Implement milestone 6 dynamic API security validation

Author: Ibraheem Olasupo

.github/workflows/api-security.yml

@@ -0,0 +1,48 @@
+name: API Dynamic Security
+
+on:
+  pull_request:
+    branches: ["main"]
+  push:
+    branches: ["main"]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: api-dynamic-security-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  dynamic-api-security:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 25
+    steps:
+      # actions/checkout v4.2.2
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+
+      # actions/setup-python v5.6.0
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+        with:
+          python-version: "3.11"
+          cache: "pip"
+
+      - name: Install dynamic test dependencies
+        run: |
+          python -m pip install --upgrade pip==25.1.1
+          python -m pip install -e ".[dev]"
+
+      - name: Dynamic tool inventory
+        run: make dynamic-tools
+
+      - name: Dynamic pytest validation
+        run: make dynamic-fast
+
+      - name: Schemathesis local API validation
+        run: make schemathesis-test
+
+      - name: OWASP ZAP local baseline
+        run: make zap-baseline
+
+      - name: Dynamic evidence and reports
+        run: make dynamic-evidence verify-dynamic-evidence dynamic-report

CONTRIBUTING.md

@@ -9,6 +9,7 @@ Run:
 ```bash
 make quality
 make appsec-fast
+make dynamic-fast
 ```
 
 Use deterministic synthetic data only. Do not add real patient, NHS, genomic, credential, or cloud account data.
@@ -20,4 +21,5 @@ Use deterministic synthetic data only. Do not add real patient, NHS, genomic, cr
 - Do not introduce wildcard CORS defaults.
 - Do not commit generated caches, local databases, logs, or environment files.
 - Run scanner targets after changing dependencies, Dockerfile, Terraform, authentication or request-handling code.
+- Keep dynamic-security scans pointed only at localhost, loopback or approved local Docker targets.
 - Do not add broad scanner suppressions. Use `security/config/suppressions.yaml` with an owner, expiry and exact path or rule scope.

Makefile

@@ -1,4 +1,4 @@
-.PHONY: setup install format format-check lint type-check test test-coverage auth-test api-security-test terraform-fmt terraform-fmt-check terraform-init terraform-validate terraform-test infrastructure-test infrastructure-evidence verify-infrastructure-evidence infrastructure-report security-tools secrets-scan sast sast-semgrep sast-bandit semgrep-test sca dependency-audit sbom verify-sbom iac-scan checkov-scan container-build-security container-scan appsec-fast appsec-full appsec-evidence verify-appsec-evidence appsec-report pre-commit-install pre-commit-run quality run docker-build docker-run threat-model-validate threat-model-evidence verify-threat-model-evidence threat-model-report api-security-evidence verify-api-security-evidence api-security-report dev-token-researcher dev-token-approver dev-token-auditor clean
+.PHONY: setup install format format-check lint type-check test test-coverage auth-test api-security-test terraform-fmt terraform-fmt-check terraform-init terraform-validate terraform-test infrastructure-test infrastructure-evidence verify-infrastructure-evidence infrastructure-report security-tools secrets-scan sast sast-semgrep sast-bandit semgrep-test sca dependency-audit sbom verify-sbom iac-scan checkov-scan container-build-security container-scan appsec-fast appsec-full appsec-evidence verify-appsec-evidence appsec-report dynamic-tools dynamic-server-start dynamic-server-wait dynamic-server-stop schemathesis-test api-schema-security-test zap-baseline zap-api-scan auth-boundary-test authorisation-boundary-test object-access-test input-mutation-test security-header-test cors-test resource-consumption-test audit-dynamic-test dast dynamic-evidence verify-dynamic-evidence dynamic-report dynamic-fast dynamic-full pre-commit-install pre-commit-run quality run docker-build docker-run threat-model-validate threat-model-evidence verify-threat-model-evidence threat-model-report api-security-evidence verify-api-security-evidence api-security-report dev-token-researcher dev-token-approver dev-token-auditor clean
 
 PYTHON ?= python3
 VENV ?= .venv
@@ -120,6 +120,69 @@ appsec-fast: secrets-scan sast dependency-audit
 
 appsec-full: appsec-fast sbom verify-sbom checkov-scan container-build-security container-scan appsec-evidence verify-appsec-evidence appsec-report
 
+dynamic-tools:
+	PYTHONPATH=src $(PYTHON) scripts/dynamic_security_tools.py tools
+
+dynamic-server-start:
+	PYTHONPATH=src $(PYTHON) scripts/dynamic_security_tools.py server-start
+
+dynamic-server-wait:
+	PYTHONPATH=src $(PYTHON) scripts/dynamic_security_tools.py server-wait
+
+dynamic-server-stop:
+	PYTHONPATH=src $(PYTHON) scripts/dynamic_security_tools.py server-stop
+
+schemathesis-test:
+	PYTHONPATH=src $(PYTHON) scripts/dynamic_security_tools.py schemathesis
+
+api-schema-security-test: schemathesis-test
+
+zap-baseline:
+	PYTHONPATH=src $(PYTHON) scripts/dynamic_security_tools.py zap
+
+zap-api-scan: zap-baseline
+
+auth-boundary-test:
+	PYTHONPATH=src $(PYTEST) tests/dynamic -q -k authentication --json-report --json-report-file=outputs/security/dynamic/raw/pytest-dynamic.json
+
+authorisation-boundary-test:
+	PYTHONPATH=src $(PYTEST) tests/dynamic -q -k authorisation --json-report --json-report-file=outputs/security/dynamic/raw/pytest-dynamic.json
+
+object-access-test:
+	PYTHONPATH=src $(PYTEST) tests/dynamic -q -k object_level --json-report --json-report-file=outputs/security/dynamic/raw/pytest-dynamic.json
+
+input-mutation-test:
+	PYTHONPATH=src $(PYTEST) tests/dynamic -q -k input_mutation --json-report --json-report-file=outputs/security/dynamic/raw/pytest-dynamic.json
+
+security-header-test:
+	PYTHONPATH=src $(PYTEST) tests/dynamic -q -k security_headers --json-report --json-report-file=outputs/security/dynamic/raw/pytest-dynamic.json
+
+cors-test:
+	PYTHONPATH=src $(PYTEST) tests/dynamic -q -k cors --json-report --json-report-file=outputs/security/dynamic/raw/pytest-dynamic.json
+
+resource-consumption-test:
+	PYTHONPATH=src $(PYTEST) tests/dynamic -q -k rate_limit --json-report --json-report-file=outputs/security/dynamic/raw/pytest-dynamic.json
+
+audit-dynamic-test:
+	PYTHONPATH=src $(PYTEST) tests/dynamic -q -k audit --json-report --json-report-file=outputs/security/dynamic/raw/pytest-dynamic.json
+
+dast: zap-baseline
+
+dynamic-evidence:
+	PYTHONPATH=src $(PYTHON) -m genomic_research_access_api.security.dynamic.evidence --timestamp 2026-01-01T00:00:00Z
+
+verify-dynamic-evidence:
+	PYTHONPATH=src $(PYTHON) -m genomic_research_access_api.security.dynamic.evidence --verify
+
+dynamic-report:
+	PYTHONPATH=src $(PYTHON) -m genomic_research_access_api.security.dynamic.report
+
+dynamic-fast:
+	PYTHONPATH=src $(PYTHON) scripts/dynamic_security_tools.py pytest
+
+dynamic-full:
+	PYTHONPATH=src $(PYTHON) scripts/dynamic_security_tools.py full
+
 pre-commit-install:
 	$(PYTHON) -m pip install pre-commit==3.8.0
 	$(VENV)/bin/pre-commit install

README.md

@@ -26,6 +26,8 @@ Milestone 4 delivered a secure AWS ECS Fargate Terraform reference architecture,
 
 Milestone 5 delivered the core AppSec pipeline: pinned scanner configuration, Semgrep and Bandit SAST, project-scoped pip-audit SCA, deterministic CycloneDX SBOM evidence, Checkov IaC reporting, Gitleaks and Trivy wrapper targets, AppSec reports and SHA-pinned security workflows.
 
+Milestone 6 adds local-only dynamic API security validation: dynamic pytest boundary tests, pinned Schemathesis OpenAPI testing, pinned OWASP ZAP baseline scanning, bounded resource-consumption checks, deterministic dynamic evidence and dynamic-security reports. Dynamic scans are restricted to localhost, loopback and approved local Docker targets.
+
 ## Milestone 1 Scope
 
 Implemented:
@@ -183,6 +185,8 @@ Open `http://127.0.0.1:8000/docs` for FastAPI's local OpenAPI UI.
 - `make checkov-scan`: run Checkov and record Terraform findings.
 - `make container-build-security`: build the local image for scanning.
 - `make container-scan`: run Trivy against the local image.
+- `make dynamic-fast`: run local dynamic pytest security tests.
+- `make dynamic-full`: run dynamic pytest, Schemathesis, ZAP, evidence verification and reports.
 - `make appsec-evidence`: generate deterministic AppSec evidence.
 - `make verify-appsec-evidence`: verify AppSec evidence checksums and SBOM shape.
 - `make quality`: run format, lint, type, coverage, auth, API-security, infrastructure and evidence checks.

SECURITY.md

@@ -6,13 +6,14 @@ If you identify a vulnerability or unsafe pattern in this demonstration code, op
 
 Do not submit real patient data, NHS data, genomic data, credentials, cloud account identifiers, or sensitive operational details in reports.
 
-Current implemented security controls include local JWT authentication, role-based and object-level authorisation, threat-model validation, non-deployed Terraform reference controls, and a Milestone 5 AppSec pipeline.
+Current implemented security controls include local JWT authentication, role-based and object-level authorisation, threat-model validation, non-deployed Terraform reference controls, a Milestone 5 AppSec pipeline, and Milestone 6 local dynamic API security validation.
 
 Run local security checks with:
 
 ```bash
 make quality
 make appsec-fast
+make dynamic-fast
 ```
 
-Docker-backed Gitleaks and Trivy scans require a running Docker daemon when native binaries are not installed. Do not treat local scanner evidence as a production vulnerability-management programme or release approval gate.
+Docker-backed Gitleaks, Trivy, Schemathesis and ZAP scans require a running Docker daemon when native binaries or scanner containers are used. Dynamic scan targets must remain local-only. Do not treat local scanner evidence as a production vulnerability-management programme, penetration test or release approval gate.

docs/architecture/application-architecture.md

@@ -108,3 +108,19 @@ flowchart LR
 ```
 
 The scanner pipeline is local and CI-oriented. It does not publish images, create cloud resources or implement vulnerability-management workflow states.
+
+## Milestone 6 Dynamic Security Architecture
+
+```mermaid
+flowchart LR
+    LocalAPI["FastAPI on 127.0.0.1"] --> Pytest["Dynamic pytest boundary tests"]
+    LocalAPI --> Schema["Schemathesis OpenAPI tests"]
+    LocalAPI --> Zap["OWASP ZAP baseline"]
+    Pytest --> Raw["outputs/security/dynamic/raw"]
+    Schema --> Raw
+    Zap --> Raw
+    Raw --> Evidence["Deterministic dynamic evidence"]
+    Evidence --> Reports["Dynamic security reports"]
+```
+
+Dynamic validation starts and stops a local API instance, rejects non-local scan targets, runs bounded generated traffic and records deterministic evidence. It does not scan external hosts, deploy cloud resources or add release-gate logic.

docs/limitations.md

@@ -6,8 +6,10 @@
 - Runtime state is stored in memory and resets on restart.
 - Local JWT keys under `tests/fixtures/keys/` are synthetic development material and are not production secrets.
 - The audit event API is for local demonstration only and is restricted by role.
-- External identity-provider integration, AWS deployment, production rate limiting, immutable audit-log operations, release gates and vulnerability-management operations are intentionally deferred.
+- External identity-provider integration, AWS deployment, distributed production rate limiting, immutable audit-log operations, release gates and vulnerability-management operations are intentionally deferred.
 - AWS Terraform is present as a reference architecture only; no resources are deployed.
 - Terraform validation is skipped locally when Terraform is unavailable and is configured for CI through a pinned setup action.
 - Gitleaks and Trivy local execution require native binaries or a running Docker daemon for pinned container fallbacks.
+- Schemathesis and ZAP dynamic scans require Docker for pinned scanner containers and are restricted to local targets.
 - Checkov findings are captured as reporting evidence in Milestone 5; full Terraform remediation is not claimed.
+- Dynamic API security evidence is local synthetic validation and is not penetration-test coverage.

docs/milestones/milestone-6.md

@@ -0,0 +1,14 @@
+# Milestone 6: API and Dynamic Security Validation
+
+Milestone 6 adds local-only dynamic validation for the Genomic Research Access API.
+
+Implemented controls:
+
+- Dynamic pytest boundary tests for authentication, authorisation, object-level access, input mutation, security headers, CORS, resource consumption and audit events.
+- Pinned Schemathesis container execution against the local OpenAPI schema.
+- Pinned OWASP ZAP baseline scan against the local API only.
+- Local target safeguards for `127.0.0.1`, `localhost`, `::1`, `host.docker.internal` and the approved Docker service name `api`.
+- Bounded in-memory application rate limiter for deterministic dynamic tests.
+- Deterministic evidence under `outputs/security/dynamic/` and reports under `reports/security/`.
+
+Milestone 6 does not add release gates, canonical finding normalisation, risk scoring, exception workflow, cloud deployment, Redis, API Gateway or external scanning.

docs/operations/local-development.md

@@ -32,6 +32,15 @@ make appsec-fast
 
 This runs Semgrep rule tests, SAST, project-scoped dependency audit, SBOM validation, Checkov reporting and AppSec evidence verification. Docker-backed secret and container scans are available through `make secrets-scan` and `make container-scan` when Docker is running.
 
+## Dynamic API Security Checks
+
+```bash
+make dynamic-fast
+make dynamic-full
+```
+
+`dynamic-fast` runs local in-process API security tests. `dynamic-full` adds local API startup, pinned Schemathesis OpenAPI testing, pinned OWASP ZAP baseline scanning, deterministic evidence verification and report generation. Do not override scan targets to external hosts.
+
 ## Local API Tokens
 
 Protected `/api/v1/*` routes require a bearer token. Generate synthetic local tokens with:

docs/roadmap.md

@@ -7,8 +7,8 @@ The broader portfolio roadmap may include:
 3. Authentication and object-level authorisation. Delivered.
 4. Secure AWS infrastructure with Terraform. Delivered as non-deployed configuration.
 5. Automated security scanning. Delivered as local AppSec pipeline configuration and evidence.
-6. AWS and Terraform security.
+6. API and dynamic security validation. Delivered as local-only Schemathesis, ZAP and dynamic pytest evidence.
 7. Vulnerability management and release gates.
 8. Developer enablement and Security Champions.
 
-Milestones 1, 2, 3, 4 and 5 are implemented in this repository state. Future milestones should update this document when they are actually delivered.
+Milestones 1, 2, 3, 4, 5 and 6 are implemented in this repository state. Future milestones should update this document when they are actually delivered.