@feltdb/core 0.12.2 → 0.15.0

package/dist/create/server-source/crates/feltdb-server/src/redaction.rs

@@ -0,0 +1,208 @@
+//! Credential redaction for everything the server writes outward: log lines,
+//! error responses and diagnostics.
+//!
+//! Redaction is by shape, not by knowing the secret: FeltDB service keys
+//! (`fdb_live_…`), end-user session tokens (`session_token_…`), `Bearer`
+//! credentials, credential-named query parameters (`token=`, `access_token=`,
+//! `api_key=`, `secret=`, `password=`, …), signed console session cookies
+//! (`feltdb_session=`), and the password of a `scheme://user:password@host`
+//! connection string. Each is replaced by `[REDACTED]`, keeping the prefix so
+//! an operator can still tell what kind of credential was there.
+
+use std::{borrow::Cow, io};
+
+pub const REDACTED: &str = "[REDACTED]";
+
+const PREFIXED: &[&str] = &["fdb_live_", "session_token_"];
+const ASSIGNED: &[&str] = &[
+    "access_token=",
+    "token=",
+    "api_key=",
+    "apikey=",
+    "api-key=",
+    "secret=",
+    "password=",
+    "passwd=",
+    "feltdb_session=",
+    "x-feltdb-intent-service=",
+];
+
+fn credential_char(byte: u8) -> bool {
+    byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_' | b'.' | b'~' | b'+' | b'/' | b'=' | b'%')
+}
+
+/// Whether `text` may hold something [`redact`] would change. Cheap; lets hot
+/// paths skip the copy.
+pub fn may_contain_credential(text: &str) -> bool {
+    let lower = text.to_ascii_lowercase();
+    PREFIXED.iter().any(|prefix| lower.contains(prefix))
+        || ASSIGNED.iter().any(|name| lower.contains(name))
+        || lower.contains("bearer ")
+        || lower.contains("://")
+}
+
+/// Replace every credential-shaped span in `text` with `[REDACTED]`.
+pub fn redact(text: &str) -> Cow<'_, str> {
+    if !may_contain_credential(text) {
+        return Cow::Borrowed(text);
+    }
+    let bytes = text.as_bytes();
+    let lower = text.to_ascii_lowercase();
+    let lower = lower.as_bytes();
+    let mut out = String::with_capacity(text.len());
+    let mut index = 0;
+    let mut changed = false;
+    'scan: while index < bytes.len() {
+        // `fdb_live_…`, `session_token_…`: keep the prefix, drop the material.
+        for prefix in PREFIXED {
+            if lower[index..].starts_with(prefix.as_bytes()) {
+                let start = index + prefix.len();
+                let mut end = start;
+                while end < bytes.len() && bytes[end].is_ascii_alphanumeric() {
+                    end += 1;
+                }
+                if end > start {
+                    out.push_str(&text[index..start]);
+                    out.push_str(REDACTED);
+                    index = end;
+                    changed = true;
+                    continue 'scan;
+                }
+            }
+        }
+        // `Bearer <credential>`
+        if lower[index..].starts_with(b"bearer ") && (index == 0 || !bytes[index - 1].is_ascii_alphanumeric()) {
+            let start = index + "bearer ".len();
+            let mut end = start;
+            while end < bytes.len() && credential_char(bytes[end]) {
+                end += 1;
+            }
+            // Prose ("valid bearer API key") is not a credential; issued
+            // tokens are far longer than any English word.
+            if end - start >= 12 && !text[start..end].starts_with(REDACTED) {
+                out.push_str(&text[index..start]);
+                out.push_str(REDACTED);
+                index = end;
+                changed = true;
+                continue 'scan;
+            }
+        }
+        // `token=<value>` and friends, at a word boundary.
+        if index == 0 || !bytes[index - 1].is_ascii_alphanumeric() {
+            for name in ASSIGNED {
+                if lower[index..].starts_with(name.as_bytes()) {
+                    let start = index + name.len();
+                    let mut end = start;
+                    while end < bytes.len() && credential_char(bytes[end]) && bytes[end] != b'&' {
+                        end += 1;
+                    }
+                    if end > start {
+                        out.push_str(&text[index..start]);
+                        out.push_str(REDACTED);
+                        index = end;
+                        changed = true;
+                        continue 'scan;
+                    }
+                }
+            }
+        }
+        // `scheme://user:password@host` — redact the password.
+        if lower[index..].starts_with(b"://") {
+            let authority_start = index + 3;
+            let mut end = authority_start;
+            while end < bytes.len() && !matches!(bytes[end], b'/' | b'@' | b' ' | b'"' | b'\'' | b'?' | b'#' | b'\n') {
+                end += 1;
+            }
+            if end < bytes.len() && bytes[end] == b'@' {
+                if let Some(colon) = text[authority_start..end].find(':') {
+                    let password_start = authority_start + colon + 1;
+                    if password_start < end {
+                        out.push_str(&text[index..password_start]);
+                        out.push_str(REDACTED);
+                        index = end;
+                        changed = true;
+                        continue 'scan;
+                    }
+                }
+            }
+        }
+        let next = text[index..].chars().next().map_or(1, char::len_utf8);
+        out.push_str(&text[index..index + next]);
+        index += next;
+    }
+    if changed {
+        Cow::Owned(out)
+    } else {
+        Cow::Borrowed(text)
+    }
+}
+
+/// A `tracing_subscriber` writer that redacts each formatted event before it
+/// reaches stdout. The fmt layer writes one event per `write` call, so a
+/// credential never straddles two calls.
+#[derive(Clone, Copy, Default)]
+pub struct RedactingStdout;
+
+pub struct RedactingWriter(io::Stdout);
+
+impl io::Write for RedactingWriter {
+    fn write(&mut self, buffer: &[u8]) -> io::Result<usize> {
+        match std::str::from_utf8(buffer) {
+            Ok(text) => {
+                self.0.write_all(redact(text).as_bytes())?;
+            }
+            Err(_) => self.0.write_all(buffer)?,
+        }
+        Ok(buffer.len())
+    }
+    fn flush(&mut self) -> io::Result<()> {
+        self.0.flush()
+    }
+}
+
+impl<'a> tracing_subscriber::fmt::MakeWriter<'a> for RedactingStdout {
+    type Writer = RedactingWriter;
+    fn make_writer(&'a self) -> Self::Writer {
+        RedactingWriter(io::stdout())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn redacts_every_credential_shape() {
+        let key = ["fdb", "live", "Q7rT2mXk9LpA4sVb8NcY1wEz6HdJ3uFg5KoR0iPq"].join("_");
+        let cases = [
+            (format!("invalid type: string \"{key}\", expected a sequence"), "fdb_live_[REDACTED]"),
+            (format!("authorization: Bearer {key}"), "Bearer [REDACTED]"),
+            ("authorization: bearer session_token_abc123XYZ".to_string(), "bearer [REDACTED]"),
+            ("GET /v1/events?access_token=abc.def-ghi&cursor=fh1-00".to_string(), "access_token=[REDACTED]&cursor=fh1-00"),
+            ("uri=/x?token=s3cr3t".to_string(), "token=[REDACTED]"),
+            ("client_secret=s3cr3t".to_string(), "client_secret=[REDACTED]"),
+            ("cookie: feltdb_session=eyJ2.c2ln".to_string(), "feltdb_session=[REDACTED]"),
+            ("postgres://app:hunter2@db.internal/feltdb".to_string(), "postgres://app:[REDACTED]@db.internal/feltdb"),
+        ];
+        for (input, expected) in cases {
+            let output = redact(&input);
+            assert!(output.contains(expected), "{input} -> {output}");
+            assert!(!output.contains("hunter2") && !output.contains("s3cr3t") && !output.contains(&key[9..]));
+        }
+    }
+
+    #[test]
+    fn leaves_ordinary_text_alone() {
+        for text in [
+            "missing scope keys:admin",
+            "valid bearer API key required",
+            "https://api.feltdb.com/v1/status",
+            "tokens: 3, key_id=abc",
+            "the token budget",
+            "fdb_live_ prefix",
+        ] {
+            assert_eq!(redact(text), text);
+        }
+        assert!(matches!(redact("plain"), Cow::Borrowed(_)));
+    }
+}

package/dist/create/server-source/crates/feltdb-server/src/tenancy.rs

@@ -10,7 +10,6 @@ use argon2::{
     password_hash::{rand_core::OsRng, PasswordHash, PasswordHasher, PasswordVerifier, SaltString},
     Argon2,
 };
-use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine};
 use rand::{distributions::Alphanumeric, Rng};
 use serde::{Deserialize, Serialize};
 
@@ -192,23 +191,24 @@ fn slug(value: &str) -> String {
         .collect::<Vec<_>>()
         .join("-")
 }
-fn platform_owner_user(user_id: &str) -> bool {
+/// Whether `user_id` is a platform owner: the platform user registered under
+/// that id has an identity listed in `FELTDB_PLATFORM_OWNERS`. Before 0.15.0
+/// this compared `user_id` with an id derived from a prefix of each owner's
+/// identity, so any identity sharing that prefix was an owner too.
+fn platform_owner_user(records: &PlatformRecords, user_id: &str) -> bool {
+    let Some(identity) = records
+        .users
+        .iter()
+        .find(|user| user.user_id == user_id)
+        .map(|user| user.identity.as_str())
+    else {
+        return false;
+    };
     std::env::var("FELTDB_PLATFORM_OWNERS")
         .unwrap_or_default()
         .split(',')
         .map(|owner| owner.trim().to_lowercase())
-        .filter(|owner| !owner.is_empty())
-        .map(|owner| {
-            format!(
-                "user_{}",
-                URL_SAFE_NO_PAD
-                    .encode(owner)
-                    .chars()
-                    .take(18)
-                    .collect::<String>()
-            )
-        })
-        .any(|owner_id| owner_id == user_id)
+        .any(|owner| !owner.is_empty() && owner == identity)
 }
 
 pub fn tenant_role_grants() -> Vec<RoleGrant> {
@@ -424,6 +424,100 @@ impl TenancyStore {
         );
         self.persist(&records)
     }
+    /// The application an active service key is bound to, if any.
+    pub fn service_binding(&self, service_id: &str) -> Option<ApplicationServicePrincipal> {
+        self.records
+            .read()
+            .ok()?
+            .application_service_principals
+            .iter()
+            .find(|principal| {
+                principal.service_id == service_id && principal.status == MembershipStatus::Active
+            })
+            .cloned()
+    }
+
+    /// The application record, without an authorization decision. Callers
+    /// must have authorized the caller for this application already.
+    pub fn application_record(&self, application_id: &str) -> Option<Application> {
+        self.records
+            .read()
+            .ok()?
+            .applications
+            .iter()
+            .find(|app| app.id == application_id)
+            .cloned()
+    }
+
+    /// Ids of the active service keys bound to one application.
+    pub fn application_service_ids(&self, application_id: &str) -> Vec<String> {
+        self.records
+            .read()
+            .map(|records| {
+                records
+                    .application_service_principals
+                    .iter()
+                    .filter(|principal| {
+                        principal.application_id == application_id
+                            && principal.status == MembershipStatus::Active
+                    })
+                    .map(|principal| principal.service_id.clone())
+                    .collect()
+            })
+            .unwrap_or_default()
+    }
+
+    /// Move an application binding from a rotated-out key to its replacement,
+    /// or end it when the key is revoked (`replacement` of `None`).
+    ///
+    /// The caller has already authorized the actor for the bound application;
+    /// this records the change and its audit event.
+    pub fn transfer_application_service(
+        &self,
+        actor: &str,
+        service_id: &str,
+        replacement: Option<&str>,
+    ) -> Result<(), String> {
+        let mut records = self
+            .records
+            .write()
+            .map_err(|_| "tenancy store lock poisoned")?;
+        let Some(index) = records
+            .application_service_principals
+            .iter()
+            .position(|principal| {
+                principal.service_id == service_id && principal.status == MembershipStatus::Active
+            })
+        else {
+            return Ok(());
+        };
+        records.application_service_principals[index].status = MembershipStatus::Revoked;
+        let bound = records.application_service_principals[index].clone();
+        if let Some(replacement) = replacement {
+            records
+                .application_service_principals
+                .push(ApplicationServicePrincipal {
+                    service_id: replacement.into(),
+                    created_by: actor.into(),
+                    created_at: now(),
+                    status: MembershipStatus::Active,
+                    ..bound.clone()
+                });
+        }
+        Self::audit(
+            &mut records,
+            if replacement.is_some() {
+                "application.service.rotated"
+            } else {
+                "application.service.revoked"
+            },
+            actor,
+            &bound.tenant_id,
+            Some(&bound.application_id),
+            service_id,
+        );
+        self.persist(&records)
+    }
     fn persist(&self, records: &PlatformRecords) -> Result<(), String> {
         if let Some(parent) = self.path.parent() {
             fs::create_dir_all(parent).map_err(|error| error.to_string())?;
@@ -506,18 +600,60 @@ impl TenancyStore {
             .records
             .write()
             .map_err(|_| "tenancy store lock poisoned")?;
-        if records.users.iter().any(|user| user.user_id == user_id) {
-            return Ok(());
+        let identity_normalized = identity.trim().to_lowercase();
+        if let Some(existing) = records.users.iter().find(|user| user.user_id == user_id) {
+            // One user id is one identity. Before 0.15.0 a second identity
+            // that derived the same id silently shared the first one's
+            // tenants; refuse instead.
+            if existing.identity == identity_normalized {
+                return Ok(());
+            }
+            return Err(format!(
+                "platform user {user_id} is registered to a different identity"
+            ));
         }
         records.users.push(PlatformUser {
             user_id: user_id.into(),
-            identity: identity.trim().to_lowercase(),
+            identity: identity_normalized,
             status: MembershipStatus::Active,
             created_at: now(),
         });
         self.persist(&records)
     }
 
+    pub fn platform_user_exists(&self, user_id: &str) -> bool {
+        self.records
+            .read()
+            .is_ok_and(|records| records.users.iter().any(|user| user.user_id == user_id))
+    }
+
+    /// The identity a platform user was registered with.
+    pub fn platform_user_identity(&self, user_id: &str) -> Option<String> {
+        self.records.read().ok().and_then(|records| {
+            records
+                .users
+                .iter()
+                .find(|user| user.user_id == user_id)
+                .map(|user| user.identity.clone())
+        })
+    }
+
+    /// User ids of platform users registered with `identity` (normalized).
+    pub fn platform_users_with_identity(&self, identity: &str) -> Vec<String> {
+        let identity = identity.trim().to_lowercase();
+        self.records
+            .read()
+            .map(|records| {
+                records
+                    .users
+                    .iter()
+                    .filter(|user| user.identity == identity)
+                    .map(|user| user.user_id.clone())
+                    .collect()
+            })
+            .unwrap_or_default()
+    }
+
     pub fn platform_update_user(
         &self,
         actor: &str,
@@ -1037,7 +1173,9 @@ impl TenancyStore {
         if !self.platform_user_active(user_id) {
             return false;
         }
-        if platform_owner_user(user_id) {
+        if self.records.read().is_ok_and(|records| {
+            platform_owner_user(&records, user_id)
+        }) {
             return self
                 .records
                 .read()
@@ -1112,7 +1250,7 @@ impl TenancyStore {
         {
             return false;
         }
-        if platform_owner_user(user_id) {
+        if platform_owner_user(&records, user_id) {
             return true;
         }
         let memberships: Vec<Membership> = records
@@ -1311,6 +1449,47 @@ mod tests {
         TenancyStore::load(path).unwrap()
     }
 
+    #[test]
+    fn a_user_id_is_never_shared_by_two_identities() {
+        let store = store("platform-user-identity");
+        store
+            .register_platform_user("user_shared", "first@example.com")
+            .unwrap();
+        // Same identity (normalized) is idempotent.
+        store
+            .register_platform_user("user_shared", " First@Example.com ")
+            .unwrap();
+        let refused = store
+            .register_platform_user("user_shared", "second@example.com")
+            .unwrap_err();
+        assert!(refused.contains("different identity"), "{refused}");
+        assert_eq!(
+            store.platform_user_identity("user_shared").as_deref(),
+            Some("first@example.com")
+        );
+    }
+
+    #[test]
+    fn platform_ownership_follows_the_registered_identity_not_an_id_prefix() {
+        let store = store("platform-owner-identity");
+        let owner_id = crate::console_accounts::legacy_user_id("owner-account@example.com");
+        // An identity that shares the owner's 13-character prefix used to derive
+        // the owner's id; it is registered first under that id here.
+        store
+            .register_platform_user(&owner_id, "owner-account@evil.example")
+            .unwrap();
+        let tenant = store.create_tenant("user_someone_else", "Victim").unwrap();
+        std::env::set_var("FELTDB_PLATFORM_OWNERS", "owner-account@example.com");
+        let colliding = store.authorize_tenant(&owner_id, &tenant.id, "applications:read");
+        store
+            .register_platform_user("user_real_owner", "owner-account@example.com")
+            .unwrap();
+        let genuine = store.authorize_tenant("user_real_owner", &tenant.id, "applications:read");
+        std::env::remove_var("FELTDB_PLATFORM_OWNERS");
+        assert!(!colliding, "an id-prefix collision must not confer platform ownership");
+        assert!(genuine, "the owner's registered identity confers platform ownership");
+    }
+
     #[test]
     fn tenant_and_application_are_isolated() {
         let store = store("isolation");