTL). Requires a new `Broker` abstraction alongside `Rotator`, integration with AWS STS / GCP service account impersonation / Vault dynamic, and consumer-side token refresh logic in the example apps.
## Evaluation rubric (for self-review)
A great extension PR:
- Has unit tests in `spec/unit/<area>/` mirroring the source layout
- Has a focused commit message explaining the *why*, not just the *what*
- Doesn't break existing tests (`crystal spec spec/` should be green)
- Adds 1-3 file-level changes; if it touches more than 5 files, the abstraction is probably wrong
- Surfaces failure modes honestly (e.g., the JIT broker should clearly document the consumer-side complexity it shifts)