igniter 0.5.0 → 0.5.1

data/packages/igniter-app/lib/igniter/app/credentials/credential.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+module Igniter
+  class App
+    module Credentials
+      class Credential < Igniter::DTO::Record
+        field :key, required: true, coerce: ->(value) { value.to_sym }
+        field :label, required: true, coerce: ->(value) { value.to_s }
+        field :provider, required: true, coerce: ->(value) { value.to_sym }
+        field :scope, required: true, coerce: ->(value) { value.to_sym }
+        field :node, coerce: ->(value) { value&.to_s }
+        field :policy, required: true, coerce: :normalize_policy
+        field :metadata, default: -> { {} }, coerce: :normalize_metadata, merge: true
+
+        def local?
+          scope == :local
+        end
+
+        def remote?
+          !local?
+        end
+
+        def allowed_in_scope?(target_scope)
+          policy.allows_scope?(target_scope)
+        end
+
+        private
+
+        def self.normalize_policy(value)
+          case value
+          when CredentialPolicy
+            value
+          when Hash
+            CredentialPolicy.from_h(value)
+          else
+            raise ArgumentError, "policy must be a CredentialPolicy or Hash"
+          end
+        end
+
+        def self.normalize_metadata(hash)
+          (hash || {}).each_with_object({}) do |(key, value), memo|
+            memo[key.to_sym] = value
+          end.freeze
+        end
+      end
+    end
+  end
+end

data/packages/igniter-app/lib/igniter/app/credentials/credential_policy.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+module Igniter
+  class App
+    module Credentials
+      class CredentialPolicy < Igniter::DTO::Record
+        field :name, required: true, coerce: ->(value) { value.to_sym }
+        field :label, required: true, coerce: ->(value) { value.to_s }
+        field :secret_class, required: true, coerce: ->(value) { value.to_sym }
+        field :propagation, required: true, coerce: ->(value) { value.to_sym }
+        field :route_over_replicate, required: true, coerce: ->(value) { !!value }
+        field :weak_trust_behavior, required: true, coerce: ->(value) { value.to_sym }
+        field :operator_approval_required, required: true, coerce: ->(value) { !!value }
+        field :description, default: "", coerce: ->(value) { value.to_s }
+        field :metadata, default: -> { {} }, coerce: :normalize_metadata, merge: true
+
+        def local_only?
+          propagation == :disabled || secret_class == :local_only
+        end
+
+        def allows_scope?(scope)
+          normalized_scope = scope.to_sym
+          return true if normalized_scope == :local
+
+          !local_only?
+        end
+
+        private
+
+        def self.normalize_metadata(hash)
+          (hash || {}).each_with_object({}) do |(key, value), memo|
+            memo[key.to_sym] = value
+          end.freeze
+        end
+      end
+    end
+  end
+end

data/packages/igniter-app/lib/igniter/app/credentials/events/credential_event.rb

@@ -0,0 +1,179 @@
+# frozen_string_literal: true
+
+require "time"
+
+module Igniter
+  class App
+    module Credentials
+      module Events
+        class CredentialEvent
+          EVENT_TYPES = %i[
+            lease_requested
+            lease_issued
+            lease_denied
+            lease_used
+            lease_revoked
+            replication_requested
+            replication_denied
+            replication_revoked
+            access_denied
+          ].freeze
+
+          STATUS_TYPES = %i[
+            requested
+            issued
+            denied
+            used
+            revoked
+          ].freeze
+
+          attr_reader :event, :status, :credential_key, :policy_name, :node, :target_node,
+                      :lease_id, :actor, :origin, :source, :reason, :timestamp, :metadata
+
+          def initialize(event:, credential_key:, policy_name:, status: nil, node: nil, target_node: nil,
+                         lease_id: nil, actor: nil, origin: nil, source: nil, reason: nil,
+                         timestamp: Time.now.utc.iso8601, metadata: {})
+            @event = normalize_event(event)
+            @status = normalize_status(status || default_status_for(@event))
+            @credential_key = credential_key.to_sym
+            @policy_name = policy_name.to_sym
+            @node = node&.to_s
+            @target_node = target_node&.to_s
+            @lease_id = lease_id&.to_s
+            @actor = actor&.to_s
+            @origin = origin&.to_s
+            @source = source&.to_sym
+            @reason = reason&.to_sym
+            @timestamp = normalize_timestamp(timestamp)
+            @metadata = normalize_metadata(metadata)
+            freeze
+          end
+
+          def self.from_h(event_hash)
+            normalized = (event_hash || {}).each_with_object({}) do |(key, value), memo|
+              memo[key.to_sym] = value
+            end
+
+            new(
+              event: normalized.fetch(:event),
+              status: normalized[:status],
+              credential_key: normalized.fetch(:credential_key),
+              policy_name: normalized.fetch(:policy_name),
+              node: normalized[:node],
+              target_node: normalized[:target_node],
+              lease_id: normalized[:lease_id],
+              actor: normalized[:actor],
+              origin: normalized[:origin],
+              source: normalized[:source],
+              reason: normalized[:reason],
+              timestamp: normalized[:timestamp],
+              metadata: normalized.fetch(:metadata, {})
+            )
+          end
+
+          def lease_event?
+            event.to_s.start_with?("lease_")
+          end
+
+          def replication_event?
+            event.to_s.start_with?("replication_")
+          end
+
+          def denied?
+            status == :denied
+          end
+
+          def granted?
+            status == :issued || status == :used
+          end
+
+          def with(**overrides)
+            self.class.new(
+              event: overrides.fetch(:event, event),
+              status: overrides.fetch(:status, status),
+              credential_key: overrides.fetch(:credential_key, credential_key),
+              policy_name: overrides.fetch(:policy_name, policy_name),
+              node: overrides.fetch(:node, node),
+              target_node: overrides.fetch(:target_node, target_node),
+              lease_id: overrides.fetch(:lease_id, lease_id),
+              actor: overrides.fetch(:actor, actor),
+              origin: overrides.fetch(:origin, origin),
+              source: overrides.fetch(:source, source),
+              reason: overrides.fetch(:reason, reason),
+              timestamp: overrides.fetch(:timestamp, timestamp),
+              metadata: metadata.merge(normalize_metadata(overrides.fetch(:metadata, {})))
+            )
+          end
+
+          def to_h
+            {
+              event: event,
+              status: status,
+              credential_key: credential_key,
+              policy_name: policy_name,
+              node: node,
+              target_node: target_node,
+              lease_id: lease_id,
+              actor: actor,
+              origin: origin,
+              source: source,
+              reason: reason,
+              timestamp: timestamp,
+              metadata: metadata
+            }.compact.freeze
+          end
+
+          private
+
+          def normalize_event(value)
+            normalized = value.to_sym
+            return normalized if EVENT_TYPES.include?(normalized)
+
+            raise ArgumentError, "unknown credential event: #{value}"
+          end
+
+          def normalize_status(value)
+            normalized = value.to_sym
+            return normalized if STATUS_TYPES.include?(normalized)
+
+            raise ArgumentError, "unknown credential event status: #{value}"
+          end
+
+          def default_status_for(event_name)
+            case event_name.to_sym
+            when :lease_requested, :replication_requested
+              :requested
+            when :lease_issued
+              :issued
+            when :lease_used
+              :used
+            when :lease_denied, :replication_denied, :access_denied
+              :denied
+            when :lease_revoked, :replication_revoked
+              :revoked
+            else
+              :requested
+            end
+          end
+
+          def normalize_timestamp(value)
+            case value
+            when Time
+              value.utc.iso8601
+            else
+              Time.parse(value.to_s).utc.iso8601
+            end
+          rescue ArgumentError
+            Time.now.utc.iso8601
+          end
+
+          def normalize_metadata(hash)
+            (hash || {}).each_with_object({}) do |(key, value), memo|
+              memo[key.to_sym] = value
+            end.freeze
+          end
+        end
+      end
+    end
+  end
+end

data/packages/igniter-app/lib/igniter/app/credentials/events.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+require_relative "events/credential_event"
+
+module Igniter
+  class App
+    module Credentials
+      module Events
+      end
+    end
+  end
+end

data/packages/igniter-app/lib/igniter/app/credentials/lease_request.rb

@@ -0,0 +1,153 @@
+# frozen_string_literal: true
+
+require "securerandom"
+require "time"
+
+module Igniter
+  class App
+    module Credentials
+      class LeaseRequest < Igniter::DTO::Record
+        field :request_id, default: -> { SecureRandom.uuid }, coerce: ->(value) { value.to_s }
+        field :credential, required: true, coerce: :normalize_credential
+        field :requested_scope, default: :remote, coerce: ->(value) { value.to_sym }
+        field :node, coerce: ->(value) { value&.to_s }
+        field :target_node, required: true, coerce: ->(value) { value.to_s }
+        field :actor, coerce: ->(value) { value&.to_s }
+        field :origin, coerce: ->(value) { value&.to_s }
+        field :source, required: true, coerce: ->(value) { value&.to_sym }
+        field :reason, coerce: ->(value) { value&.to_sym }
+        field :lease_id, coerce: ->(value) { value&.to_s }
+        field :requested_at, default: -> { Time.now.utc.iso8601 }, coerce: :normalize_timestamp
+        field :metadata, default: -> { {} }, coerce: :normalize_metadata, merge: true
+
+        def initialize(**attributes)
+          normalized = self.class.send(:normalize_input_attributes, attributes)
+          normalized[:credential] = self.class.send(:normalize_credential, normalized[:credential]) if normalized.key?(:credential)
+          if normalized[:node].nil? && normalized[:credential].respond_to?(:node)
+            normalized[:node] = normalized[:credential].node
+          end
+
+          super(**normalized)
+        end
+
+        def credential_key
+          credential.key
+        end
+
+        def policy_name
+          credential.policy.name
+        end
+
+        def policy
+          credential.policy
+        end
+
+        def policy_allows_request?
+          credential.allowed_in_scope?(requested_scope)
+        end
+
+        def local_request?
+          requested_scope == :local
+        end
+
+        def remote_request?
+          !local_request?
+        end
+
+        def request_event
+          build_event(:lease_requested, timestamp: requested_at)
+        end
+
+        def issue_event(lease_id: nil, actor: nil, origin: nil, source: nil, metadata: {}, timestamp: Time.now.utc.iso8601)
+          build_event(
+            :lease_issued,
+            lease_id: lease_id || self.lease_id,
+            actor: actor || self.actor,
+            origin: origin || self.origin,
+            source: source || self.source,
+            metadata: self.metadata.merge(self.class.send(:normalize_metadata, metadata)),
+            timestamp: timestamp
+          )
+        end
+
+        def deny_event(reason:, actor: nil, origin: nil, source: nil, metadata: {}, timestamp: Time.now.utc.iso8601)
+          build_event(
+            :lease_denied,
+            actor: actor || self.actor,
+            origin: origin || self.origin,
+            source: source || self.source,
+            reason: reason,
+            metadata: self.metadata.merge(self.class.send(:normalize_metadata, metadata)),
+            timestamp: timestamp
+          )
+        end
+
+        def revoke_event(lease_id: nil, reason: nil, actor: nil, origin: nil, source: nil, metadata: {}, timestamp: Time.now.utc.iso8601)
+          build_event(
+            :lease_revoked,
+            lease_id: lease_id || self.lease_id,
+            actor: actor || self.actor,
+            origin: origin || self.origin,
+            source: source || self.source,
+            reason: reason || self.reason,
+            metadata: self.metadata.merge(self.class.send(:normalize_metadata, metadata)),
+            timestamp: timestamp
+          )
+        end
+
+        private
+
+        def build_event(event_name, lease_id: self.lease_id, actor: self.actor, origin: self.origin,
+                        source: self.source, reason: self.reason, metadata: self.metadata,
+                        timestamp: Time.now.utc.iso8601)
+          Events::CredentialEvent.new(
+            event: event_name,
+            credential_key: credential_key,
+            policy_name: policy_name,
+            node: node,
+            target_node: target_node,
+            lease_id: lease_id,
+            actor: actor,
+            origin: origin,
+            source: source,
+            reason: reason,
+            timestamp: timestamp,
+            metadata: metadata.merge(
+              credential_provider: credential.provider,
+              requested_scope: requested_scope,
+              request_id: request_id
+            )
+          )
+        end
+
+        def self.normalize_credential(value)
+          case value
+          when Credential
+            value
+          when Hash
+            Credential.from_h(value)
+          else
+            raise ArgumentError, "credential must be a Credential or Hash"
+          end
+        end
+
+        def self.normalize_timestamp(value)
+          case value
+          when Time
+            value.utc.iso8601
+          else
+            Time.parse(value.to_s).utc.iso8601
+          end
+        rescue ArgumentError
+          Time.now.utc.iso8601
+        end
+
+        def self.normalize_metadata(hash)
+          (hash || {}).each_with_object({}) do |(key, value), memo|
+            memo[key.to_sym] = value
+          end.freeze
+        end
+      end
+    end
+  end
+end

data/packages/igniter-app/lib/igniter/app/credentials/policies/ephemeral_lease_policy.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module Igniter
+  class App
+    module Credentials
+      module Policies
+        class EphemeralLeasePolicy < CredentialPolicy
+          def initialize(**overrides)
+            defaults = {
+              name: :ephemeral_lease,
+              label: "Ephemeral Lease",
+              secret_class: :ephemeral_lease,
+              propagation: :ephemeral,
+              route_over_replicate: true,
+              weak_trust_behavior: :deny,
+              operator_approval_required: true,
+              description: "Credentials may be issued as bounded, auditable leases rather than replicated as long-lived secrets.",
+              metadata: {
+                lease_mode: :ephemeral,
+                declared_only: true,
+                notes: [
+                  "Use leases for bounded cross-node work, not for normal secret fan-out.",
+                  "Leases should be auditable, revocable, and time-bounded.",
+                  "This policy is a declared contract foundation before transport is implemented."
+                ]
+              }
+            }
+
+            super(**defaults.merge(overrides))
+          end
+        end
+      end
+    end
+  end
+end

data/packages/igniter-app/lib/igniter/app/credentials/policies/local_only_policy.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+module Igniter
+  class App
+    module Credentials
+      module Policies
+        class LocalOnlyPolicy < CredentialPolicy
+          def initialize(**overrides)
+            defaults = {
+              name: :local_only,
+              label: "Local Only",
+              secret_class: :local_only,
+              propagation: :disabled,
+              route_over_replicate: true,
+              weak_trust_behavior: :deny,
+              operator_approval_required: true,
+              description: "Credentials stay node-local by default. Prefer routing work to credential-owning nodes over copying secrets.",
+              metadata: {
+                notes: [
+                  "No automatic cross-node credential propagation.",
+                  "Weakly trusted nodes should not receive long-lived external credentials.",
+                  "Route work before considering any secret replication."
+                ]
+              }
+            }
+
+            super(**defaults.merge(overrides))
+          end
+        end
+      end
+    end
+  end
+end

data/packages/igniter-app/lib/igniter/app/credentials/policies.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+require_relative "policies/local_only_policy"
+require_relative "policies/ephemeral_lease_policy"
+
+module Igniter
+  class App
+    module Credentials
+      module Policies
+      end
+    end
+  end
+end

data/packages/igniter-app/lib/igniter/app/credentials/store.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module Igniter
+  class App
+    module Credentials
+      class Store
+        def append(_event)
+          raise NotImplementedError, "#{self.class}#append not implemented"
+        end
+
+        def load_events
+          raise NotImplementedError, "#{self.class}#load_events not implemented"
+        end
+
+        def clear!
+          raise NotImplementedError, "#{self.class}#clear! not implemented"
+        end
+      end
+    end
+  end
+end

data/packages/igniter-app/lib/igniter/app/credentials/stores/file_store.rb

@@ -0,0 +1,114 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require "json"
+
+module Igniter
+  class App
+    module Credentials
+      module Stores
+        class FileStore < Store
+          attr_reader :path, :max_events, :archive_path
+
+          def initialize(path:, max_events: nil, archive_path: nil)
+            @path = path
+            @max_events = max_events&.to_i
+            @archive_path = archive_path
+            FileUtils.mkdir_p(File.dirname(path))
+            FileUtils.mkdir_p(File.dirname(archive_path)) if archive_path
+          end
+
+          def append(event)
+            File.open(path, "a") do |file|
+              file.puts(JSON.generate(event))
+            end
+            rotate_if_needed!
+            event
+          end
+
+          def load_events
+            return [] unless File.exist?(path)
+
+            File.readlines(path, chomp: true).filter_map do |line|
+              next if line.strip.empty?
+
+              deep_symbolize(JSON.parse(line))
+            rescue JSON::ParserError
+              next
+            end
+          end
+
+          def clear!
+            FileUtils.rm_f(path)
+            FileUtils.rm_f(archive_path) if archive_path
+            self
+          end
+
+          def retained_limit
+            max_events
+          end
+
+          def prune_events(events)
+            return Array(events) unless max_events && max_events.positive?
+            return Array(events) if events.size <= max_events
+
+            Array(events).last(max_events).map { |event| deep_symbolize(event) }
+          end
+
+          def persistence_metadata
+            {
+              enabled: true,
+              store_class: self.class.name,
+              path: path,
+              max_events: max_events,
+              archive_path: archive_path,
+              archived_events: archived_events_count
+            }.compact
+          end
+
+          private
+
+          def deep_symbolize(value)
+            case value
+            when Hash
+              value.each_with_object({}) do |(key, nested), memo|
+                memo[key.to_sym] = deep_symbolize(nested)
+              end
+            when Array
+              value.map { |item| deep_symbolize(item) }
+            else
+              value
+            end
+          end
+
+          def rotate_if_needed!
+            return unless max_events && max_events.positive?
+            return unless File.exist?(path)
+
+            lines = File.readlines(path, chomp: true).reject(&:empty?)
+            return if lines.size <= max_events
+
+            overflow = lines[0...(lines.size - max_events)]
+            retained = lines.last(max_events)
+            append_archive_lines(overflow)
+            File.write(path, retained.empty? ? "" : "#{retained.join("\n")}\n")
+          end
+
+          def append_archive_lines(lines)
+            return if lines.empty? || archive_path.nil?
+
+            File.open(archive_path, "a") do |file|
+              lines.each { |line| file.puts(line) }
+            end
+          end
+
+          def archived_events_count
+            return 0 unless archive_path && File.exist?(archive_path)
+
+            File.foreach(archive_path).count
+          end
+        end
+      end
+    end
+  end
+end