@feltdb/core 0.12.2 → 0.15.0

package/dist/create/server-source/crates/feltdb-server/src/auth.rs

@@ -181,6 +181,34 @@ impl KeyStore {
             })
     }
 
+    /// The current scopes and subject type of an active key, by id.
+    ///
+    /// Work executed after its request — an autonomous run — re-reads its
+    /// principal here, so a key revoked or narrowed since the run was created
+    /// is not honoured at its old breadth. `None` when the key is unknown,
+    /// revoked, or not valid for `namespace`.
+    pub fn active_scopes(&self, key_id: &str, namespace: &str) -> Option<(Vec<String>, String)> {
+        let records = self.records.read().ok()?;
+        records
+            .iter()
+            .find(|record| {
+                record.id == key_id
+                    && !record.revoked
+                    && record
+                        .namespaces
+                        .iter()
+                        .any(|allowed| allowed == "*" || allowed == namespace)
+            })
+            .map(|record| {
+                let kind = if record.worker_id.is_some() {
+                    "worker"
+                } else {
+                    "service"
+                };
+                (record.scopes.clone(), kind.to_string())
+            })
+    }
+
     pub fn create(
         &self,
         name: String,
@@ -202,35 +230,13 @@ impl KeyStore {
         namespaces: Vec<String>,
         worker_id: Option<String>,
     ) -> Result<CreatedApiKey, String> {
-        let secret: String = rand::thread_rng()
-            .sample_iter(&Alphanumeric)
-            .take(48)
-            .map(char::from)
-            .collect();
-        let token = format!("fdb_live_{secret}");
-        // Service keys are high-entropy random secrets, not user-selected
-        // passwords. A deterministic digest keeps them out of the credential
-        // store without imposing Argon2's CPU cost on every API request.
-        let hash = hash_api_key(&token);
-        let id: String = rand::thread_rng()
-            .sample_iter(&Alphanumeric)
-            .take(12)
-            .map(char::from)
-            .collect();
+        let (record, created) = new_record(name, scopes, namespaces, worker_id);
         self.records
             .write()
             .map_err(|_| "API key store lock poisoned".to_string())?
-            .push(ApiKeyRecord {
-                id: id.clone(),
-                name,
-                hash,
-                scopes,
-                namespaces,
-                revoked: false,
-                worker_id,
-            });
+            .push(record);
         self.persist()?;
-        Ok(CreatedApiKey { id, secret: token })
+        Ok(created)
     }
 
     pub fn list(&self) -> Result<Vec<ApiKeySummary>, String> {
@@ -249,6 +255,46 @@ impl KeyStore {
             .collect())
     }
 
+    /// The listing entry of one key — never its secret or digest.
+    pub fn summary(&self, id: &str) -> Option<ApiKeySummary> {
+        self.list()
+            .ok()?
+            .into_iter()
+            .find(|summary| summary.id == id)
+    }
+
+    /// Replace a key: issue a new secret with the same name, scopes, namespaces
+    /// and worker identity, and revoke the old key in the same store write.
+    ///
+    /// The new secret is returned once and is never stored or listed. `None`
+    /// when no active key has this id.
+    pub fn rotate(&self, id: &str) -> Result<Option<CreatedApiKey>, String> {
+        let created = {
+            let mut records = self
+                .records
+                .write()
+                .map_err(|_| "API key store lock poisoned".to_string())?;
+            let Some(old) = records
+                .iter_mut()
+                .find(|record| record.id == id && !record.revoked)
+            else {
+                return Ok(None);
+            };
+            old.revoked = true;
+            let (name, scopes, namespaces, worker_id) = (
+                old.name.clone(),
+                old.scopes.clone(),
+                old.namespaces.clone(),
+                old.worker_id.clone(),
+            );
+            let (record, created) = new_record(name, scopes, namespaces, worker_id);
+            records.push(record);
+            created
+        };
+        self.persist()?;
+        Ok(Some(created))
+    }
+
     pub fn revoke(&self, id: &str) -> Result<bool, String> {
         let found = {
             let mut records = self
@@ -280,6 +326,13 @@ impl KeyStore {
             .map_err(|_| "API key store lock poisoned".to_string())?;
         let bytes = serde_json::to_vec_pretty(&*records).map_err(|error| error.to_string())?;
         fs::write(&temporary, bytes).map_err(|error| error.to_string())?;
+        // Digests, not secrets, but still credential material: owner-only.
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            fs::set_permissions(&temporary, fs::Permissions::from_mode(0o600))
+                .map_err(|error| error.to_string())?;
+        }
         fs::rename(&temporary, &self.path).map_err(|error| error.to_string())?;
         Ok(())
     }
@@ -289,6 +342,41 @@ impl KeyStore {
     }
 }
 
+fn new_record(
+    name: String,
+    scopes: Vec<String>,
+    namespaces: Vec<String>,
+    worker_id: Option<String>,
+) -> (ApiKeyRecord, CreatedApiKey) {
+    let secret: String = rand::thread_rng()
+        .sample_iter(&Alphanumeric)
+        .take(48)
+        .map(char::from)
+        .collect();
+    let token = format!("fdb_live_{secret}");
+    // Service keys are high-entropy random secrets, not user-selected
+    // passwords. A deterministic digest keeps them out of the credential
+    // store without imposing Argon2's CPU cost on every API request.
+    let hash = hash_api_key(&token);
+    let id: String = rand::thread_rng()
+        .sample_iter(&Alphanumeric)
+        .take(12)
+        .map(char::from)
+        .collect();
+    (
+        ApiKeyRecord {
+            id: id.clone(),
+            name,
+            hash,
+            scopes,
+            namespaces,
+            revoked: false,
+            worker_id,
+        },
+        CreatedApiKey { id, secret: token },
+    )
+}
+
 fn hash_api_key(token: &str) -> String {
     let digest = Sha256::digest(token.as_bytes());
     let encoded = digest

package/dist/create/server-source/crates/feltdb-server/src/backup.rs

@@ -166,6 +166,10 @@ pub fn server_artifacts(data: &Path, keys: &Path, audit: &Path) -> Vec<(String,
             "revoked-sessions.json".into(),
             data.with_extension("revoked-sessions.json"),
         ),
+        (
+            "console-accounts.json".into(),
+            data.with_extension("console-accounts.json"),
+        ),
         ("api-keys.json".into(), keys.to_path_buf()),
         ("audit.log".into(), audit.to_path_buf()),
     ]