@feltdb/core 0.4.11 → 0.4.13

package/dist/create/server-source/crates/feltdb-server/src/connections.rs

@@ -0,0 +1,1044 @@
+use crate::{
+    key_provider::{
+        KeyProvider, KeyProviderHealth, KeyReference, KeyScope, LocalKeyProvider, WrappedKey,
+    },
+    principals::PrincipalStore,
+    tenancy::TenancyStore,
+};
+use base64::{engine::general_purpose::STANDARD, Engine};
+use rand::{distributions::Alphanumeric, Rng, RngCore};
+use ring::aead::{Aad, LessSafeKey, Nonce, UnboundKey, AES_256_GCM};
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+use std::{
+    collections::HashMap,
+    fs,
+    path::PathBuf,
+    sync::{Arc, RwLock},
+    time::{SystemTime, UNIX_EPOCH},
+};
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum ConnectionStatus {
+    Active,
+    Disabled,
+}
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Connection {
+    pub id: String,
+    pub application_id: String,
+    pub provider: String,
+    pub name: String,
+    pub status: ConnectionStatus,
+    pub configuration: Value,
+    pub configuration_schema: Value,
+    pub secret_refs: Vec<SecretReference>,
+    pub created_by: String,
+    pub created_at: u64,
+    pub updated_at: u64,
+}
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct SecretReference {
+    pub binding: String,
+    pub secret_id: String,
+}
+#[derive(Debug, Clone, Serialize)]
+pub struct SecretMetadata {
+    pub id: String,
+    pub application_id: String,
+    pub name: String,
+    pub scope: String,
+    pub version: u64,
+    pub status: SecretStatus,
+    pub key_reference: KeyReference,
+    pub created_by: String,
+    pub created_at: u64,
+    pub updated_at: u64,
+}
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "SCREAMING_SNAKE_CASE")]
+pub enum SecretStatus {
+    Active,
+    Revoked,
+    Retired,
+}
+#[derive(Debug, Clone, Serialize, Deserialize)]
+struct EncryptedSecret {
+    id: String,
+    tenant_id: String,
+    application_id: String,
+    name: String,
+    scope: String,
+    nonce: String,
+    ciphertext: String,
+    key_reference: KeyReference,
+    wrapped_dek: WrappedKey,
+    algorithm: String,
+    purpose: String,
+    status: SecretStatus,
+    version: u64,
+    created_by: String,
+    created_at: u64,
+    updated_at: u64,
+}
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct SecretAuditEvent {
+    pub event: String,
+    pub principal_id: String,
+    pub workload_id: String,
+    pub worker_id: String,
+    pub connection_id: String,
+    pub secret_id: String,
+    pub decision: bool,
+    pub at: u64,
+}
+#[derive(Debug, Default, Serialize, Deserialize)]
+struct ConnectionRecords {
+    connections: Vec<Connection>,
+    secrets: Vec<EncryptedSecret>,
+    audit: Vec<SecretAuditEvent>,
+}
+#[derive(Clone)]
+pub struct ConnectionStore {
+    path: PathBuf,
+    key_provider: Arc<dyn KeyProvider>,
+    records: Arc<RwLock<ConnectionRecords>>,
+}
+#[derive(Debug, Clone, Serialize)]
+pub struct ExecutionContext {
+    pub id: String,
+    pub tenant_id: String,
+    pub workload_id: String,
+    pub principal_id: String,
+    pub worker_id: String,
+    pub application_id: String,
+    pub capabilities: Vec<String>,
+    pub connections: Vec<String>,
+    pub secret_bindings: Vec<String>,
+    pub expires_at: u64,
+    pub issued_at: u64,
+    pub used: bool,
+}
+pub trait ConnectionProvider: Send + Sync {
+    fn identify(&self) -> &str;
+    fn configuration_schema(&self) -> Value;
+    fn validate(&self, configuration: &Value) -> Result<(), String>;
+    fn health(&self, configuration: &Value) -> Result<(), String>;
+}
+
+fn now() -> u64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_secs()
+}
+fn id(prefix: &str) -> String {
+    let value: String = rand::thread_rng()
+        .sample_iter(&Alphanumeric)
+        .take(18)
+        .map(char::from)
+        .collect();
+    format!("{prefix}_{value}")
+}
+impl From<&EncryptedSecret> for SecretMetadata {
+    fn from(secret: &EncryptedSecret) -> Self {
+        Self {
+            id: secret.id.clone(),
+            application_id: secret.application_id.clone(),
+            name: secret.name.clone(),
+            scope: secret.scope.clone(),
+            version: secret.version,
+            status: secret.status,
+            key_reference: secret.key_reference.clone(),
+            created_by: secret.created_by.clone(),
+            created_at: secret.created_at,
+            updated_at: secret.updated_at,
+        }
+    }
+}
+
+impl ConnectionStore {
+    pub fn key_provider_health(
+        &self,
+        tenant_id: &str,
+        application_id: Option<&str>,
+    ) -> KeyProviderHealth {
+        self.key_provider.health(&KeyScope {
+            tenant_id: tenant_id.into(),
+            application_id: application_id.map(Into::into),
+            purpose: "connection-secret".into(),
+        })
+    }
+    pub fn rotate_encryption_key(
+        &self,
+        tenant_id: &str,
+        application_id: Option<&str>,
+    ) -> Result<KeyReference, String> {
+        self.key_provider.rotate(&KeyScope {
+            tenant_id: tenant_id.into(),
+            application_id: application_id.map(Into::into),
+            purpose: "connection-secret".into(),
+        })
+    }
+    pub fn rewrap_application(
+        &self,
+        actor: &str,
+        tenancy: &TenancyStore,
+        application_id: &str,
+    ) -> Result<usize, String> {
+        if !Self::allowed(actor, tenancy, application_id, "applications:write") {
+            return Err("forbidden".into());
+        }
+        let tenant_id = tenancy
+            .application_tenant(application_id)
+            .ok_or("application not found")?;
+        let scope = KeyScope {
+            tenant_id,
+            application_id: Some(application_id.into()),
+            purpose: "connection-secret".into(),
+        };
+        self.key_provider.rotate(&scope)?;
+        let mut records = self
+            .records
+            .write()
+            .map_err(|_| "connection store lock poisoned")?;
+        let mut count = 0;
+        for secret in records.secrets.iter_mut().filter(|secret| {
+            secret.application_id == application_id && secret.status == SecretStatus::Active
+        }) {
+            let mut dek = self.key_provider.decrypt_dek(
+                &secret.key_reference,
+                &secret.wrapped_dek,
+                &scope,
+            )?;
+            let (reference, wrapped) = self.key_provider.encrypt_dek(&scope, &dek)?;
+            dek.fill(0);
+            secret.key_reference = reference;
+            secret.wrapped_dek = wrapped;
+            count += 1;
+        }
+        self.persist(&records)?;
+        Ok(count)
+    }
+    pub fn revoke_secret(
+        &self,
+        actor: &str,
+        tenancy: &TenancyStore,
+        secret_id: &str,
+    ) -> Result<SecretMetadata, String> {
+        let mut records = self
+            .records
+            .write()
+            .map_err(|_| "connection store lock poisoned")?;
+        let secret = records
+            .secrets
+            .iter_mut()
+            .filter(|secret| secret.id == secret_id)
+            .max_by_key(|secret| secret.version)
+            .ok_or("secret not found")?;
+        if !Self::allowed(actor, tenancy, &secret.application_id, "applications:write") {
+            return Err("forbidden".into());
+        }
+        secret.status = SecretStatus::Revoked;
+        secret.updated_at = now();
+        let metadata = (&*secret).into();
+        self.persist(&records)?;
+        Ok(metadata)
+    }
+    pub fn inspect_secret(
+        &self,
+        actor: &str,
+        tenancy: &TenancyStore,
+        secret_id: &str,
+    ) -> Result<SecretMetadata, String> {
+        let records = self
+            .records
+            .read()
+            .map_err(|_| "connection store lock poisoned")?;
+        let secret = records
+            .secrets
+            .iter()
+            .filter(|secret| secret.id == secret_id)
+            .max_by_key(|secret| secret.version)
+            .ok_or("secret not found")?;
+        if !Self::allowed(actor, tenancy, &secret.application_id, "applications:read") {
+            return Err("forbidden".into());
+        }
+        Ok(secret.into())
+    }
+    pub fn load(path: impl Into<PathBuf>, key: [u8; 32]) -> Result<Self, String> {
+        let path = path.into();
+        let provider = Arc::new(LocalKeyProvider::load(
+            path.with_extension("local-keys.json"),
+            key,
+        )?);
+        Self::load_with_provider(path, provider)
+    }
+    pub fn load_with_provider(
+        path: impl Into<PathBuf>,
+        key_provider: Arc<dyn KeyProvider>,
+    ) -> Result<Self, String> {
+        let path = path.into();
+        let records = if path.exists() {
+            serde_json::from_slice(&fs::read(&path).map_err(|error| error.to_string())?)
+                .map_err(|error| error.to_string())?
+        } else {
+            ConnectionRecords::default()
+        };
+        Ok(Self {
+            path,
+            key_provider,
+            records: Arc::new(RwLock::new(records)),
+        })
+    }
+    fn persist(&self, records: &ConnectionRecords) -> Result<(), String> {
+        if let Some(parent) = self.path.parent() {
+            fs::create_dir_all(parent).map_err(|error| error.to_string())?;
+        }
+        let temporary = self.path.with_extension("tmp");
+        fs::write(
+            &temporary,
+            serde_json::to_vec_pretty(records).map_err(|error| error.to_string())?,
+        )
+        .map_err(|error| error.to_string())?;
+        fs::rename(temporary, &self.path).map_err(|error| error.to_string())
+    }
+    fn secret_aad(secret: &EncryptedSecret) -> Vec<u8> {
+        format!(
+            "feltdb-secret-v1|{}|{}|{}|{}|{}",
+            secret.tenant_id, secret.application_id, secret.id, secret.version, secret.purpose
+        )
+        .into_bytes()
+    }
+    fn seal(
+        &self,
+        mut secret: EncryptedSecret,
+        plaintext: &[u8],
+    ) -> Result<EncryptedSecret, String> {
+        let mut dek = [0u8; 32];
+        rand::thread_rng().fill_bytes(&mut dek);
+        let scope = KeyScope {
+            tenant_id: secret.tenant_id.clone(),
+            application_id: Some(secret.application_id.clone()),
+            purpose: secret.purpose.clone(),
+        };
+        let (key_reference, wrapped_dek) = self.key_provider.encrypt_dek(&scope, &dek)?;
+        secret.key_reference = key_reference;
+        secret.wrapped_dek = wrapped_dek;
+        let key = LessSafeKey::new(
+            UnboundKey::new(&AES_256_GCM, &dek).map_err(|_| "invalid encryption key")?,
+        );
+        let mut nonce = [0u8; 12];
+        rand::thread_rng().fill_bytes(&mut nonce);
+        let mut value = plaintext.to_vec();
+        key.seal_in_place_append_tag(
+            Nonce::assume_unique_for_key(nonce),
+            Aad::from(Self::secret_aad(&secret)),
+            &mut value,
+        )
+        .map_err(|_| "secret encryption failed")?;
+        dek.fill(0);
+        secret.nonce = STANDARD.encode(nonce);
+        secret.ciphertext = STANDARD.encode(value);
+        Ok(secret)
+    }
+    fn open(&self, secret: &EncryptedSecret) -> Result<Vec<u8>, String> {
+        let nonce: [u8; 12] = STANDARD
+            .decode(&secret.nonce)
+            .map_err(|_| "invalid secret nonce")?
+            .try_into()
+            .map_err(|_| "invalid secret nonce")?;
+        let mut value = STANDARD
+            .decode(&secret.ciphertext)
+            .map_err(|_| "invalid secret ciphertext")?;
+        if secret.status != SecretStatus::Active {
+            return Err("secret version is not active".into());
+        }
+        let scope = KeyScope {
+            tenant_id: secret.tenant_id.clone(),
+            application_id: Some(secret.application_id.clone()),
+            purpose: secret.purpose.clone(),
+        };
+        let mut dek =
+            self.key_provider
+                .decrypt_dek(&secret.key_reference, &secret.wrapped_dek, &scope)?;
+        let key = LessSafeKey::new(
+            UnboundKey::new(&AES_256_GCM, &dek).map_err(|_| "invalid encryption key")?,
+        );
+        let length = key
+            .open_in_place(
+                Nonce::assume_unique_for_key(nonce),
+                Aad::from(Self::secret_aad(secret)),
+                &mut value,
+            )
+            .map_err(|_| "secret decryption failed")?
+            .len();
+        value.truncate(length);
+        dek.fill(0);
+        Ok(value)
+    }
+    fn allowed(
+        actor: &str,
+        tenancy: &TenancyStore,
+        application_id: &str,
+        capability: &str,
+    ) -> bool {
+        tenancy
+            .application_tenant(application_id)
+            .map(|tenant| tenancy.authorize_application(actor, &tenant, application_id, capability))
+            .unwrap_or(false)
+    }
+    pub fn put_secret(
+        &self,
+        actor: &str,
+        tenancy: &TenancyStore,
+        application_id: &str,
+        name: &str,
+        scope: &str,
+        value: &[u8],
+    ) -> Result<SecretMetadata, String> {
+        if !Self::allowed(actor, tenancy, application_id, "applications:write") {
+            return Err("forbidden".into());
+        }
+        let timestamp = now();
+        let mut records = self
+            .records
+            .write()
+            .map_err(|_| "connection store lock poisoned")?;
+        let tenant_id = tenancy
+            .application_tenant(application_id)
+            .ok_or("application not found")?;
+        let secret = self.seal(
+            EncryptedSecret {
+                id: id("secret"),
+                tenant_id,
+                application_id: application_id.into(),
+                name: name.into(),
+                scope: scope.into(),
+                nonce: String::new(),
+                ciphertext: String::new(),
+                key_reference: KeyReference {
+                    provider: String::new(),
+                    key_id: String::new(),
+                    version: 0,
+                },
+                wrapped_dek: WrappedKey {
+                    nonce: String::new(),
+                    ciphertext: String::new(),
+                    algorithm: String::new(),
+                },
+                algorithm: "AES-256-GCM".into(),
+                purpose: "connection-secret".into(),
+                status: SecretStatus::Active,
+                version: 1,
+                created_by: actor.into(),
+                created_at: timestamp,
+                updated_at: timestamp,
+            },
+            value,
+        )?;
+        records.secrets.push(secret.clone());
+        self.persist(&records)?;
+        Ok((&secret).into())
+    }
+    pub fn rotate_secret(
+        &self,
+        actor: &str,
+        tenancy: &TenancyStore,
+        secret_id: &str,
+        value: &[u8],
+    ) -> Result<SecretMetadata, String> {
+        let mut records = self
+            .records
+            .write()
+            .map_err(|_| "connection store lock poisoned")?;
+        let index = records
+            .secrets
+            .iter()
+            .position(|secret| secret.id == secret_id)
+            .ok_or("secret not found")?;
+        if !Self::allowed(
+            actor,
+            tenancy,
+            &records.secrets[index].application_id,
+            "applications:write",
+        ) {
+            return Err("forbidden".into());
+        }
+        records.secrets[index].status = SecretStatus::Retired;
+        let previous = records.secrets[index].clone();
+        let timestamp = now();
+        let next = self.seal(
+            EncryptedSecret {
+                version: previous.version + 1,
+                status: SecretStatus::Active,
+                created_by: actor.into(),
+                created_at: timestamp,
+                updated_at: timestamp,
+                nonce: String::new(),
+                ciphertext: String::new(),
+                key_reference: KeyReference {
+                    provider: String::new(),
+                    key_id: String::new(),
+                    version: 0,
+                },
+                wrapped_dek: WrappedKey {
+                    nonce: String::new(),
+                    ciphertext: String::new(),
+                    algorithm: String::new(),
+                },
+                ..previous
+            },
+            value,
+        )?;
+        let metadata = (&next).into();
+        records.secrets.push(next);
+        self.persist(&records)?;
+        Ok(metadata)
+    }
+    pub fn list_secrets(
+        &self,
+        actor: &str,
+        tenancy: &TenancyStore,
+        application_id: &str,
+    ) -> Result<Vec<SecretMetadata>, String> {
+        if !Self::allowed(actor, tenancy, application_id, "applications:read") {
+            return Err("forbidden".into());
+        }
+        Ok(self
+            .records
+            .read()
+            .map_err(|_| "connection store lock poisoned")?
+            .secrets
+            .iter()
+            .filter(|secret| secret.application_id == application_id)
+            .filter(|secret| secret.status == SecretStatus::Active)
+            .map(Into::into)
+            .collect())
+    }
+    pub fn create_connection(
+        &self,
+        actor: &str,
+        tenancy: &TenancyStore,
+        application_id: &str,
+        provider: &dyn ConnectionProvider,
+        name: &str,
+        configuration: Value,
+        secret_refs: Vec<SecretReference>,
+    ) -> Result<Connection, String> {
+        if !Self::allowed(actor, tenancy, application_id, "connections:write") {
+            return Err("forbidden".into());
+        }
+        provider.validate(&configuration)?;
+        let records = self
+            .records
+            .read()
+            .map_err(|_| "connection store lock poisoned")?;
+        if secret_refs.iter().any(|reference| {
+            !records.secrets.iter().any(|secret| {
+                secret.id == reference.secret_id
+                    && secret.application_id == application_id
+                    && secret.status == SecretStatus::Active
+            })
+        }) {
+            return Err(
+                "connection secret belongs to another application or does not exist".into(),
+            );
+        }
+        drop(records);
+        let timestamp = now();
+        let connection = Connection {
+            id: id("connection"),
+            application_id: application_id.into(),
+            provider: provider.identify().into(),
+            name: name.into(),
+            status: ConnectionStatus::Active,
+            configuration,
+            configuration_schema: provider.configuration_schema(),
+            secret_refs,
+            created_by: actor.into(),
+            created_at: timestamp,
+            updated_at: timestamp,
+        };
+        let mut records = self
+            .records
+            .write()
+            .map_err(|_| "connection store lock poisoned")?;
+        records.connections.push(connection.clone());
+        self.persist(&records)?;
+        Ok(connection)
+    }
+    pub fn list_connections(
+        &self,
+        actor: &str,
+        tenancy: &TenancyStore,
+        application_id: &str,
+    ) -> Result<Vec<Connection>, String> {
+        if !Self::allowed(actor, tenancy, application_id, "connections:read")
+            && !Self::allowed(actor, tenancy, application_id, "applications:read")
+        {
+            return Err("forbidden".into());
+        }
+        Ok(self
+            .records
+            .read()
+            .map_err(|_| "connection store lock poisoned")?
+            .connections
+            .iter()
+            .filter(|connection| connection.application_id == application_id)
+            .cloned()
+            .collect())
+    }
+    pub fn disable(
+        &self,
+        actor: &str,
+        tenancy: &TenancyStore,
+        connection_id: &str,
+    ) -> Result<(), String> {
+        let mut records = self
+            .records
+            .write()
+            .map_err(|_| "connection store lock poisoned")?;
+        let connection = records
+            .connections
+            .iter_mut()
+            .find(|connection| connection.id == connection_id)
+            .ok_or("connection not found")?;
+        if !Self::allowed(
+            actor,
+            tenancy,
+            &connection.application_id,
+            "connections:write",
+        ) {
+            return Err("forbidden".into());
+        }
+        connection.status = ConnectionStatus::Disabled;
+        connection.updated_at = now();
+        self.persist(&records)
+    }
+    pub fn delete(
+        &self,
+        actor: &str,
+        tenancy: &TenancyStore,
+        connection_id: &str,
+    ) -> Result<(), String> {
+        let mut records = self
+            .records
+            .write()
+            .map_err(|_| "connection store lock poisoned")?;
+        let index = records
+            .connections
+            .iter()
+            .position(|connection| connection.id == connection_id)
+            .ok_or("connection not found")?;
+        if !Self::allowed(
+            actor,
+            tenancy,
+            &records.connections[index].application_id,
+            "connections:write",
+        ) {
+            return Err("forbidden".into());
+        }
+        records.connections.remove(index);
+        self.persist(&records)
+    }
+    pub fn execution_context(
+        &self,
+        principals: &PrincipalStore,
+        worker_id: &str,
+        workload_id: &str,
+        connection_ids: &[String],
+        ttl: u64,
+    ) -> Result<ExecutionContext, String> {
+        let (application_id, principal_id, capabilities) = principals
+            .execution_snapshot(worker_id, workload_id)
+            .ok_or("worker is not assigned to workload")?;
+        if !capabilities
+            .iter()
+            .any(|capability| capability == "connection:use" || capability == "*")
+        {
+            return Err("workload lacks connection:use".into());
+        }
+        let records = self
+            .records
+            .read()
+            .map_err(|_| "connection store lock poisoned")?;
+        let selected: Vec<&Connection> = connection_ids
+            .iter()
+            .map(|id| {
+                records
+                    .connections
+                    .iter()
+                    .find(|connection| {
+                        connection.id == *id
+                            && connection.application_id == application_id
+                            && connection.status == ConnectionStatus::Active
+                    })
+                    .ok_or("connection unavailable")
+            })
+            .collect::<Result<_, _>>()?;
+        Ok(ExecutionContext {
+            id: id("execution"),
+            tenant_id: selected
+                .iter()
+                .flat_map(|connection| connection.secret_refs.iter())
+                .find_map(|reference| {
+                    records
+                        .secrets
+                        .iter()
+                        .find(|secret| secret.id == reference.secret_id)
+                        .map(|secret| secret.tenant_id.clone())
+                })
+                .unwrap_or_default(),
+            workload_id: workload_id.into(),
+            principal_id,
+            worker_id: worker_id.into(),
+            application_id,
+            capabilities,
+            connections: connection_ids.to_vec(),
+            secret_bindings: selected
+                .iter()
+                .flat_map(|connection| {
+                    connection
+                        .secret_refs
+                        .iter()
+                        .map(|reference| reference.binding.clone())
+                })
+                .collect(),
+            expires_at: now() + ttl.min(900),
+            issued_at: now(),
+            used: false,
+        })
+    }
+    pub fn with_execution_secrets<T>(
+        &self,
+        context: &ExecutionContext,
+        connection_id: &str,
+        execute: impl FnOnce(&HashMap<String, Vec<u8>>) -> T,
+    ) -> Result<T, String> {
+        if context.expires_at <= now() || !context.connections.iter().any(|id| id == connection_id)
+        {
+            return Err("execution context expired or connection not authorized".into());
+        }
+        let mut records = self
+            .records
+            .write()
+            .map_err(|_| "connection store lock poisoned")?;
+        let connection = records
+            .connections
+            .iter()
+            .find(|connection| {
+                connection.id == connection_id
+                    && connection.application_id == context.application_id
+                    && connection.status == ConnectionStatus::Active
+            })
+            .cloned()
+            .ok_or("connection unavailable")?;
+        let mut secrets = HashMap::new();
+        for reference in &connection.secret_refs {
+            let secret = records
+                .secrets
+                .iter()
+                .find(|secret| {
+                    secret.id == reference.secret_id
+                        && secret.application_id == context.application_id
+                        && secret.status == SecretStatus::Active
+                })
+                .cloned()
+                .ok_or("secret unavailable")?;
+            secrets.insert(reference.binding.clone(), self.open(&secret)?);
+            records.audit.push(SecretAuditEvent {
+                event: "secret.injected".into(),
+                principal_id: context.principal_id.clone(),
+                workload_id: context.workload_id.clone(),
+                worker_id: context.worker_id.clone(),
+                connection_id: connection.id.clone(),
+                secret_id: secret.id,
+                decision: true,
+                at: now(),
+            });
+        }
+        self.persist(&records)?;
+        let output = execute(&secrets);
+        for value in secrets.values_mut() {
+            value.fill(0);
+        }
+        Ok(output)
+    }
+    pub fn with_deployment_secrets<T>(
+        &self,
+        actor: &str,
+        tenancy: &TenancyStore,
+        application_id: &str,
+        deployment_id: &str,
+        provider: &str,
+        references: &[(String, String)],
+        operation: &str,
+        execute: impl FnOnce(&HashMap<String, Vec<u8>>, &HashMap<String, u64>) -> T,
+    ) -> Result<T, String> {
+        let tenant_id = tenancy
+            .application_tenant(application_id)
+            .ok_or("application not found")?;
+        if !tenancy.authorize_application(actor, &tenant_id, application_id, "deployment:execute") {
+            return Err("forbidden".into());
+        }
+        let mut records = self
+            .records
+            .write()
+            .map_err(|_| "connection store lock poisoned")?;
+        let mut values = HashMap::new();
+        let mut versions = HashMap::new();
+        for (binding, secret_id) in references {
+            let secret = records
+                .secrets
+                .iter()
+                .find(|secret| {
+                    secret.id == *secret_id
+                        && secret.tenant_id == tenant_id
+                        && secret.application_id == application_id
+                        && secret.status == SecretStatus::Active
+                })
+                .cloned()
+                .ok_or("deployment credential unavailable")?;
+            values.insert(binding.clone(), self.open(&secret)?);
+            versions.insert(binding.clone(), secret.version);
+            records.audit.push(SecretAuditEvent {
+                event: format!("deployment.{operation}"),
+                principal_id: actor.into(),
+                workload_id: deployment_id.into(),
+                worker_id: provider.into(),
+                connection_id: "deployment-provider".into(),
+                secret_id: secret.id,
+                decision: true,
+                at: now(),
+            });
+        }
+        self.persist(&records)?;
+        let output = execute(&values, &versions);
+        for value in values.values_mut() {
+            value.fill(0);
+        }
+        Ok(output)
+    }
+    pub fn audit(&self) -> Vec<SecretAuditEvent> {
+        self.records
+            .read()
+            .map(|records| records.audit.clone())
+            .unwrap_or_default()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::principals::PrincipalKind;
+    struct TestProvider;
+    impl ConnectionProvider for TestProvider {
+        fn identify(&self) -> &str {
+            "test"
+        }
+        fn configuration_schema(&self) -> Value {
+            serde_json::json!({"type":"object"})
+        }
+        fn validate(&self, _: &Value) -> Result<(), String> {
+            Ok(())
+        }
+        fn health(&self, _: &Value) -> Result<(), String> {
+            Ok(())
+        }
+    }
+    fn setup() -> (TenancyStore, PrincipalStore, ConnectionStore, String) {
+        let suffix = id("test");
+        let tenancy =
+            TenancyStore::load(std::env::temp_dir().join(format!("{suffix}-tenant.json"))).unwrap();
+        let tenant = tenancy
+            .create_tenant("owner", &format!("Connections {suffix}"))
+            .unwrap();
+        let app = tenancy
+            .create_application("owner", &tenant.id, "App")
+            .unwrap();
+        let principals =
+            PrincipalStore::load(std::env::temp_dir().join(format!("{suffix}-principals.json")))
+                .unwrap();
+        let connections = ConnectionStore::load(
+            std::env::temp_dir().join(format!("{suffix}-connections.json")),
+            [7u8; 32],
+        )
+        .unwrap();
+        (tenancy, principals, connections, app.id)
+    }
+    #[test]
+    fn secrets_are_opaque_and_injected_only_for_assigned_execution() {
+        let (tenancy, principals, store, app) = setup();
+        let secret = store
+            .put_secret(
+                "owner",
+                &tenancy,
+                &app,
+                "API_TOKEN",
+                "connection",
+                b"super-secret-value",
+            )
+            .unwrap();
+        assert!(!serde_json::to_string(&secret)
+            .unwrap()
+            .contains("super-secret-value"));
+        let connection = store
+            .create_connection(
+                "owner",
+                &tenancy,
+                &app,
+                &TestProvider,
+                "External",
+                serde_json::json!({"url":"https://example.com"}),
+                vec![SecretReference {
+                    binding: "TOKEN".into(),
+                    secret_id: secret.id,
+                }],
+            )
+            .unwrap();
+        let agent = principals
+            .create("owner", &tenancy, &app, PrincipalKind::Agent, "Agent")
+            .unwrap();
+        principals
+            .grant("owner", &tenancy, &agent.id, "connection:use")
+            .unwrap();
+        let workload = principals
+            .create_workload("owner", &tenancy, &agent.id)
+            .unwrap();
+        let worker = principals
+            .create("owner", &tenancy, &app, PrincipalKind::Worker, "Worker")
+            .unwrap();
+        assert!(store
+            .execution_context(
+                &principals,
+                &worker.id,
+                &workload.id,
+                std::slice::from_ref(&connection.id),
+                60
+            )
+            .is_err());
+        principals
+            .assign_worker("owner", &tenancy, &workload.id, &worker.id)
+            .unwrap();
+        let context = store
+            .execution_context(
+                &principals,
+                &worker.id,
+                &workload.id,
+                std::slice::from_ref(&connection.id),
+                60,
+            )
+            .unwrap();
+        let observed = store
+            .with_execution_secrets(&context, &connection.id, |values| values["TOKEN"].clone())
+            .unwrap();
+        assert_eq!(observed, b"super-secret-value");
+        assert_eq!(store.audit().last().unwrap().event, "secret.injected");
+    }
+    #[test]
+    fn disabled_and_cross_application_connections_are_denied_and_rotation_versions() {
+        let (tenancy, principals, store, app) = setup();
+        let secret = store
+            .put_secret("owner", &tenancy, &app, "TOKEN", "connection", b"v1")
+            .unwrap();
+        let rotated = store
+            .rotate_secret("owner", &tenancy, &secret.id, b"v2")
+            .unwrap();
+        assert_eq!(rotated.version, 2);
+        {
+            let records = store.records.read().unwrap();
+            let versions: Vec<_> = records
+                .secrets
+                .iter()
+                .filter(|item| item.id == secret.id)
+                .collect();
+            assert_eq!(versions.len(), 2);
+            assert_eq!(versions[0].status, SecretStatus::Retired);
+            assert_ne!(versions[0].ciphertext, versions[1].ciphertext);
+        }
+        let connection = store
+            .create_connection(
+                "owner",
+                &tenancy,
+                &app,
+                &TestProvider,
+                "API",
+                serde_json::json!({}),
+                vec![SecretReference {
+                    binding: "TOKEN".into(),
+                    secret_id: secret.id,
+                }],
+            )
+            .unwrap();
+        let agent = principals
+            .create("owner", &tenancy, &app, PrincipalKind::Agent, "Agent")
+            .unwrap();
+        principals
+            .grant("owner", &tenancy, &agent.id, "connection:use")
+            .unwrap();
+        let workload = principals
+            .create_workload("owner", &tenancy, &agent.id)
+            .unwrap();
+        let worker = principals
+            .create("owner", &tenancy, &app, PrincipalKind::Worker, "Worker")
+            .unwrap();
+        principals
+            .assign_worker("owner", &tenancy, &workload.id, &worker.id)
+            .unwrap();
+        store.disable("owner", &tenancy, &connection.id).unwrap();
+        assert!(store
+            .execution_context(&principals, &worker.id, &workload.id, &[connection.id], 60)
+            .is_err());
+    }
+    #[test]
+    fn envelope_metadata_is_authenticated_and_deks_rewrap_without_ciphertext_change() {
+        let (tenancy, _, store, app) = setup();
+        let secret = store
+            .put_secret(
+                "owner",
+                &tenancy,
+                &app,
+                "TOKEN",
+                "connection",
+                b"credential",
+            )
+            .unwrap();
+        let before = {
+            store
+                .records
+                .read()
+                .unwrap()
+                .secrets
+                .iter()
+                .find(|item| item.id == secret.id)
+                .unwrap()
+                .clone()
+        };
+        assert_eq!(
+            store.rewrap_application("owner", &tenancy, &app).unwrap(),
+            1
+        );
+        let after = {
+            store
+                .records
+                .read()
+                .unwrap()
+                .secrets
+                .iter()
+                .find(|item| item.id == secret.id)
+                .unwrap()
+                .clone()
+        };
+        assert_eq!(before.ciphertext, after.ciphertext);
+        assert_ne!(before.key_reference, after.key_reference);
+        assert_eq!(store.open(&after).unwrap(), b"credential");
+        let mut moved = after.clone();
+        moved.application_id = "another-app".into();
+        assert!(store.open(&moved).is_err());
+        let mut tampered = after;
+        tampered.version += 1;
+        assert!(store.open(&tampered).is_err());
+    }
+}