Remote Config 驱动安全决策时怎样划定 VMP 边界

from pathlib import Path
import json
import re
import sys

if len(sys.argv) != 2:
    raise SystemExit(2)
policy_path = Path(sys.argv[1])
if not policy_path.is_file():
    raise SystemExit(2)
try:
    policy = json.loads(policy_path.read_text(encoding="utf-8"))
except (OSError, UnicodeError, json.JSONDecodeError):
    raise SystemExit(2)
required_lifecycle = {
    "fetchFailure": "keep-last-activated",
    "noActivatedValue": "use-defaults",
    "activateFailure": "keep-current"
}
if policy.get("lifecycle") != required_lifecycle:
    raise SystemExit(3)
parameters = policy.get("parameters")
if not isinstance(parameters, list) or not parameters:
    raise SystemExit(2)
allowed_classes = {"presentation", "risk-input", "authorization", "disable-only"}
allowed_failures = {"use-default", "deny", "require-server"}
allowed_scopes = {"protect", "exclude"}
key_pattern = re.compile(r"^[a-z][a-zA-Z0-9_]{2,63}$")
glue_pattern = re.compile(r"(?i)(fetch|activate|remoteConfig|firebase|callback|listener)")
issues = []
seen_keys = set()
for item in parameters:
    if not isinstance(item, dict):
        raise SystemExit(2)
    key = item.get("key")
    if not isinstance(key, str) or not key_pattern.fullmatch(key) or key in seen_keys:
        issues.append({"key": str(key), "issue": "invalid-or-duplicate-key"})
        continue
    seen_keys.add(key)
    decision_class = item.get("decisionClass")
    failure_policy = item.get("failurePolicy")
    vmp_scope = item.get("vmpScope")
    function_name = item.get("decisionFunction")
    if decision_class not in allowed_classes or failure_policy not in allowed_failures or vmp_scope not in allowed_scopes:
        issues.append({"key": key, "issue": "unknown-policy-enum"})
    if not isinstance(function_name, str) or not function_name.strip():
        issues.append({"key": key, "issue": "missing-decision-function"})
    if vmp_scope == "protect" and glue_pattern.search(function_name or ""):
        issues.append({"key": key, "issue": "sdk-glue-selected-for-vmp"})
    conditions = item.get("conditions", [])
    priorities = [condition.get("priority") for condition in conditions if isinstance(condition, dict)]
    if len(priorities) != len(conditions) or priorities != list(range(len(priorities))):
        issues.append({"key": key, "issue": "condition-priority-gap"})
    if decision_class == "authorization":
        if item.get("default") is not False:
            issues.append({"key": key, "issue": "authorization-default-not-deny"})
        if item.get("serverEnforced") is not True:
            issues.append({"key": key, "issue": "authorization-not-server-enforced"})
        if failure_policy not in {"deny", "require-server"}:
            issues.append({"key": key, "issue": "unsafe-authorization-fallback"})
report = {"variant": policy.get("variant"), "parameterCount": len(parameters), "issues": issues}
print(json.dumps(report, ensure_ascii=False, indent=2))
if issues:
    raise SystemExit(3)