Merge pull request #78 from r33drichards/claude/audit-packages-disable-external-RMSXg

Add external module import policy enforcement via OPA

Author: r33drichards

.github/workflows/module-policy-integration.yml

@@ -0,0 +1,23 @@
+name: Module Policy Integration Test
+
+on:
+  pull_request:
+    paths:
+      - Dockerfile
+      - docker-compose.module-policy.yml
+      - policies/**
+      - tests/module-policy-integration.sh
+      - server/src/**
+
+jobs:
+  integration-test:
+    name: Module Policy Integration
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Run module policy integration tests
+        run: ./tests/module-policy-integration.sh

docker-compose.module-policy.yml

@@ -0,0 +1,42 @@
+# Docker Compose for module policy integration tests.
+#
+# Services:
+#   opa            – OPA server loaded with policies/
+#   mcp-default    – mcp-js with external modules DISABLED (default)
+#   mcp-opa-policy – mcp-js with --allow-external-modules + --opa-module-policy
+
+services:
+  opa:
+    image: openpolicyagent/opa:latest
+    command: ["run", "--server", "--addr", "0.0.0.0:8181", "/policies"]
+    ports:
+      - "8181:8181"
+    volumes:
+      - ./policies:/policies:ro
+
+  mcp-default:
+    build: .
+    command:
+      - --http-port=3000
+      - --directory-path=/data/heaps
+      - --session-db-path=/data/sessions
+    tmpfs:
+      - /data:uid=1000,gid=1000
+    ports:
+      - "3001:3000"
+
+  mcp-opa-policy:
+    build: .
+    command:
+      - --http-port=3000
+      - --directory-path=/data/heaps
+      - --session-db-path=/data/sessions
+      - --allow-external-modules
+      - --opa-url=http://opa:8181
+      - --opa-module-policy=mcp/modules
+    tmpfs:
+      - /data:uid=1000,gid=1000
+    ports:
+      - "3002:3000"
+    depends_on:
+      - opa

policies/modules.rego

@@ -0,0 +1,75 @@
+package mcp.modules
+
+default allow = false
+
+# Allow specific npm packages (via esm.sh)
+allow if {
+    input.specifier_type == "npm"
+    npm_package_allowed
+}
+
+# Allow specific JSR packages (via esm.sh/jsr/)
+allow if {
+    input.specifier_type == "jsr"
+    jsr_package_allowed
+}
+
+# Allow specific URL hosts
+allow if {
+    input.specifier_type == "url"
+    url_host_allowed
+}
+
+# ── Allowed npm packages ────────────────────────────────────────────────
+# Add package names (as they appear on esm.sh) to this set.
+# The policy checks that the resolved URL host is esm.sh and the path
+# starts with one of these package prefixes.
+
+allowed_npm_packages := {
+    "lodash-es",
+    "uuid",
+    "date-fns",
+    "zod",
+}
+
+npm_package_allowed if {
+    input.url_parsed.host == "esm.sh"
+    some pkg in allowed_npm_packages
+    startswith(input.url_parsed.path, sprintf("/%s", [pkg]))
+}
+
+# ── Allowed JSR packages ────────────────────────────────────────────────
+
+allowed_jsr_packages := {
+    "@luca/cases",
+    "@std/path",
+}
+
+jsr_package_allowed if {
+    input.url_parsed.host == "esm.sh"
+    some pkg in allowed_jsr_packages
+    startswith(input.url_parsed.path, sprintf("/jsr/%s", [pkg]))
+}
+
+# ── Allowed URL hosts ───────────────────────────────────────────────────
+# Direct URL imports are allowed from these exact hosts.
+
+allowed_url_hosts := {
+    "esm.sh",
+    "cdn.jsdelivr.net",
+    "unpkg.com",
+}
+
+url_host_allowed if {
+    allowed_url_hosts[input.url_parsed.host]
+}
+
+# Wildcard suffix matches for URL hosts
+allowed_url_suffixes := {
+    ".esm.sh",
+}
+
+url_host_allowed if {
+    some suffix in allowed_url_suffixes
+    endswith(input.url_parsed.host, suffix)
+}

server/fuzz/fuzz_targets/fuzz_execute_stateful.rs

@@ -72,5 +72,5 @@ fuzz_target!(|input: StatefulInput| {
     let max_bytes = 8 * 1024 * 1024;
     let wasm_default = 8 * 1024 * 1024;
     let handle = Arc::new(Mutex::new(None));
-    let _ = server::engine::execute_stateful(&input.code, raw_snapshot, max_bytes, handle, &modules, wasm_default, None, None);
+    let _ = server::engine::execute_stateful(&input.code, raw_snapshot, max_bytes, handle, &modules, wasm_default, None, None, None);
 });

server/fuzz/fuzz_targets/fuzz_execute_stateless.rs

@@ -59,5 +59,5 @@ fuzz_target!(|input: StatelessInput| {
     let max_bytes = 8 * 1024 * 1024;
     let wasm_default = 8 * 1024 * 1024;
     let handle = Arc::new(Mutex::new(None));
-    let _ = server::engine::execute_stateless(&input.code, max_bytes, handle, &modules, wasm_default, None, None);
+    let _ = server::engine::execute_stateless(&input.code, max_bytes, handle, &modules, wasm_default, None, None, None);
 });

server/fuzz/fuzz_targets/fuzz_snapshot_deserialization.rs

@@ -39,5 +39,5 @@ fuzz_target!(|data: &[u8]| {
     let max_bytes = 64 * 1024 * 1024;
     let handle = Arc::new(Mutex::new(None));
     let wasm_default = 16 * 1024 * 1024;
-    let _ = server::engine::execute_stateful("1", raw_snapshot, max_bytes, handle, &[], wasm_default, None, None);
+    let _ = server::engine::execute_stateful("1", raw_snapshot, max_bytes, handle, &[], wasm_default, None, None, None);
 });

server/fuzz/fuzz_targets/fuzz_wasm_compile.rs

@@ -43,5 +43,5 @@ fuzz_target!(|data: &[u8]| {
     let max_bytes = 64 * 1024 * 1024;
     let wasm_default = 8 * 1024 * 1024;
     let handle = Arc::new(Mutex::new(None));
-    let _ = server::engine::execute_stateless("1", max_bytes, handle, &modules, wasm_default, None, None);
+    let _ = server::engine::execute_stateless("1", max_bytes, handle, &modules, wasm_default, None, None, None);
 });

server/src/engine/mod.rs

@@ -720,6 +720,7 @@ pub fn execute_stateless(
     wasm_default_max_bytes: usize,
     fetch_config: Option<&fetch::FetchConfig>,
     console_tree: Option<sled::Tree>,
+    module_loader_config: Option<&module_loader::ModuleLoaderConfig>,
 ) -> (Result<String, String>, bool) {
     let oom_flag = Arc::new(AtomicBool::new(false));
 
@@ -738,7 +739,10 @@ pub fn execute_stateless(
         // When the code contains ES module syntax (import/export) we need a
         // module loader that can resolve npm:/jsr:/URL specifiers.
         let module_loader: Option<Rc<dyn deno_core::ModuleLoader>> = if use_modules {
-            Some(Rc::new(module_loader::NetworkModuleLoader::new()))
+            match module_loader_config {
+                Some(config) => Some(Rc::new(module_loader::NetworkModuleLoader::with_config(config.clone()))),
+                None => Some(Rc::new(module_loader::NetworkModuleLoader::new())),
+            }
         } else {
             None
         };
@@ -825,6 +829,7 @@ pub fn execute_stateful(
     wasm_default_max_bytes: usize,
     fetch_config: Option<&fetch::FetchConfig>,
     console_tree: Option<sled::Tree>,
+    module_loader_config: Option<&module_loader::ModuleLoaderConfig>,
 ) -> (Result<(String, Vec<u8>, String), String>, bool) {
     let oom_flag = Arc::new(AtomicBool::new(false));
 
@@ -859,7 +864,10 @@ pub fn execute_stateful(
         }
 
         let module_loader: Option<Rc<dyn deno_core::ModuleLoader>> = if use_modules {
-            Some(Rc::new(module_loader::NetworkModuleLoader::new()))
+            match module_loader_config {
+                Some(config) => Some(Rc::new(module_loader::NetworkModuleLoader::with_config(config.clone()))),
+                None => Some(Rc::new(module_loader::NetworkModuleLoader::new())),
+            }
         } else {
             None
         };
@@ -989,6 +997,8 @@ pub struct Engine {
     fetch_config: Option<Arc<fetch::FetchConfig>>,
     /// Execution registry for async execution tracking and console output.
     execution_registry: Option<Arc<ExecutionRegistry>>,
+    /// Module loader configuration controlling external module access and OPA auditing.
+    module_loader_config: Arc<module_loader::ModuleLoaderConfig>,
 }
 
 impl Engine {
@@ -1009,6 +1019,11 @@ impl Engine {
             wasm_modules: Arc::new(Vec::new()),
             fetch_config: None,
             execution_registry: None,
+            module_loader_config: Arc::new(module_loader::ModuleLoaderConfig {
+                allow_external: false,
+                opa_client: None,
+                opa_module_policy: None,
+            }),
         }
     }
 
@@ -1032,6 +1047,11 @@ impl Engine {
             wasm_modules: Arc::new(Vec::new()),
             fetch_config: None,
             execution_registry: None,
+            module_loader_config: Arc::new(module_loader::ModuleLoaderConfig {
+                allow_external: false,
+                opa_client: None,
+                opa_module_policy: None,
+            }),
         }
     }
 
@@ -1059,6 +1079,12 @@ impl Engine {
         self
     }
 
+    /// Configure module loader settings (external module access and OPA auditing).
+    pub fn with_module_loader_config(mut self, config: module_loader::ModuleLoaderConfig) -> Self {
+        self.module_loader_config = Arc::new(config);
+        self
+    }
+
     /// Submit code for async execution. Returns an execution ID immediately.
     /// V8 runs in a background task. Use `get_execution()` to poll status and
     /// `get_execution_output()` to read console output.
@@ -1150,8 +1176,9 @@ impl Engine {
                 let wasm_default = self.wasm_default_max_bytes;
                 let fc = self.fetch_config.clone();
                 let ct = console_tree;
+                let mlc = self.module_loader_config.clone();
                 let mut join_handle = tokio::task::spawn_blocking(move || {
-                    execute_stateless(&code, max_bytes, ih, &wasm, wasm_default, fc.as_deref(), Some(ct))
+                    execute_stateless(&code, max_bytes, ih, &wasm, wasm_default, fc.as_deref(), Some(ct), Some(&mlc))
                 });
 
                 // Publish isolate handle for cancellation once it's available.
@@ -1201,11 +1228,12 @@ impl Engine {
                 let wasm_default = self.wasm_default_max_bytes;
                 let fc = self.fetch_config.clone();
                 let ct = console_tree;
+                let mlc = self.module_loader_config.clone();
 
                 let snap_mutex = self.snapshot_mutex.clone();
                 let mut join_handle = tokio::task::spawn_blocking(move || {
                     let _guard = snap_mutex.blocking_lock();
-                    execute_stateful(&code, raw_snapshot, max_bytes, ih, &wasm, wasm_default, fc.as_deref(), Some(ct))
+                    execute_stateful(&code, raw_snapshot, max_bytes, ih, &wasm, wasm_default, fc.as_deref(), Some(ct), Some(&mlc))
                 });
 
                 // Publish isolate handle for cancellation.