@feltdb/core 0.13.0 → 0.16.0

package/dist/create/server-source/crates/feltdb-server/src/key_management.rs

@@ -1,14 +1,32 @@
+//! `/api/keys`: list, create, rotate and revoke service keys.
+//!
+//! The request middleware has already required `keys:admin` of a machine
+//! caller and refused application end-user sessions
+//! ([`crate::control_authorization`]). These handlers make the decisions that
+//! need the target: a caller never issues a key with a scope or namespace it
+//! does not hold itself, a key bound to an application only manages keys of
+//! that application, and a console user manages only keys bound to an
+//! application in which it holds `members:write`, with application-level
+//! capabilities its own role grants. Secrets are returned once, at creation
+//! or rotation; listings carry ids, names, scopes and namespaces only.
+
 use axum::{
-    extract::{Extension, Path, State},
+    extract::{Extension, Path, Query, State},
     http::StatusCode,
+    response::{IntoResponse, Response},
     Json,
 };
 use serde::{Deserialize, Serialize};
+use serde_json::json;
 use std::time::{SystemTime, UNIX_EPOCH};
 
 use crate::{
     app_state::AppState,
     auth::{ApiKeySummary, Principal},
+    control_authorization::{
+        console_delegable, namespaces_within, scopes_within, Denial, PrincipalClass,
+        APPLICATION_SCOPE_REQUIRED, END_USER_SESSION_FORBIDDEN, PRIVILEGE_ESCALATION_DENIED,
+    },
 };
 
 #[derive(Debug, Serialize)]
@@ -24,34 +42,267 @@ pub struct CreateKeyRequest {
     pub application_id: Option<String>,
 }
 
+#[derive(Debug, Default, Deserialize)]
+pub struct KeyListQuery {
+    pub application_id: Option<String>,
+}
+
 #[derive(Debug, Serialize)]
 pub struct CreateKeyResponse {
     pub secret: String,
     pub id: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub replaces: Option<String>,
+}
+
+/// A key-management failure, in the server's canonical error shape.
+#[derive(Debug)]
+pub struct KeyError {
+    status: StatusCode,
+    message: String,
+    reason: Option<&'static str>,
+    required_scope: Option<String>,
+}
+
+impl KeyError {
+    fn status(status: StatusCode, message: impl Into<String>) -> Self {
+        Self {
+            status,
+            message: message.into(),
+            reason: None,
+            required_scope: None,
+        }
+    }
+    fn forbidden(reason: &'static str, message: impl Into<String>) -> Self {
+        Self {
+            reason: Some(reason),
+            ..Self::status(StatusCode::FORBIDDEN, message)
+        }
+    }
+    fn internal(error: impl ToString) -> Self {
+        // Store errors name files, not credentials; the detail stays in logs.
+        tracing::error!(error = %error.to_string(), "key store operation failed");
+        Self::status(
+            StatusCode::INTERNAL_SERVER_ERROR,
+            "the key store could not complete the operation",
+        )
+    }
+}
+
+impl From<Denial> for KeyError {
+    fn from(denial: Denial) -> Self {
+        Self {
+            status: StatusCode::FORBIDDEN,
+            message: denial.message,
+            reason: Some(denial.reason),
+            required_scope: denial.required_scope,
+        }
+    }
+}
+
+impl IntoResponse for KeyError {
+    fn into_response(self) -> Response {
+        let code = match self.status {
+            StatusCode::FORBIDDEN => "FORBIDDEN",
+            StatusCode::NOT_FOUND => "NOT_FOUND",
+            StatusCode::BAD_REQUEST => "VALIDATION_ERROR",
+            _ => "EXECUTION_FAILED",
+        };
+        let mut body = json!({
+            "error": code,
+            "code": code,
+            "message": self.message,
+            "request_id": format!("req_{}", uuid::Uuid::new_v4().simple()),
+        });
+        if let Some(reason) = self.reason {
+            body["reason"] = json!(reason);
+        }
+        if let Some(scope) = self.required_scope {
+            body["required_scope"] = json!(scope);
+        }
+        (self.status, Json(body)).into_response()
+    }
+}
+
+fn refuse_end_user(class: PrincipalClass) -> Result<(), KeyError> {
+    if class == PrincipalClass::EndUser {
+        return Err(KeyError::forbidden(
+            END_USER_SESSION_FORBIDDEN,
+            "end-user sessions cannot manage keys — use an admin key holding keys:admin, or a console session with members:write on the application",
+        ));
+    }
+    Ok(())
+}
+
+/// The application a console user may manage keys for, with `capability` in it.
+fn console_application(
+    state: &AppState,
+    principal: &Principal,
+    application_id: Option<&str>,
+    capability: &str,
+) -> Result<crate::tenancy::Application, KeyError> {
+    let application_id = application_id.ok_or_else(|| {
+        KeyError::forbidden(
+            APPLICATION_SCOPE_REQUIRED,
+            "console sessions manage keys per application — pass application_id for an application in which you hold members:write",
+        )
+    })?;
+    let denied = || {
+        KeyError::forbidden(
+            "MEMBERSHIP_REQUIRED",
+            format!("managing keys of this application requires {capability} in it"),
+        )
+        .with_scope(capability)
+    };
+    let application = state
+        .tenancy
+        .application_record(application_id)
+        .ok_or_else(denied)?;
+    if !state.tenancy.authorize_application(
+        &principal.key_id,
+        &application.tenant_id,
+        &application.id,
+        capability,
+    ) {
+        return Err(denied());
+    }
+    Ok(application)
+}
+
+impl KeyError {
+    fn with_scope(mut self, scope: &str) -> Self {
+        self.required_scope = Some(scope.to_string());
+        self
+    }
+}
+
+/// The namespaces the calling key authenticates for.
+fn caller_namespaces(state: &AppState, principal: &Principal) -> Vec<String> {
+    state
+        .keys
+        .summary(&principal.key_id)
+        .map(|summary| summary.namespaces)
+        .unwrap_or_else(|| vec![state.namespace.to_string()])
 }
 
 pub async fn list_keys(
     State(state): State<AppState>,
-) -> Result<Json<KeyListResponse>, (StatusCode, String)> {
-    let tokens = state
-        .keys
-        .list()
-        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e))?;
+    Extension(principal): Extension<Principal>,
+    Extension(class): Extension<PrincipalClass>,
+    Query(query): Query<KeyListQuery>,
+) -> Result<Json<KeyListResponse>, KeyError> {
+    refuse_end_user(class)?;
+    let all = state.keys.list().map_err(KeyError::internal)?;
+    let application = match class {
+        PrincipalClass::ConsoleUser => Some(
+            console_application(
+                &state,
+                &principal,
+                query.application_id.as_deref(),
+                "members:read",
+            )?
+            .id,
+        ),
+        _ => match state.tenancy.service_binding(&principal.key_id) {
+            // A key bound to an application sees only that application's keys.
+            Some(binding) => {
+                if query
+                    .application_id
+                    .as_deref()
+                    .is_some_and(|requested| requested != binding.application_id)
+                {
+                    return Err(KeyError::forbidden(
+                        PRIVILEGE_ESCALATION_DENIED,
+                        "this key is bound to another application and cannot list its keys",
+                    ));
+                }
+                Some(binding.application_id)
+            }
+            None => query.application_id,
+        },
+    };
+    let tokens = match application {
+        Some(application_id) => {
+            let bound = state.tenancy.application_service_ids(&application_id);
+            all.into_iter()
+                .filter(|summary| bound.contains(&summary.id))
+                .collect()
+        }
+        None => all,
+    };
     Ok(Json(KeyListResponse { tokens }))
 }
 
 pub async fn create_key(
     State(state): State<AppState>,
     Extension(principal): Extension<Principal>,
+    Extension(class): Extension<PrincipalClass>,
     Json(req): Json<CreateKeyRequest>,
-) -> Result<(StatusCode, Json<CreateKeyResponse>), (StatusCode, String)> {
+) -> Result<(StatusCode, Json<CreateKeyResponse>), KeyError> {
+    refuse_end_user(class)?;
+    let scopes = req.scopes;
+    if scopes.is_empty() || scopes.iter().any(|scope| scope.trim().is_empty()) {
+        return Err(KeyError::status(
+            StatusCode::BAD_REQUEST,
+            "scopes must name at least one capability, e.g. [\"state:read\"]",
+        ));
+    }
+    match class {
+        PrincipalClass::ConsoleUser => {
+            let application = console_application(
+                &state,
+                &principal,
+                req.application_id.as_deref(),
+                "members:write",
+            )?;
+            if let Some(scope) = scopes.iter().find(|scope| {
+                !console_delegable(scope)
+                    || !state.tenancy.authorize_application(
+                        &principal.key_id,
+                        &application.tenant_id,
+                        &application.id,
+                        scope,
+                    )
+            }) {
+                return Err(KeyError::forbidden(
+                    PRIVILEGE_ESCALATION_DENIED,
+                    format!("cannot delegate scope {scope}: console sessions delegate only application capabilities their own role grants; operator scopes need an admin key"),
+                ));
+            }
+            if req.namespace != state.namespace.as_ref() && req.namespace != application.namespace
+            {
+                return Err(KeyError::forbidden(
+                    PRIVILEGE_ESCALATION_DENIED,
+                    format!(
+                        "cannot issue a key for namespace {}: use this authority's or the application's namespace",
+                        req.namespace
+                    ),
+                ));
+            }
+        }
+        PrincipalClass::Machine => {
+            scopes_within(&scopes, &principal.scopes)?;
+            namespaces_within(&req.namespace, &caller_namespaces(&state, &principal))?;
+            if let Some(binding) = state.tenancy.service_binding(&principal.key_id) {
+                if req.application_id.as_deref() != Some(binding.application_id.as_str()) {
+                    return Err(KeyError::forbidden(
+                        APPLICATION_SCOPE_REQUIRED,
+                        format!(
+                            "this key is bound to application {}; keys it issues must name that application_id",
+                            binding.application_id
+                        ),
+                    ));
+                }
+            }
+        }
+        PrincipalClass::Development | PrincipalClass::EndUser => {}
+    }
+
     let timestamp = SystemTime::now()
         .duration_since(UNIX_EPOCH)
         .unwrap_or_default()
         .as_secs();
-
     let name = req.id.unwrap_or_else(|| format!("key-{}", timestamp));
-    let scopes = req.scopes;
     let mut authentication_namespaces = vec![req.namespace];
     if !authentication_namespaces
         .iter()
@@ -64,10 +315,12 @@ pub async fn create_key(
     // unavailable while qualification creates several scoped keys.
     let keys = state.keys.clone();
     let key_scopes = scopes.clone();
-    let key = tokio::task::spawn_blocking(move || keys.create(name, key_scopes, authentication_namespaces))
-        .await
-        .map_err(|error| (StatusCode::INTERNAL_SERVER_ERROR, error.to_string()))?
-        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e))?;
+    let key = tokio::task::spawn_blocking(move || {
+        keys.create(name, key_scopes, authentication_namespaces)
+    })
+    .await
+    .map_err(KeyError::internal)?
+    .map_err(KeyError::internal)?;
 
     if let Some(application_id) = req.application_id {
         if let Err(error) = state.tenancy.register_application_service(
@@ -77,7 +330,10 @@ pub async fn create_key(
             scopes,
         ) {
             let _ = state.keys.revoke(&key.id);
-            return Err((StatusCode::FORBIDDEN, error));
+            return Err(KeyError::forbidden(
+                "MEMBERSHIP_REQUIRED",
+                format!("the key could not be bound to application {application_id}: {error}; binding requires members:write in that application"),
+            ));
         }
     }
 
@@ -86,22 +342,98 @@ pub async fn create_key(
         Json(CreateKeyResponse {
             secret: key.secret,
             id: key.id,
+            replaces: None,
         }),
     ))
 }
 
+/// May this caller revoke or rotate `id`? Returns the key's listing entry.
+fn authorize_target(
+    state: &AppState,
+    principal: &Principal,
+    class: PrincipalClass,
+    id: &str,
+) -> Result<ApiKeySummary, KeyError> {
+    refuse_end_user(class)?;
+    let target = state.keys.summary(id);
+    let binding = state.tenancy.service_binding(id);
+    match class {
+        PrincipalClass::ConsoleUser => {
+            let application = binding.as_ref().map(|binding| binding.application_id.as_str());
+            console_application(state, principal, application, "members:write")?;
+        }
+        PrincipalClass::Machine => {
+            if let Some(own) = state.tenancy.service_binding(&principal.key_id) {
+                if binding.as_ref().map(|binding| &binding.application_id)
+                    != Some(&own.application_id)
+                {
+                    return Err(KeyError::forbidden(
+                        PRIVILEGE_ESCALATION_DENIED,
+                        "this key is bound to an application and manages only that application's keys",
+                    ));
+                }
+            }
+            if let Some(target) = &target {
+                // Revoking or re-issuing a broader key is not a narrower act.
+                scopes_within(&target.scopes, &principal.scopes)?;
+                for namespace in &target.namespaces {
+                    namespaces_within(namespace, &caller_namespaces(state, principal))?;
+                }
+            }
+        }
+        PrincipalClass::Development | PrincipalClass::EndUser => {}
+    }
+    target.ok_or_else(|| KeyError::status(StatusCode::NOT_FOUND, "key not found"))
+}
+
 pub async fn revoke_key(
     State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    Extension(class): Extension<PrincipalClass>,
     Path(id): Path<String>,
-) -> Result<StatusCode, (StatusCode, String)> {
-    let found = state
-        .keys
-        .revoke(&id)
-        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e))?;
+) -> Result<StatusCode, KeyError> {
+    authorize_target(&state, &principal, class, &id)?;
+    if !state.keys.revoke(&id).map_err(KeyError::internal)? {
+        return Err(KeyError::status(StatusCode::NOT_FOUND, "key not found"));
+    }
+    state
+        .tenancy
+        .transfer_application_service(&principal.key_id, &id, None)
+        .map_err(KeyError::internal)?;
+    Ok(StatusCode::NO_CONTENT)
+}
 
-    if found {
-        Ok(StatusCode::NO_CONTENT)
-    } else {
-        Err((StatusCode::NOT_FOUND, "Key not found".to_string()))
+/// Rotate = issue a replacement with the same scopes, namespaces and binding,
+/// and revoke the old key in the same store write. The new secret is shown
+/// once, here.
+pub async fn rotate_key(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    Extension(class): Extension<PrincipalClass>,
+    Path(id): Path<String>,
+) -> Result<(StatusCode, Json<CreateKeyResponse>), KeyError> {
+    let target = authorize_target(&state, &principal, class, &id)?;
+    if target.revoked {
+        return Err(KeyError::status(
+            StatusCode::NOT_FOUND,
+            "key is revoked; create a new key instead",
+        ));
     }
+    let created = state
+        .keys
+        .rotate(&id)
+        .map_err(KeyError::internal)?
+        .ok_or_else(|| KeyError::status(StatusCode::NOT_FOUND, "key not found"))?;
+    state
+        .tenancy
+        .transfer_application_service(&principal.key_id, &id, Some(&created.id))
+        .map_err(KeyError::internal)?;
+    Ok((
+        StatusCode::CREATED,
+        Json(CreateKeyResponse {
+            secret: created.secret,
+            id: created.id,
+            replaces: Some(id),
+        }),
+    ))
 }

package/dist/create/server-source/crates/feltdb-server/src/lib.rs

@@ -34,7 +34,9 @@ pub mod certification_harness;
 pub mod clock;
 pub mod cluster;
 pub mod connections;
+pub mod console_accounts;
 pub mod content;
+pub mod control_authorization;
 pub mod control_plane;
 pub mod delegation_token;
 pub mod durable_operations;
@@ -49,6 +51,7 @@ pub mod portable_bundle;
 pub mod principals;
 pub mod providers;
 pub mod query_shape;
+pub mod redaction;
 pub mod releases;
 pub mod request_telemetry;
 pub mod sessions;