@feltdb/core 0.13.0 → 0.15.0

package/dist/create/server-source/crates/feltdb-client/Cargo.toml

@@ -16,7 +16,7 @@ exclude = ["tests/", "target/"]
 # The wire types are the server's own: the request and response documents are defined once, in
 # `feltdb`, and both sides serialize the same structs. Exact, because the modules they come from are
 # not yet covered by `feltdb`'s compatibility policy; the workspace releases both at one version.
-feltdb = { version = "=0.2.2", path = "../feltdb" }
+feltdb = { version = "=0.3.0", path = "../feltdb" }
 reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"

package/dist/create/server-source/crates/feltdb-server/Cargo.toml

@@ -24,7 +24,7 @@ hmac = "0.12"
 # Exact: the server uses `unstable-internals`, which carries no semver promise, so a release of
 # this crate is built against the one `feltdb` release it was tested with. The workspace shares one
 # version, so this moves with every release (a mismatch fails to resolve, it cannot drift silently).
-feltdb = { version = "=0.2.2", path = "../feltdb", features = ["unstable-internals"] }
+feltdb = { version = "=0.3.0", path = "../feltdb", features = ["unstable-internals"] }
 futures-core = "0.3"
 rand = "0.8"
 ring = "0.17"

package/dist/create/server-source/crates/feltdb-server/README.md

@@ -53,7 +53,12 @@ Implemented in this slice:
 - collection list/create/get/update/delete endpoints
 - `GET /events` as a server-sent event stream
 - durable, hashed API keys with namespace and `state:read`, `state:write`, or `events:read` scopes
-- `GET /metrics` request, authorization, state, and event counters
+- `GET /metrics` request, authorization, state, and event counters (requires `operator:read`)
+- `GET /v1/status` operator status: release identity, a write/fsync/read-back storage probe, the
+  last recorded backup and the last verified restore (requires `operator:read`)
+- `/api/keys` listing (never secrets), issuing, `POST /api/keys/{id}/rotate` and revocation
+  (requires `keys:admin`; a caller can never delegate a scope it does not hold). See
+  [`docs/reference/managed-operator-surface.md`](../../docs/reference/managed-operator-surface.md).
 - authenticated `POST /sync/pull` and `POST /sync/push` operation exchange
 - durable, transitive operation history with content-hash verification, deduplication, and gap rejection
 

package/dist/create/server-source/crates/feltdb-server/src/app_state.rs

@@ -21,7 +21,7 @@ use crate::{
     auth::KeyStore, canonical_principals::CanonicalPrincipalAuthority,
     causal::CanonicalEventAuthority,
     clock::LeaseClock, cluster::ClusterStore,
-    connections::ConnectionStore, content::ContentStore, identity::IdentityStore,
+    connections::ConnectionStore, console_accounts::ConsoleAccountStore, content::ContentStore, identity::IdentityStore,
     leases::LeaseStore, metrics::Metrics, portable_bundle::BundleStore,
     providers::ProviderStore, releases::ReleaseStore, sessions::SessionVerifier,
     tenancy::TenancyStore,
@@ -60,6 +60,12 @@ pub struct AppState {
     /// arbiter; this semaphore only bounds pre-commit working memory.
     pub state_transaction_admission: Arc<tokio::sync::Semaphore>,
     pub worker_enabled: bool,
+    /// Started with `--work-authority`: this node commits Durable Work even
+    /// with peers. See `is_work_authority`.
+    pub work_authority: bool,
+    /// A peer also reports being the Durable Work authority. Set by peer sync;
+    /// while set, this node refuses Durable Work writes (fail closed).
+    pub work_authority_conflict: Arc<std::sync::atomic::AtomicBool>,
     pub leases: LeaseStore,
     pub content: ContentStore,
     pub artifacts: ArtifactStore,
@@ -74,6 +80,8 @@ pub struct AppState {
     pub backup_artifacts: Arc<Vec<(String, PathBuf)>>,
     pub tenancy: TenancyStore,
     pub sessions: SessionVerifier,
+    /// Console (website) accounts; the only source of console user ids.
+    pub console_accounts: ConsoleAccountStore,
     pub principals: CanonicalPrincipalAuthority,
     pub connections: ConnectionStore,
     pub identities: IdentityStore,

package/dist/create/server-source/crates/feltdb-server/src/auth.rs

@@ -230,35 +230,13 @@ impl KeyStore {
         namespaces: Vec<String>,
         worker_id: Option<String>,
     ) -> Result<CreatedApiKey, String> {
-        let secret: String = rand::thread_rng()
-            .sample_iter(&Alphanumeric)
-            .take(48)
-            .map(char::from)
-            .collect();
-        let token = format!("fdb_live_{secret}");
-        // Service keys are high-entropy random secrets, not user-selected
-        // passwords. A deterministic digest keeps them out of the credential
-        // store without imposing Argon2's CPU cost on every API request.
-        let hash = hash_api_key(&token);
-        let id: String = rand::thread_rng()
-            .sample_iter(&Alphanumeric)
-            .take(12)
-            .map(char::from)
-            .collect();
+        let (record, created) = new_record(name, scopes, namespaces, worker_id);
         self.records
             .write()
             .map_err(|_| "API key store lock poisoned".to_string())?
-            .push(ApiKeyRecord {
-                id: id.clone(),
-                name,
-                hash,
-                scopes,
-                namespaces,
-                revoked: false,
-                worker_id,
-            });
+            .push(record);
         self.persist()?;
-        Ok(CreatedApiKey { id, secret: token })
+        Ok(created)
     }
 
     pub fn list(&self) -> Result<Vec<ApiKeySummary>, String> {
@@ -277,6 +255,46 @@ impl KeyStore {
             .collect())
     }
 
+    /// The listing entry of one key — never its secret or digest.
+    pub fn summary(&self, id: &str) -> Option<ApiKeySummary> {
+        self.list()
+            .ok()?
+            .into_iter()
+            .find(|summary| summary.id == id)
+    }
+
+    /// Replace a key: issue a new secret with the same name, scopes, namespaces
+    /// and worker identity, and revoke the old key in the same store write.
+    ///
+    /// The new secret is returned once and is never stored or listed. `None`
+    /// when no active key has this id.
+    pub fn rotate(&self, id: &str) -> Result<Option<CreatedApiKey>, String> {
+        let created = {
+            let mut records = self
+                .records
+                .write()
+                .map_err(|_| "API key store lock poisoned".to_string())?;
+            let Some(old) = records
+                .iter_mut()
+                .find(|record| record.id == id && !record.revoked)
+            else {
+                return Ok(None);
+            };
+            old.revoked = true;
+            let (name, scopes, namespaces, worker_id) = (
+                old.name.clone(),
+                old.scopes.clone(),
+                old.namespaces.clone(),
+                old.worker_id.clone(),
+            );
+            let (record, created) = new_record(name, scopes, namespaces, worker_id);
+            records.push(record);
+            created
+        };
+        self.persist()?;
+        Ok(Some(created))
+    }
+
     pub fn revoke(&self, id: &str) -> Result<bool, String> {
         let found = {
             let mut records = self
@@ -308,6 +326,13 @@ impl KeyStore {
             .map_err(|_| "API key store lock poisoned".to_string())?;
         let bytes = serde_json::to_vec_pretty(&*records).map_err(|error| error.to_string())?;
         fs::write(&temporary, bytes).map_err(|error| error.to_string())?;
+        // Digests, not secrets, but still credential material: owner-only.
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            fs::set_permissions(&temporary, fs::Permissions::from_mode(0o600))
+                .map_err(|error| error.to_string())?;
+        }
         fs::rename(&temporary, &self.path).map_err(|error| error.to_string())?;
         Ok(())
     }
@@ -317,6 +342,41 @@ impl KeyStore {
     }
 }
 
+fn new_record(
+    name: String,
+    scopes: Vec<String>,
+    namespaces: Vec<String>,
+    worker_id: Option<String>,
+) -> (ApiKeyRecord, CreatedApiKey) {
+    let secret: String = rand::thread_rng()
+        .sample_iter(&Alphanumeric)
+        .take(48)
+        .map(char::from)
+        .collect();
+    let token = format!("fdb_live_{secret}");
+    // Service keys are high-entropy random secrets, not user-selected
+    // passwords. A deterministic digest keeps them out of the credential
+    // store without imposing Argon2's CPU cost on every API request.
+    let hash = hash_api_key(&token);
+    let id: String = rand::thread_rng()
+        .sample_iter(&Alphanumeric)
+        .take(12)
+        .map(char::from)
+        .collect();
+    (
+        ApiKeyRecord {
+            id: id.clone(),
+            name,
+            hash,
+            scopes,
+            namespaces,
+            revoked: false,
+            worker_id,
+        },
+        CreatedApiKey { id, secret: token },
+    )
+}
+
 fn hash_api_key(token: &str) -> String {
     let digest = Sha256::digest(token.as_bytes());
     let encoded = digest

package/dist/create/server-source/crates/feltdb-server/src/backup.rs

@@ -166,6 +166,10 @@ pub fn server_artifacts(data: &Path, keys: &Path, audit: &Path) -> Vec<(String,
             "revoked-sessions.json".into(),
             data.with_extension("revoked-sessions.json"),
         ),
+        (
+            "console-accounts.json".into(),
+            data.with_extension("console-accounts.json"),
+        ),
         ("api-keys.json".into(), keys.to_path_buf()),
         ("audit.log".into(), audit.to_path_buf()),
     ]