Skip to content

symfonic.diagnostics.inspection.platform_checks

platform_checks

Security posture that can be read off an environment and a source tree.

symfonic.platform.posture already records the defect this inspector makes checkable: the production gate recognises four environment variables and two values, and in dev mode the missing-verifier warning fires once. A deployment whose variable says prd or live is therefore not production as far as the gate is concerned, and it trusts the X-Tenant-ID header in silence for the rest of its life after one log line nobody read.

The gate cannot fix that by widening its list — an unnamed convention is unnameable by definition. What it can do is let somebody ask the question before deploying, from outside the process, which is what this is. The constants come from the platform module itself so the two cannot disagree about what counts as production.

describes_a_deployment 

describes_a_deployment(environ: Mapping[str, str]) -> bool

Whether environ says anything about the deployment being inspected.

Every check below is silent for an environment that names no target: the production gate never fires, so no verifier is demanded, and no spelling is unrecognised. That silence is indistinguishable from a clean result, and the caller uses this to record the category as not inspected rather than hand back a green tick for a gate nobody examined.

Source code in src/symfonic/diagnostics/inspection/platform_checks.py 
60
61
62
63
64
65
66
67
68
69
70
def describes_a_deployment(environ: Mapping[str, str]) -> bool:
    """Whether *environ* says anything about the deployment being inspected.

    Every check below is silent for an environment that names no target: the
    production gate never fires, so no verifier is demanded, and no spelling is
    unrecognised. That silence is indistinguishable from a clean result, and
    the caller uses this to record the category as *not inspected* rather than
    hand back a green tick for a gate nobody examined.
    """
    named = any(environ.get(name, "").strip() for name in PRODUCTION_ENV_VARS)
    return named or bool(environ.get("ALLOW_INSECURE_PROD", "").strip())

platform_security 

platform_security(environ: Mapping[str, str], refs: tuple[ImportRef, ...]) -> list[InspectionFinding]

Header-trust and production-gate gaps visible without running anything.

Source code in src/symfonic/diagnostics/inspection/platform_checks.py 
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
def platform_security(
    environ: Mapping[str, str], refs: tuple[ImportRef, ...]
) -> list[InspectionFinding]:
    """Header-trust and production-gate gaps visible without running anything."""
    findings: list[InspectionFinding] = []

    insecure = environ.get("ALLOW_INSECURE_PROD", "").strip().lower()
    if insecure in _TRUTHY:
        findings.append(
            InspectionFinding(
                code="PS-1",
                category="platform-security",
                severity=Severity.ERROR,
                subject="ALLOW_INSECURE_PROD",
                detail=(
                    f"set to {insecure!r}, which downgrades the production "
                    "auth gate from a refusal to a log line"
                ),
                migration_action=(
                    "Unset ALLOW_INSECURE_PROD and register a tenant auth "
                    "verifier before serving production traffic."
                ),
            )
        )

    for name, value in _unrecognised(environ):
        findings.append(
            InspectionFinding(
                code="PS-2",
                category="platform-security",
                severity=Severity.WARN,
                subject=name,
                detail=(
                    f"is {value!r}, which the production gate does not recognise "
                    f"(it knows {', '.join(sorted(PRODUCTION_VALUES))}); if this "
                    "deployment is production, the gate will not fire"
                ),
                migration_action=(
                    "Spell the production environment with a recognised value, or "
                    "poll AuthPosture so a header-trusting host is visible."
                ),
            )
        )

    if _is_production(environ) or _unrecognised(environ):
        findings.extend(_verifier_findings(refs))
    return findings