@feltdb/core 0.13.0 → 0.16.0

package/dist/create/server-source/crates/feltdb-server/src/control_authorization.rs

@@ -0,0 +1,441 @@
+//! Control-plane (`/api/*`) and operator-route authorization.
+//!
+//! Before 0.14.1 the request middleware skipped its authorization decision for
+//! every `/api/*` path and left it to each handler. The key handlers had none,
+//! so a self-serve end-user session could list every key and mint a wildcard
+//! service key (Phase 1 managed audit, GAP-01). This module is the replacement:
+//! every control-plane route has an explicit [`Requirement`], every principal
+//! has a [`PrincipalClass`], and [`decide`] combines them before any handler
+//! runs. An `/api/*` route that is not in [`control_plane_requirement`] is
+//! refused, so a new route fails closed until someone decides who may call it.
+//!
+//! Console users (human platform sessions) carry no direct scopes: they are
+//! authorized by tenant/application membership, which the handlers evaluate
+//! through [`crate::tenancy::TenancyStore`]. Machine principals (service and
+//! worker keys) must hold the route's capability as a direct grant *and* pass
+//! the handler's tenancy check. Application end-user sessions (minted by
+//! `/v1/auth/signup` / `/v1/auth/signin`) never reach the control plane.
+
+use axum::http::Method;
+use serde_json::json;
+
+use crate::tenancy::application_role_grants;
+
+/// Who is calling, as far as control-plane authorization is concerned.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum PrincipalClass {
+    /// Authentication disabled (`--auth` not set): the development principal.
+    Development,
+    /// A service or worker API key.
+    Machine,
+    /// A human console (platform) session: membership-authorized.
+    ConsoleUser,
+    /// An application end-user session from `/v1/auth/signup` or `signin`.
+    EndUser,
+}
+
+/// What a route demands of its caller.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Requirement {
+    /// Acts only on the caller's own session or identity; any authenticated
+    /// principal may call it.
+    SelfOnly,
+    /// Machine principals need this capability as a direct grant; console users
+    /// are authorized by membership in the handler; end users are refused.
+    Capability(&'static str),
+    /// No decision exists for this route, so nobody may call it.
+    Unmapped,
+}
+
+/// A refusal with a stable reason and an actionable message.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Denial {
+    pub reason: &'static str,
+    pub message: String,
+    pub required_scope: Option<String>,
+}
+
+impl Denial {
+    pub fn new(reason: &'static str, message: impl Into<String>) -> Self {
+        Self {
+            reason,
+            message: message.into(),
+            required_scope: None,
+        }
+    }
+
+    pub fn missing_scope(scope: &str) -> Self {
+        Self {
+            reason: MISSING_SCOPE,
+            message: format!(
+                "missing scope {scope} — use a key that holds {scope}; end-user sessions cannot use the control plane"
+            ),
+            required_scope: Some(scope.to_string()),
+        }
+    }
+
+    pub fn with_scope(mut self, scope: &str) -> Self {
+        self.required_scope = Some(scope.to_string());
+        self
+    }
+
+    /// The JSON message `ApiError` turns into the response body. The wire
+    /// `code` stays the canonical `FORBIDDEN`; `reason` is the stable detail.
+    pub fn body(&self) -> String {
+        let mut body = json!({ "message": self.message, "reason": self.reason });
+        if let Some(scope) = &self.required_scope {
+            body["required_scope"] = json!(scope);
+        }
+        body.to_string()
+    }
+}
+
+pub const MISSING_SCOPE: &str = "MISSING_SCOPE";
+pub const END_USER_SESSION_FORBIDDEN: &str = "END_USER_SESSION_FORBIDDEN";
+pub const PRIVILEGE_ESCALATION_DENIED: &str = "PRIVILEGE_ESCALATION_DENIED";
+pub const APPLICATION_SCOPE_REQUIRED: &str = "APPLICATION_SCOPE_REQUIRED";
+pub const UNMAPPED_CONTROL_ROUTE: &str = "UNMAPPED_CONTROL_ROUTE";
+
+/// Key listing, creation, rotation and revocation.
+pub const KEYS_ADMIN: &str = "keys:admin";
+/// `/metrics` and `/v1/status`.
+pub const OPERATOR_READ: &str = "operator:read";
+
+fn segments(path: &str) -> Vec<&str> {
+    path.trim_matches('/').split('/').collect()
+}
+
+/// The requirement of a control-plane route, or `None` for a path outside `/api/`.
+pub fn control_plane_requirement(method: &Method, path: &str) -> Option<Requirement> {
+    if !path.starts_with("/api/") {
+        return None;
+    }
+    let get = method == Method::GET;
+    let s = segments(path);
+    use Requirement::*;
+    let requirement = match s.as_slice() {
+        ["api", "session", "revoke"] | ["api", "platform", "access"] => SelfOnly,
+        ["api", "keys"] | ["api", "keys", _] | ["api", "keys", _, "rotate"] => {
+            Capability(KEYS_ADMIN)
+        }
+        ["api", "platform"] | ["api", "platform", "users", _] => Capability("platform:admin"),
+        ["api", "platform", "applications", _, "members", _] => Capability("platform:admin"),
+        ["api", "tenants"] | ["api", "tenants", _, "applications"] => Capability(if get {
+            "applications:read"
+        } else {
+            "applications:write"
+        }),
+        ["api", "tenants", _] => Capability("applications:read"),
+        ["api", "applications", _] => Capability(if get {
+            "applications:read"
+        } else {
+            "applications:write"
+        }),
+        ["api", "applications", _, "qualification", "destroy"] => Capability("applications:write"),
+        ["api", "applications", _, "members"] => Capability("members:read"),
+        ["api", "applications", _, "invitations"] => Capability("members:invite"),
+        ["api", "applications", _, "audit"] => Capability("audit:read"),
+        ["api", "applications", _, "principals"] => Capability(if get {
+            "applications:read"
+        } else {
+            "applications:write"
+        }),
+        ["api", "principals", _, "capabilities"] => Capability("applications:write"),
+        ["api", "agents", _, "workloads"] => Capability("workloads:execute"),
+        ["api", "applications", _, "connections"] => Capability(if get {
+            "connections:read"
+        } else {
+            "connections:write"
+        }),
+        ["api", "connections", _] | ["api", "connections", _, "disable"] => {
+            Capability("connections:write")
+        }
+        ["api", "applications", _, "secrets"] => Capability(if get {
+            "applications:read"
+        } else {
+            "applications:write"
+        }),
+        ["api", "secrets", _, "rotate"] => Capability("applications:write"),
+        ["api", "applications", _, "drafts"] => Capability("application:revision:create"),
+        ["api", "applications", _, "drafts", _] => Capability(if get {
+            "application:revision:read"
+        } else {
+            "application:write"
+        }),
+        ["api", "applications", _, "drafts", _, "validate" | "commit" | "runtime"] => {
+            Capability("application:revision:create")
+        }
+        ["api", "applications", _, "drafts", _, "run"] => Capability("application:runtime:run"),
+        ["api", "applications", _, "drafts", _, "stop"] => Capability("application:runtime:stop"),
+        ["api", "applications", _, "import"] => Capability("application:revision:create"),
+        ["api", "applications", _, "runtime"] => Capability("application:revision:read"),
+        ["api", "applications", _, "revisions"]
+        | ["api", "applications", _, "revisions", _]
+        | ["api", "applications", _, "previews", _] => Capability("application:revision:read"),
+        ["api", "applications", _, "revisions", _, "diff" | "export" | "runtime"]
+        | ["api", "applications", _, "revisions", _, "validate-runtime"] => {
+            Capability("application:revision:read")
+        }
+        ["api", "applications", _, "revisions", _, "actions" | "queries" | "workflows" | "triggers"]
+            if get =>
+        {
+            Capability("application:revision:read")
+        }
+        ["api", "applications", _, "revisions", _, "preview"] => {
+            Capability("application:revision:preview")
+        }
+        ["api", "applications", _, "revisions", _, "promote"] => {
+            Capability("application:revision:promote")
+        }
+        ["api", "applications", _, "revisions", _, "run"] => Capability("application:runtime:run"),
+        ["api", "applications", _, "revisions", _, "stop"] => {
+            Capability("application:runtime:stop")
+        }
+        ["api", "applications", _, "revisions", _, "actions", _] => Capability("state:write"),
+        ["api", "applications", _, "revisions", _, "queries", _] => Capability("state:read"),
+        ["api", "applications", _, "revisions", _, "workflows", _, "run"] => {
+            Capability("workflows:run")
+        }
+        ["api", "applications", _, "environments"]
+        | ["api", "applications", _, "environments", _]
+        | ["api", "applications", _, "environments", _, "history" | "readiness"] => {
+            Capability("application:environment:read")
+        }
+        ["api", "applications", _, "environments", _, "promote"] => {
+            Capability("application:revision:promote")
+        }
+        ["api", "applications", _, "environments", _, "rollback"] => {
+            Capability("application:revision:rollback")
+        }
+        _ => Unmapped,
+    };
+    Some(requirement)
+}
+
+fn holds(scopes: &[String], required: &str) -> bool {
+    scopes.iter().any(|scope| scope == "*" || scope == required)
+}
+
+/// The middleware decision for a control-plane route.
+pub fn decide(
+    class: PrincipalClass,
+    scopes: &[String],
+    requirement: Requirement,
+) -> Result<(), Denial> {
+    match (class, requirement) {
+        (_, Requirement::Unmapped) => Err(Denial::new(
+            UNMAPPED_CONTROL_ROUTE,
+            "this control-plane route has no authorization decision and is refused",
+        )),
+        (PrincipalClass::Development, _) => Ok(()),
+        (_, Requirement::SelfOnly) => Ok(()),
+        (PrincipalClass::EndUser, Requirement::Capability(scope)) => Err(Denial::new(
+            END_USER_SESSION_FORBIDDEN,
+            "end-user sessions cannot use the control plane (/api/*) or manage keys — sign in to the console as an application member, or use a service key that holds the required scope",
+        )
+        .with_scope(scope)),
+        // Membership (tenant and application roles) is the console user's
+        // authority; every handler routed here evaluates it.
+        (PrincipalClass::ConsoleUser, Requirement::Capability(_)) => Ok(()),
+        (PrincipalClass::Machine, Requirement::Capability(scope)) => {
+            if holds(scopes, scope) {
+                Ok(())
+            } else {
+                Err(Denial::missing_scope(scope))
+            }
+        }
+    }
+}
+
+/// Scopes a credential may hold only when an operator key that holds them
+/// delegates them. A console user can never mint these, whatever its role.
+pub fn is_operator_scope(scope: &str) -> bool {
+    scope == "*"
+        || scope == KEYS_ADMIN
+        || scope == OPERATOR_READ
+        || ["cluster:", "sync:", "admin:", "backup:", "platform:", "keys:", "operator:"]
+            .iter()
+            .any(|prefix| scope.starts_with(prefix))
+        || scope.contains('*')
+}
+
+/// Application-level capabilities a console user may delegate to an
+/// application-bound key (subject to its own role in that application).
+pub fn console_delegable(scope: &str) -> bool {
+    !is_operator_scope(scope)
+        && application_role_grants()
+            .iter()
+            .flat_map(|role| role.capabilities.iter())
+            .any(|capability| capability != "*" && capability == scope)
+}
+
+/// No privilege amplification: every requested scope is already held.
+pub fn scopes_within(requested: &[String], held: &[String]) -> Result<(), Denial> {
+    match requested.iter().find(|scope| {
+        if scope.as_str() == "*" {
+            !held.iter().any(|value| value == "*")
+        } else {
+            !holds(held, scope)
+        }
+    }) {
+        Some(scope) => Err(Denial::new(
+            PRIVILEGE_ESCALATION_DENIED,
+            format!(
+                "cannot delegate scope {scope}: a caller may only grant scopes it holds itself"
+            ),
+        )),
+        None => Ok(()),
+    }
+}
+
+/// No escape from the caller's namespaces.
+pub fn namespaces_within(requested: &str, held: &[String]) -> Result<(), Denial> {
+    let allowed = if requested == "*" {
+        held.iter().any(|value| value == "*")
+    } else {
+        held.iter().any(|value| value == "*" || value == requested)
+    };
+    if allowed {
+        Ok(())
+    } else {
+        Err(Denial::new(
+            PRIVILEGE_ESCALATION_DENIED,
+            format!("cannot issue a key for namespace {requested}: it is outside the caller's namespaces"),
+        ))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn owned(values: &[&str]) -> Vec<String> {
+        values.iter().map(|value| value.to_string()).collect()
+    }
+
+    /// Every `/api/*` route the server registers. A route added to the router
+    /// without a decision here is `Unmapped` and refused; this list keeps the
+    /// mapping honest about the routes that exist today.
+    const ROUTES: &[(&str, &str)] = &[
+        ("GET", "/api/tenants"),
+        ("POST", "/api/tenants"),
+        ("GET", "/api/platform"),
+        ("PATCH", "/api/platform/users/u"),
+        ("PATCH", "/api/platform/applications/a/members/u"),
+        ("GET", "/api/tenants/t"),
+        ("GET", "/api/keys"),
+        ("POST", "/api/keys"),
+        ("DELETE", "/api/keys/k"),
+        ("POST", "/api/keys/k/rotate"),
+        ("GET", "/api/tenants/t/applications"),
+        ("POST", "/api/tenants/t/applications"),
+        ("GET", "/api/applications/a"),
+        ("PATCH", "/api/applications/a"),
+        ("DELETE", "/api/applications/a"),
+        ("POST", "/api/applications/a/qualification/destroy"),
+        ("GET", "/api/applications/a/members"),
+        ("POST", "/api/applications/a/invitations"),
+        ("GET", "/api/applications/a/audit"),
+        ("POST", "/api/applications/a/drafts"),
+        ("GET", "/api/applications/a/drafts/d"),
+        ("PUT", "/api/applications/a/drafts/d"),
+        ("POST", "/api/applications/a/drafts/d/validate"),
+        ("GET", "/api/applications/a/drafts/d/runtime"),
+        ("POST", "/api/applications/a/drafts/d/run"),
+        ("POST", "/api/applications/a/drafts/d/stop"),
+        ("POST", "/api/applications/a/drafts/d/commit"),
+        ("GET", "/api/applications/a/revisions"),
+        ("GET", "/api/applications/a/revisions/r"),
+        ("GET", "/api/applications/a/revisions/r/diff"),
+        ("POST", "/api/applications/a/revisions/r/preview"),
+        ("GET", "/api/applications/a/previews/p"),
+        ("GET", "/api/applications/a/environments"),
+        ("GET", "/api/applications/a/environments/e"),
+        ("POST", "/api/applications/a/environments/e/promote"),
+        ("POST", "/api/applications/a/environments/e/rollback"),
+        ("GET", "/api/applications/a/environments/e/history"),
+        ("GET", "/api/applications/a/environments/e/readiness"),
+        ("POST", "/api/applications/a/revisions/r/promote"),
+        ("GET", "/api/applications/a/revisions/r/export"),
+        ("POST", "/api/applications/a/import"),
+        ("GET", "/api/applications/a/runtime"),
+        ("GET", "/api/applications/a/revisions/r/runtime"),
+        ("POST", "/api/applications/a/revisions/r/validate-runtime"),
+        ("POST", "/api/applications/a/revisions/r/run"),
+        ("POST", "/api/applications/a/revisions/r/stop"),
+        ("GET", "/api/applications/a/revisions/r/actions"),
+        ("POST", "/api/applications/a/revisions/r/actions/x"),
+        ("GET", "/api/applications/a/revisions/r/queries"),
+        ("POST", "/api/applications/a/revisions/r/queries/q"),
+        ("GET", "/api/applications/a/revisions/r/workflows"),
+        ("POST", "/api/applications/a/revisions/r/workflows/w/run"),
+        ("GET", "/api/applications/a/revisions/r/triggers"),
+        ("POST", "/api/session/revoke"),
+        ("GET", "/api/platform/access"),
+        ("GET", "/api/applications/a/principals"),
+        ("POST", "/api/applications/a/principals"),
+        ("POST", "/api/principals/p/capabilities"),
+        ("POST", "/api/agents/a/workloads"),
+        ("GET", "/api/applications/a/connections"),
+        ("POST", "/api/applications/a/connections"),
+        ("GET", "/api/applications/a/secrets"),
+        ("POST", "/api/applications/a/secrets"),
+        ("POST", "/api/secrets/s/rotate"),
+        ("POST", "/api/connections/c/disable"),
+        ("DELETE", "/api/connections/c"),
+    ];
+
+    #[test]
+    fn every_registered_control_route_has_an_explicit_requirement() {
+        for (method, path) in ROUTES {
+            let method = Method::from_bytes(method.as_bytes()).unwrap();
+            let requirement = control_plane_requirement(&method, path).expect("an /api path");
+            assert_ne!(requirement, Requirement::Unmapped, "{method} {path} is unmapped");
+        }
+        assert_eq!(
+            control_plane_requirement(&Method::GET, "/api/unknown/thing"),
+            Some(Requirement::Unmapped)
+        );
+        assert_eq!(control_plane_requirement(&Method::GET, "/v1/state"), None);
+    }
+
+    #[test]
+    fn key_routes_require_keys_admin_and_end_users_never_pass() {
+        for (method, path) in [("GET", "/api/keys"), ("POST", "/api/keys"), ("DELETE", "/api/keys/x"), ("POST", "/api/keys/x/rotate")] {
+            let requirement =
+                control_plane_requirement(&Method::from_bytes(method.as_bytes()).unwrap(), path)
+                    .unwrap();
+            assert_eq!(requirement, Requirement::Capability(KEYS_ADMIN));
+            let denial = decide(PrincipalClass::EndUser, &owned(&["*"]), requirement).unwrap_err();
+            assert_eq!(denial.reason, END_USER_SESSION_FORBIDDEN);
+            let denial = decide(PrincipalClass::Machine, &owned(&["state:write"]), requirement)
+                .unwrap_err();
+            assert_eq!(denial.reason, MISSING_SCOPE);
+            assert!(denial.message.contains("missing scope keys:admin"));
+            assert!(decide(PrincipalClass::Machine, &owned(&[KEYS_ADMIN]), requirement).is_ok());
+        }
+        assert!(decide(PrincipalClass::Machine, &owned(&["*"]), Requirement::Unmapped).is_err());
+        assert!(decide(PrincipalClass::Development, &[], Requirement::Unmapped).is_err());
+    }
+
+    #[test]
+    fn delegation_never_amplifies() {
+        let held = owned(&[KEYS_ADMIN, "state:read"]);
+        assert!(scopes_within(&owned(&["state:read"]), &held).is_ok());
+        assert!(scopes_within(&owned(&["*"]), &held).is_err());
+        assert!(scopes_within(&owned(&["state:write"]), &held).is_err());
+        assert!(scopes_within(&owned(&["*"]), &owned(&["*"])).is_ok());
+        assert!(namespaces_within("ns", &owned(&["ns"])).is_ok());
+        assert!(namespaces_within("*", &owned(&["ns"])).is_err());
+        assert!(namespaces_within("other", &owned(&["ns"])).is_err());
+    }
+
+    #[test]
+    fn console_users_delegate_only_application_capabilities() {
+        assert!(console_delegable("state:read"));
+        assert!(console_delegable("application:revision:create"));
+        for scope in ["*", "keys:admin", "cluster:write", "sync:write", "backup:restore", "admin:logs", "operator:read", "state:*", "made:up"] {
+            assert!(!console_delegable(scope), "{scope}");
+        }
+    }
+}

package/dist/create/server-source/crates/feltdb-server/src/identity.rs

@@ -9,6 +9,21 @@ use std::{
     time::{SystemTime, UNIX_EPOCH},
 };
 
+/// A session bearer token: 32 random alphanumeric characters (about 190 bits).
+fn session_token() -> String {
+    let random: String = rand::thread_rng()
+        .sample_iter(&Alphanumeric)
+        .take(32)
+        .map(char::from)
+        .collect();
+    format!("session_token_{random}")
+}
+
+fn session_token_digest(token: &str) -> String {
+    use sha2::{Digest, Sha256};
+    format!("{:x}", Sha256::digest(token.as_bytes()))
+}
+
 fn now() -> u64 {
     SystemTime::now()
         .duration_since(UNIX_EPOCH)
@@ -60,7 +75,16 @@ pub struct IdentitySession {
     pub provider: String,
     pub status: String,
     pub revocation_reason: Option<String>,
+    /// Argon2 hash of the token, written by releases before 0.15.0. Never
+    /// matched any more: see `token_digest`.
     pub refresh_hash: Option<String>,
+    /// SHA-256 of the session token. Session tokens are random and
+    /// short-lived, so a fast digest is enough, and it lets a bearer token be
+    /// looked up instead of Argon2-verified against every stored session —
+    /// which made each request with an unknown token cost one Argon2
+    /// verification per session ever issued.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub token_digest: Option<String>,
 }
 #[derive(Debug, Default, Serialize, Deserialize)]
 struct State {
@@ -210,16 +234,14 @@ impl IdentityStore {
     }
     pub fn authenticate_session(&self, token: &str) -> Option<IdentitySession> {
         let current = now();
+        let digest = session_token_digest(token);
         self.state
             .read()
             .ok()?
             .sessions
             .iter()
             .find(|value| {
-                value
-                    .refresh_hash
-                    .as_deref()
-                    .is_some_and(|hash| Self::verify_password(hash, token))
+                value.token_digest.as_deref() == Some(digest.as_str())
                     && value.status == "active"
                     && value.expires_at > current
             })
@@ -245,7 +267,7 @@ impl IdentityStore {
     ) -> Result<(IdentitySession, String), String> {
         let mut s = self.state.write().map_err(|_| "identity lock poisoned")?;
         let t = now();
-        let token = id("session_token");
+        let token = session_token();
         let x = IdentitySession {
             session_id: id("session"),
             identity_id: identity.identity_id.clone(),
@@ -257,7 +279,8 @@ impl IdentityStore {
             provider: provider.into(),
             status: "active".into(),
             revocation_reason: None,
-            refresh_hash: Some(Self::hash_password(&token)?),
+            refresh_hash: None,
+            token_digest: Some(session_token_digest(&token)),
         };
         s.sessions.push(x.clone());
         self.persist(&s)?;
@@ -355,4 +378,43 @@ mod tests {
         assert!(store.authenticate_session(&token).is_none());
         let _ = std::fs::remove_file(p);
     }
+    #[test]
+    fn an_unknown_bearer_token_is_rejected_without_password_hashing() {
+        let p = std::env::temp_dir().join(format!("identity-session-{}.json", id("test")));
+        let store = IdentityStore::load(&p).unwrap();
+        let (_, _, token) = store
+            .sign_up("many@example.com", "correct horse", None)
+            .unwrap();
+        for _ in 0..200 {
+            let identity = store.list().unwrap()[0].clone();
+            store.issue_session(&identity, "password", None, 900).unwrap();
+        }
+        // 201 stored sessions. Before 0.15.0 this rejection ran 201 Argon2
+        // verifications (seconds); a digest lookup is microseconds.
+        let started = std::time::Instant::now();
+        for _ in 0..50 {
+            assert!(store.authenticate_session("session_token_not-a-real-one").is_none());
+        }
+        assert!(started.elapsed() < std::time::Duration::from_millis(200), "{:?}", started.elapsed());
+        assert!(store.authenticate_session(&token).is_some());
+        let _ = std::fs::remove_file(p);
+    }
+    #[test]
+    fn a_session_from_before_the_digest_is_not_accepted() {
+        let p = std::env::temp_dir().join(format!("identity-session-{}.json", id("test")));
+        let store = IdentityStore::load(&p).unwrap();
+        let (identity, _, _) = store.sign_up("old@example.com", "correct horse", None).unwrap();
+        let legacy_token = "session_token_legacylegacylegacy";
+        {
+            let mut state = store.state.write().unwrap();
+            let mut legacy = state.sessions[0].clone();
+            legacy.session_id = "legacy".into();
+            legacy.refresh_hash = Some(IdentityStore::hash_password(legacy_token).unwrap());
+            legacy.token_digest = None;
+            legacy.subject_id = identity.subject_id.clone();
+            state.sessions.push(legacy);
+        }
+        assert!(store.authenticate_session(legacy_token).is_none());
+        let _ = std::fs::remove_file(p);
+    }
 }