RedMesh: deployment branding readable without a session, for the sign-in page (#534)

* feat: serve the deployment branding to the sign-in page

What changed:
- Two endpoints with no actor, get_public_branding and download_public_branding_logo, answer the same
  theme/logo DTO and re-hashed logo bytes as the actor-bound reads.
- The logo download logic is shared between the actor-bound and public endpoints.
- Tests for the default, a set theme and logo, a tampered or lost file, and a missing namespace;
  the endpoint inventory grows by two.

Why:
- A browser with no session (the sign-in page, incognito) could not read the branding, so the
  sign-in page always showed the default theme and logo.

Checks:
- pytest red_mesh/tests: 6430 passed, 5 skipped.

* chore: increment version

Author: toderian

extensions/business/cybersec/red_mesh/pentester_api_01.py

@@ -4381,7 +4381,28 @@ def update_super_tenant_branding(self, actor: dict = None, changes: object = Non
   @BasePlugin.endpoint(method="post")
   def download_super_tenant_branding_logo(self, actor: dict = None):
     """The logo's bytes, re-hashed against the branding record, for every active account."""
-    logo = self._call_tenant_administration("super_tenant_branding_logo", actor)
+    return self._download_branding_logo(self._call_tenant_administration("super_tenant_branding_logo", actor))
+
+  @BasePlugin.endpoint(method="post")
+  def get_public_branding(self):
+    """The deployment's theme and logo hash with no actor, for the sign-in page; the same DTO as
+    `get_super_tenant_branding`, never the logo's reference."""
+    try:
+      service = self._execution_service()
+    except TenantStoreError:
+      return administration_unavailable()
+    return service.public_super_tenant_branding()
+
+  @BasePlugin.endpoint(method="post")
+  def download_public_branding_logo(self):
+    """The logo's bytes with no actor, for the sign-in page; re-hashed as the actor-bound download."""
+    try:
+      service = self._execution_service()
+    except TenantStoreError:
+      return administration_unavailable()
+    return self._download_branding_logo(service.public_super_tenant_branding_logo())
+
+  def _download_branding_logo(self, logo):
     if not logo.get("success"):
       return logo
 

extensions/business/cybersec/red_mesh/tenancy/administration.py

@@ -1702,6 +1702,20 @@ def get_super_tenant_branding(self, actor):
     self._actor(actor)
     return super_tenant_branding.branding_dto(self._branding_row())
 
+  # The sign-in page shows the deployment's branding before anyone signs in, so these two take no
+  # actor. They answer only what the actor-bound reads answer: the DTO, and the logo's reference for
+  # the plugin's download.
+  @_endpoint
+  def public_super_tenant_branding(self):
+    return super_tenant_branding.branding_dto(self._branding_row())
+
+  @_endpoint
+  def public_super_tenant_branding_logo(self):
+    logo = self._branding_row()["logo"]
+    if logo is None:
+      raise AdministrationDenied(404, "not_found")
+    return logo
+
   @_endpoint
   def authorize_super_tenant_branding_update(self, actor):
     """Step 1 of a logo write: refused before the plugin stores any bytes."""

extensions/business/cybersec/red_mesh/tests/test_authz_surface.py

@@ -6,7 +6,7 @@
 from .conftest import mock_plugin_modules
 
 TEST_CHANNEL_TOKEN = "test-model-token-material-at-least-32-bytes"
-EXPECTED_ENDPOINTS = 128  # +3 super-tenant branding (RM-134); +1 list_deployment_nodes (RM-126); +5 data maintenance (RM-108, temporary); +3 tenant contract (RM-095 phase 1); +6 engagements (RM-095 phase 2); +1 delete_tenant, -4 tenant assets (RM-107); +7 tenant drafts (RM-109 phase 2); +3 draft release/close and tenant document download (RM-109 phase 3); +8 engagement drafts (RM-109 phase 4); +3 super-tenant profile and generated pack (RM-110 phase 1); +6 tenant assets (RM-125)
+EXPECTED_ENDPOINTS = 130  # +2 public branding for the sign-in page; +3 super-tenant branding (RM-134); +1 list_deployment_nodes (RM-126); +5 data maintenance (RM-108, temporary); +3 tenant contract (RM-095 phase 1); +6 engagements (RM-095 phase 2); +1 delete_tenant, -4 tenant assets (RM-107); +7 tenant drafts (RM-109 phase 2); +3 draft release/close and tenant document download (RM-109 phase 3); +8 engagement drafts (RM-109 phase 4); +3 super-tenant profile and generated pack (RM-110 phase 1); +6 tenant assets (RM-125)
 TOKEN_ENDPOINTS = {"launch_model_test", "preflight_model_test_provider"}
 LAUNCH_ENDPOINTS = ("launch_network_scan", "launch_webapp_scan", "launch_test", "launch_model_test")
 # Pre-RM-075 public positional contract; account actor fields are appended to launches.
@@ -61,6 +61,9 @@
   'get_super_tenant_branding': 'actor',
   'update_super_tenant_branding': 'actor',
   'download_super_tenant_branding_logo': 'actor',
+  # The sign-in page's branding, read before anyone signs in.
+  'get_public_branding': None,
+  'download_public_branding_logo': None,
   'store_generated_document': 'actor',
   'create_tenant_contract_draft': 'actor',
   'get_tenant_contract_draft': 'actor',

extensions/business/cybersec/red_mesh/tests/test_super_tenant_branding.py

@@ -234,6 +234,37 @@ def test_no_namespace_means_unavailable_before_any_storage_access(self):
     self.assertEqual((self.store.writes, self.documents.puts), ([], []))
 
 
+class TestPublicBranding(_BrandingCase):
+  """The sign-in page's reads: no actor, the same answers as the actor-bound reads."""
+
+  def test_the_default_is_read_without_an_actor_or_a_write_and_no_logo_is_not_found(self):
+    self.assertEqual(ok(self, self.plugin.get_public_branding()), EMPTY)
+    refused(self, self.plugin.download_public_branding_logo(), 404, "not_found")
+    self.assertEqual((self.store.writes, self.events), ([], []))
+
+  def test_a_set_theme_and_logo_read_as_the_actor_bound_reads_do(self):
+    raw = png()
+    data = ok(self, self.update({"logo": upload(raw), "theme": "light"}))
+    self.assertEqual(ok(self, self.plugin.get_public_branding()), data)
+    got = ok(self, self.plugin.download_public_branding_logo())
+    self.assertEqual(got, ok(self, self.download()))
+    self.assertEqual(base64.b64decode(got["content_b64"]), raw)
+
+  def test_a_tampered_file_answers_integrity_and_a_lost_one_not_found(self):
+    ok(self, self.update({"logo": upload(png())}))
+    self.documents.envelopes["doc-1"]["content_b64"] = base64.b64encode(png(size=4096)).decode("ascii")
+    refused(self, self.plugin.download_public_branding_logo(), 409, "contract_integrity")
+    del self.documents.envelopes["doc-1"]
+    refused(self, self.plugin.download_public_branding_logo(), 404, "not_found")
+
+  def test_no_namespace_means_unavailable(self):
+    self.plugin.cfg_tenancy_namespace = None
+    for name in ("get_public_branding", "download_public_branding_logo"):
+      with self.subTest(name):
+        self.assertEqual(getattr(self.Plugin, name).__http_method__, "post")
+        self.assertEqual(getattr(self.plugin, name)()["status_code"], 503)
+
+
 class TestBrandingStoredRow(unittest.TestCase):
   def test_the_validator_refuses_rows_the_operations_could_not_write(self):
     from extensions.business.cybersec.red_mesh.tenancy.super_tenant_branding import validate_super_tenant_branding

ver.py

@@ -1 +1 @@
-__VER__ = '2.10.490'
+__VER__ = '2.10.491'